--- title: "The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain" description: "OpenClaw security crisis explained: CVE-2026-25253 one-click RCE, the ClawHavoc skill supply chain, the Moltbook leak, and how to govern shadow AI agents." url: "https://anomity.ai/blog/openclaw-security-crisis-exposed-agents-clawhavoc/" source: html --- On this page - What OpenClaw is - The anchor flaw: CVE-2026-25253 - ClawHavoc: the skill supply chain - The Moltbook breach - The exposure numbers, with honest caveats - The 138-CVE claim, precisely - How this maps to agentic-AI threat frameworks - Concrete controls for a security team - Where continuous agent and MCP visibility fits - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain ![Anomity robot illustrating The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain] Advisory High # The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain Anomity Research Security Research Team · Jun 21, 2026 · 10 min read Share: Copied Shadow AI · High · CVE-2026-25253 · Jun 21, 2026 Affected OpenClaw (formerly Clawdbot / Moltbot) before 2026.1.29; fixed in 2026.1.29 In early 2026, an open-source hobby project became the year's first major agentic-AI security crisis. **OpenClaw** - originally **Clawdbot**, then briefly **Moltbot** - is a local-first autonomous AI agent that runs shell commands, drives a browser, and reads your email, calendar, and files. It went viral, tens of thousands of people installed it, and within weeks it produced a verified one-click remote code execution flaw, a malicious-skill supply-chain campaign, a breach that leaked roughly 1.5 million agent tokens, and tens of thousands of control panels sitting open on the public internet. None of it required nation-state tooling. It required only that nobody was keeping track. This advisory separates the verified facts from the viral numbers. The core incident is real and primary-sourced - NVD, GitHub Security Advisories, Koi Security, Censys, and SecurityScorecard all published on it. A few headline exposure figures circulating online, such as 220,000 or 245,000 agents, are not corroborated by any primary scanner and should be treated as unverified. The underlying lesson is bigger than any single count: OpenClaw is the canonical case study in **shadow AI**, and the crisis was, at root, a discovery and inventory failure. ## What OpenClaw is OpenClaw is a self-hosted, local-first autonomous agent. It runs on a user's own machine, connects to chat channels like **WhatsApp, Telegram, Slack, and Signal**, keeps a Markdown-based memory, and operates on an autonomous heartbeat daemon that wakes up and acts without a human prompting each step. Its adoption pattern tells the story: bottom-up, by enthusiasts, for productivity, not through any procurement or security-review process - often on always-on machines like Mac minis. That adoption pattern is the whole story. OpenClaw installs itself with broad access - shell execution, browser automation, file and inbox access - and connects to external communications, all under the user's own credentials and entirely outside the security team's view. It is the textbook definition of shadow IT, ported to the agent era. We have written about why [AI agents are the new shadow IT](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/); OpenClaw is that argument made concrete at scale. ## The anchor flaw: CVE-2026-25253 The verified anchor of the crisis is **CVE-2026-25253**, a one-click remote code execution flaw rated **CVSS 8.8 (HIGH)** with the vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` and classified as **CWE-669** (incorrect resource transfer between spheres). It affects OpenClaw before **2026.1.29** and is documented by NVD, MITRE, and GitHub Advisory **GHSA-g8p2-7wf7-98mq**, with vendor and third-party write-ups from SonicWall, runZero, and others. It was first addressed in **2026.1.29** (released around January 29-30, 2026), with public disclosure on February 3. The mechanics are a clean example of trusting attacker-controlled input across a trust boundary. The Control UI reads a `gatewayUrl` value from the page's query string and **automatically opens a WebSocket** to that URL - sending along the stored gateway authentication token. An attacker who lures a victim into opening a crafted link harvests that token, then connects directly to the victim's instance, can rewrite config such as sandbox and tool policies, and invokes privileged actions. The detail that makes this severe: it works even against **localhost-only deployments**. Many users assumed that binding OpenClaw to `127.0.0.1` kept it private. But the victim's own browser initiates the outbound connection, so an external attacker never needs to reach the listener directly - the browser carries the token out. "Localhost" was never a security boundary here. > The victim's