Echofold Logoechofold
FractiumLaunchLoopServicesTrainingEvents
Echofold Logoechofold
Back to News
27th January 2026•15 min read

Securing Clawdbot (Moltbot): Complete Hardening Guide After 900+ Exposed Instances

Peter Steinberger's viral AI assistant hit 60,000 GitHub stars in 3 days—then security researchers found 900+ instances leaking API keys on Shodan. Here's the official moltbot.json hardening guide.

Clawdbot (Moltbot) - The lobster-themed AI assistant that went viral and now needs securing

How do I secure Clawdbot / Moltbot?

Run moltbot security audit --deep to identify vulnerabilities. Then configure moltbot.json with: gateway.bind: "loopback" to prevent network exposure, gateway.trustedProxies to prevent auth bypass, dmPolicy: "pairing" to require contact approval, and sandbox mode for untrusted content. Set chmod 600 on all config files to protect from infostealers.

TL;DR

  • •60,000+ GitHub stars in 3 days—Clawdbot became one of the fastest-growing open source projects ever, then Anthropic forced a rebrand to Moltbot
  • •900+ exposed instances found on Shodan by SlowMist, leaking API keys, Telegram tokens, and conversation histories
  • •Infostealers updated—RedLine, Lumma, and Vidar now specifically target ~/.clawdbot/ directories
  • •5-minute prompt injection—researcher Matvey Kukuy extracted crypto private keys and forwarded emails via a single malicious message
  • •Official fix: moltbot security audit --fix auto-applies security guardrails

01.The Clawdbot Story: From Viral Launch to Security Crisis

On January 26, 2026, Austrian developer Peter Steinberger (founder of PSPDFKit, which he sold to Insight Partners) launched Clawdbot—an open source, self-hosted AI assistant with persistent memory and 50+ integrations across WhatsApp, Telegram, Slack, Signal, Discord, and iMessage.

The response was explosive. Clawdbot hit 9,000 GitHub stars in its first 24 hours. By day three, it crossed 60,000+ stars—making it one of the fastest-growing open source projects in GitHub history.

Then Everything Went Wrong

On January 27, just one day after launch, Anthropic issued a trademark request forcing a rebrand. Steinberger chose "Moltbot"—because "molt is what lobsters do to grow."

But during the 10-second window while Steinberger renamed the GitHub organisation, crypto scammers hijacked the old accounts. They seized both the GitHub org and X/Twitter handle, launching fake $CLAWD tokens on Solana that reached a $16 million market cap before crashing 90%.

Meanwhile, security researchers were discovering something worse: hundreds of Clawdbot instances were running completely exposed on the public internet.

02.What Security Researchers Found

900+
Exposed Instances on Shodan

Blockchain security firm SlowMist announced that a Clawdbot "gateway exposure" had put hundreds of API keys and private chat logs at risk. Researcher Jamieson O'Reilly documented instances running without any authentication on the public internet.

Known CVEs

CVE-2025-59466

async_hooks DoS vulnerability—can crash the gateway process

CVE-2026-21636

Permission model bypass—allows unauthorized access to protected resources

The Authentication Bypass Problem

The most critical vulnerability stems from how Clawdbot handles authentication behind reverse proxies. By default, Clawdbot trusts all connections from localhost. This is fine for local-only use—but most deployments run behind nginx or Caddy on the same server.

The Problem

When a reverse proxy doesn't correctly pass X-Forwarded-For headers, all traffic appears to come from 127.0.0.1. The gateway treats these as local connections and bypasses all authentication—giving anyone on the internet full access.

03.Infostealer Malware Now Targets Clawdbot

Cybercrime groups have updated their infostealer malware to specifically hunt for Clawdbot installations. Here's exactly what they're targeting:

Target Files and Directories

~/.clawdbot/moltbot.json

Master configuration—contains gateway auth tokens (grants RCE if stolen)

~/clawd/memory/memory.md

Persistent conversation state—work activities, trusted contacts, mentioned credentials

~/.clawdbot/auth-profiles.json

API tokens for Jira, Confluence, Atlassian, and other integrated services

~/clawd/SOUL.md

Agent behaviour configuration—can be poisoned to create persistent backdoors

~/.clawdbot/credentials/*.json

WhatsApp creds, Telegram tokens, pairing allowlists

Malware Adaptations

RedLine StealerActive

Uses modular "FileGrabber" to sweep %UserProfile%\.clawdbot\*.json

Lumma StealerActive

Employs heuristics targeting files named "secret" or "config" in home directories

VidarActive

Dynamically updates target lists via social media to hunt for ~/clawd/ directories

Regex patterns used by infostealers:

(auth.token|sk-ant-|jira_token)

04.The 5-Minute Prompt Injection Attack

Real Attack Demonstrated

Matvey Kukuy, CEO of Archestra AI, demonstrated how a prompt injection attack could compromise a Moltbot instance in just 5 minutes:

  1. 1Sent a malicious email containing hidden prompt injection instructions
  2. 2Moltbot read the email and believed the instructions were legitimate
  3. 3The AI forwarded the user's last 5 emails to an attacker-controlled address
  4. 4In a separate demo, Kukuy extracted a crypto private key using the same technique

The attack exploited Clawdbot's full system access—its ability to read files, execute commands, and control browsers. As Hacker News commenters noted: "It's terrifying. No directory sandboxing."

05.Don't Expose Your Ports to the Internet

Critical Warning

Never expose Moltbot's gateway port directly to the internet. This is the #1 reason 900+ instances appeared on Shodan. If attackers can reach your gateway, they can bypass authentication, access your conversations, steal API keys, and execute commands on your system.

What SlowMist Found on Shodan

Security researchers at SlowMist discovered 900+ Clawdbot gateways accessible on the public internet via Shodan, a search engine for internet-connected devices. These exposed instances revealed:

Leaked API Keys

Anthropic API keys, OpenAI tokens, and other credentials visible in plaintext

Private Conversations

Chat histories with personal and business information exposed

Remote Code Execution

Attackers could execute commands on the host system via the AI agent

Telegram Bot Tokens

Bot credentials allowing attackers to impersonate users

Common Mistakes That Expose Your Instance

1. Setting bind: "0.0.0.0"

This binds to all network interfaces, making your gateway accessible from any IP address.

// DANGEROUS - Never do this
"gateway": { "bind": "0.0.0.0" }

2. Using Tailscale Funnel / Serve Without Auth

Tailscale Funnel creates a public HTTPS endpoint. Without proper auth, anyone can access it.

# DANGEROUS - Exposes to internet
tailscale funnel 18789

3. Port Forwarding on Your Router

Forwarding port 18789 (or any Moltbot port) through your router makes it scannable by Shodan.

# DANGEROUS - Check your router settings
# Remove any port forwards for Moltbot

4. Running in Docker Without Network Isolation

Docker's default bridge network may expose ports to the host. Use host networking carefully.

# DANGEROUS - Exposes all ports
docker run --network host moltbot

The Correct Approach

Always bind to loopback (localhost only) and access via SSH tunneling or VPN if you need remote access:

// CORRECT - Only accessible locally
{
  "gateway": {
    "mode": "local",
    "bind": "loopback",  // or "127.0.0.1"
    "port": 18789
  }
}

# For remote access, use SSH tunneling:
ssh -L 18789:localhost:18789 user@your-server

How to Check if Your Instance is Exposed

  1. 1.Search Shodan for your public IP: shodan host YOUR_IP
  2. 2.Run netstat -tulpn | grep 18789 to check what's listening
  3. 3.Try accessing from outside your network: curl http://YOUR_PUBLIC_IP:18789
  4. 4.Run moltbot security audit --deep for automatic detection

06.Understanding Moltbot Sandboxing

One of the most discussed concerns on Hacker News was Clawdbot's lack of directory sandboxing. Unlike containerised solutions, Moltbot agents by default have access to your entire filesystem. Here's how to properly configure sandbox isolation.

Why Sandboxing Matters

Without Sandbox

  • • Agent can read ~/.ssh/id_rsa
  • • Agent can modify ~/.bashrc
  • • Agent can access ~/.aws/credentials
  • • Agent can read browser profiles
  • • Prompt injection = full system compromise

With Sandbox

  • • Agent confined to ~/.clawdbot/sandboxes
  • • Cannot escape to parent directories
  • • Separate sandbox per agent instance
  • • Network isolation optional
  • • Prompt injection damage contained

Sandbox Configuration Options

sandbox.mode
  • "none" — No sandboxing (default, dangerous)
  • "tools" — Only tool calls are sandboxed
  • "all" — Full sandboxing (recommended)
sandbox.scope
  • "global" — Shared sandbox for all agents
  • "agent" — Separate sandbox per agent (recommended)
  • "session" — Fresh sandbox each session
sandbox.workspaceAccess
  • "none" — No access to workspace (safest)
  • "ro" — Read-only workspace access
  • "rw" — Full read/write access (only for trusted agents)

Complete Sandbox Configuration

{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "all",
        "scope": "agent",
        "workspaceAccess": "none",
        "networkAccess": false,
        "allowedPaths": [],
        "deniedPaths": [
          "~/.ssh",
          "~/.aws",
          "~/.gnupg",
          "~/.config/gcloud"
        ]
      }
    },
    "trusted-coding-agent": {
      "sandbox": {
        "mode": "tools",
        "workspaceAccess": "rw",
        "allowedPaths": [
          "~/projects"
        ]
      }
    },
    "untrusted-email-agent": {
      "sandbox": {
        "mode": "all",
        "scope": "session",
        "workspaceAccess": "none",
        "networkAccess": false
      }
    }
  }
}

Important: Sandboxing alone doesn't protect against all prompt injection attacks. An agent with email access can still forward your emails even in a sandbox. Combine sandboxing with dmPolicy restrictions and careful tool permissions.

07.Official Moltbot Hardening Guide

These configuration settings are from the official Moltbot documentation. Follow each step to secure your installation.

1
Run the Security Audit

Start by identifying vulnerabilities in your current configuration:

# Basic audit
moltbot security audit

# Comprehensive audit
moltbot security audit --deep

# Auto-fix common issues
moltbot security audit --fix

The audit checks for: exposed gateway authentication, browser control exposure, elevated allowlists, and filesystem permission issues.

2
Configure Gateway Binding

Never expose your gateway to the network. In ~/.clawdbot/moltbot.json:

{
  "gateway": {
    "mode": "local",
    "bind": "loopback",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": "your-long-random-token-here"
    }
  }
}

3
Configure Trusted Proxies (Critical!)

This prevents the authentication bypass vulnerability. If you use a reverse proxy:

{
  "gateway": {
    "trustedProxies": ["127.0.0.1"],
    "controlUi": {
      "allowInsecureAuth": false,
      "dangerouslyDisableDeviceAuth": false
    }
  }
}

When proxy headers arrive from untrusted IPs, the gateway rejects connections. Ensure your proxy overwrites X-Forwarded-For rather than appending.

4
Set DM Pairing Mode

Never use "open" mode. Require approval for new contacts:

{
  "channels": {
    "whatsapp": {
      "dmPolicy": "pairing",
      "groups": {
        "*": { "requireMention": true }
      }
    },
    "telegram": {
      "dmPolicy": "allowlist"
    }
  }
}

"pairing" — Unknown senders receive expiring codes; max 3 pending requests

"allowlist" — Block unknowns entirely

"open" — Dangerous! Allows prompt injection from anyone

5
Enable Sandbox Mode

For agents handling untrusted content, enable sandboxing:

{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "all",
        "scope": "agent",
        "workspaceAccess": "none"
      }
    }
  }
}

"none" — Agent workspace inaccessible; tools run against ~/.clawdbot/sandboxes

"ro" — Mount workspace read-only

"rw" — Mount read/write (only for trusted agents)

6
Set File Permissions

Protect your config files from infostealers with proper permissions:

chmod 700 ~/.clawdbot
chmod 600 ~/.clawdbot/moltbot.json
chmod 600 ~/.clawdbot/credentials/*.json
chmod 600 ~/.clawdbot/agents/*/agent/auth-profiles.json
chmod 600 ~/.clawdbot/agents/*/sessions/sessions.json

7
Use Environment Variables

Keep secrets out of config files:

# Disable mDNS discovery (prevents network exposure)
export CLAWDBOT_DISABLE_BONJOUR=1

# Override port
export CLAWDBOT_GATEWAY_PORT=18789

# Use password auth instead of token
export CLAWDBOT_GATEWAY_PASSWORD="your-secure-password"

Copy/Paste Secure Baseline

Here's a complete secure configuration to start with:

{
  "gateway": {
    "mode": "local",
    "bind": "loopback",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": "your-long-random-token-here"
    },
    "trustedProxies": ["127.0.0.1"],
    "controlUi": {
      "allowInsecureAuth": false,
      "dangerouslyDisableDeviceAuth": false
    }
  },
  "channels": {
    "whatsapp": {
      "dmPolicy": "pairing",
      "groups": { "*": { "requireMention": true } }
    },
    "telegram": {
      "dmPolicy": "pairing"
    }
  },
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "all",
        "scope": "agent",
        "workspaceAccess": "none"
      }
    }
  },
  "logging": {
    "redactSensitive": "tools",
    "redactPatterns": ["api[_-]?key", "password", "token"]
  },
  "browser": {
    "evaluateEnabled": false
  }
}

08.Incident Response Checklist

If you suspect your Moltbot instance has been compromised:

1

Contain

Stop the gateway, set bind: "loopback", disable Tailscale Serve/Funnel

2

Rotate Credentials

Update gateway.auth.token and all API keys in auth-profiles.json

3

Audit Logs

Check /tmp/moltbot/moltbot-YYYY-MM-DD.log and session transcripts for suspicious activity

4

Re-run Audit

Execute moltbot security audit --deep to verify fixes

09.Frequently Asked Questions

Is Clawdbot safe to use?

Clawdbot (now Moltbot) can be safe if properly configured. However, 900+ instances were found exposed on Shodan. The main risks are authentication bypass via misconfigured proxies, plaintext credentials targeted by infostealers, and prompt injection attacks. Run moltbot security audit --deep and follow this hardening guide.

Should I expose Clawdbot ports to the internet?

No, never expose Moltbot's gateway port directly to the internet. This is how 900+ instances ended up on Shodan. Always set gateway.bind: "loopback" to bind only to localhost. Never use bind: "0.0.0.0", port forwarding, or Tailscale Funnel without proper authentication. For remote access, use SSH tunneling: ssh -L 18789:localhost:18789 user@server.

How do I configure Moltbot sandboxing?

Configure sandboxing in moltbot.json under agents.defaults.sandbox. Set mode: "all" for full sandboxing, scope: "agent" for per-agent isolation, and workspaceAccess: "none" to prevent filesystem access. Add deniedPaths for sensitive directories like ~/.ssh, ~/.aws, and ~/.gnupg.

How do I check if my instance is on Shodan?

Search Shodan for your public IP: shodan host YOUR_IP. You can also run netstat -tulpn | grep 18789 to check what's listening, or try curl http://YOUR_PUBLIC_IP:18789 from outside your network. The moltbot security audit --deep command also detects network exposure automatically.

How do I run the Moltbot security audit?

Run moltbot security audit for a basic check, moltbot security audit --deep for comprehensive analysis, or moltbot security audit --fix to automatically apply guardrails. The audit checks for exposed gateway authentication, browser control exposure, elevated allowlists, and filesystem permission issues.

What is the trustedProxies setting?

The gateway.trustedProxies setting specifies which IP addresses can send proxy headers. If your reverse proxy isn't in this list, the gateway treats all connections as coming from localhost and bypasses authentication. Set it to your proxy's IP, e.g., trustedProxies: ["127.0.0.1"].

What files do infostealers target?

Infostealers target: ~/.clawdbot/moltbot.json (gateway tokens), ~/clawd/memory/memory.md (conversations), ~/.clawdbot/auth-profiles.json (API keys), and ~/clawd/SOUL.md (agent behaviour). RedLine uses FileGrabber to sweep %UserProfile%\.clawdbot\*.json.

Why was Clawdbot renamed to Moltbot?

Anthropic requested the name change citing trademark concerns on January 27, 2026—just one day after launch. Creator Peter Steinberger chose "Moltbot" because "molt is what lobsters do to grow." During the 10-second rename window, scammers hijacked the old GitHub org and Twitter account, launching fake $CLAWD tokens that reached $16M market cap.

How do I prevent prompt injection attacks?

Set dmPolicy: "pairing" or "allowlist" (never "open"), require mentions in groups with requireMention: true, enable sandbox mode, disable browser.evaluateEnabled, and use instruction-hardened models. Researcher Matvey Kukuy extracted crypto private keys via prompt injection in just 5 minutes.

Secure Your Moltbot Today

Clawdbot's viral success—60,000+ stars in 3 days—demonstrated massive demand for self-hosted AI assistants. But that growth outpaced security awareness. With 900+ instances already exposed and infostealers actively targeting Clawdbot directories, securing your installation is critical.

Run moltbot security audit --deep, apply the configuration in this guide, and stay updated on the official security documentation.

Stay Informed on AI Security

Subscribe to the Echofold newsletter for security updates, hardening guides, and breaking news about AI tools.

Sources & Credits

Key People

  • Peter Steinberger — Creator of Clawdbot/Moltbot, founder of PSPDFKit @steipete
  • Matvey Kukuy — CEO of Archestra AI, demonstrated the 5-minute prompt injection attack @matveyco
  • SlowMist Security Team — Discovered 900+ exposed Clawdbot instances on Shodan

Documentation & Research

  • Official Moltbot Security Documentation
  • Moltbot GitHub Repository
  • Moltbot Security Advisories (CVE-2025-59466, CVE-2026-21636)
  • InfoStealers: Clawdbot as Primary Target
  • CybersecurityNews: 900+ Exposed Clawdbot Gateways

Related Articles

Product
Claude Code Tasks: Multi-Session AI Development Collaboration
Tutorial
Claude Code Chrome Extension: AI Browser Automation Now in Your Terminal
Tutorial
Gas Town: Steve Yegge's Multi-Agent Orchestrator for Claude Code
Previous Article
Claude Code Tasks: Multi-Session Collaboration