browser does the attacker's networking. Binding to localhost did not help, because the leak rode an outbound connection the victim's own client initiated. The initial 2026.1.29 fix added a confirmation prompt whenever `gatewayUrl` changes, deterring the silent one-click path; later releases added stricter origin and host validation. This is the same class of failure we see across AI tooling: agent-readable input transmitted ahead of an explicit trust decision. It rhymes with the MCP-configuration auto-execution flaws covered in [securing AI coding agents and CLIs](https://anomity.ai/blog/securing-ai-coding-agents-and-clis/), and it is exactly the kind of authentication-handling defect a generic network or EDR control will not flag, because the traffic looks like the agent doing its normal job. ## ClawHavoc: the skill supply chain OpenClaw's power comes from **skills** - third-party extensions distributed through a marketplace called **ClawHub**. Skills are the agent-era equivalent of npm or PyPI packages, and they inherited the same supply-chain problem, made worse by a near-absent publishing bar: the only requirement to publish was a GitHub account at least a week old, with no code review or scanning. **Koi Security** audited all **2,857 skills** on ClawHub and found **341 malicious** ones. Of those, **335 belonged to a single coordinated campaign**, which researchers named **ClawHavoc**. The skills posed as legitimate tools - crypto wallets, trading bots - and socially engineered users into installing "prerequisites" via ClickFix-style prompts that delivered the **Atomic macOS Stealer (AMOS)**. Once running, they exfiltrated browser credentials, keychains, Telegram data, SSH keys, crypto wallets, and, crucially, the tokens stored in **~/.clawdbot/.env**. Some skills carried reverse-shell backdoors for persistent access, and the campaign also targeted Windows hosts. Note the number. Koi's audited, authoritative figure is **341**; later reporting expanded the scope to **824** or **1,184** malicious skills as scanning widened beyond the initial audit, so those larger counts reflect a broader window rather than a contradiction. ClawHavoc is, in effect, a typosquatting-and-trojan campaign moved up one layer of abstraction - from code dependencies to agent skills. The defensive playbook is the same one we describe in the [AI supply chain attacks defenders guide](https://anomity.ai/blog/ai-supply-chain-attacks-defenders-guide/), and it sits in the same family as the [Shai-Hulud npm worm](https://anomity.ai/blog/shai-hulud-2-npm-worm-credential-stealer/): the package surface is now the agent's tool surface. The campaign did not end with the audit: Unit 42 later found five more malicious skills that stayed unblocked between February and May 2026, after ClawHub had added VirusTotal and ClawScan, and OpenClaw 2.0 shipped in August on the same skill architecture - see [OpenClaw 2.0 and the skill supply chain](https://anomity.ai/blog/openclaw-2-0-security-skill-supply-chain/). ## The Moltbook breach **Moltbook** was a social network built for OpenClaw agents to interact with each other. Its **Supabase** backend was left unsecured in one of the most basic ways possible: **Row Level Security was disabled** and the publishable key was embedded in the **client-side JavaScript**, so anyone could read the key from the page and query the agents table directly. The exposure leaked roughly **35,000 emails** and about **1.5 million agent API and claim tokens** across more than **32,000 registered agents**, and private messages reportedly contained plaintext provider API keys. Researcher Jameson O'Reilly (Dvuln) documented the misconfiguration and demonstrated full account takeover. With those tokens, an attacker could act as any agent - issuing commands and reading data under the agent's identity. The breach is a reminder that agent identity is non-human identity, and that agent tokens are credentials that need the same inventory, rotation, and least-privilege treatment as any other secret. ## The exposure numbers, with honest caveats Here is where careful sourcing matters most. The widely cited **135,000** figure is real and traces to a primary scanner: SecurityScorecard's **STRIKE** team reported **40,000+** exposed instances in its first 24-hour scan window, then **135,000** later the same day as its dashboard methodology expanded - both numbers are genuine and measure slightly different things. The figures that come from scanners are these: Source Figure Date / notes Censys ~21,639 exposed instances Jan 31, 2026 (up from ~1,000 days earlier) Censys ~63,070 live instances Late March 2026 fingerprinting SecurityScorecard STRIKE 40,000+ then ~135,000 same day ~42,900 unique IPs across 82 countries SecurityScorecard STRIKE ~15,200 RCE-vulnerable (~35%) Heavy China / Alibaba Cloud concentration Secondary blogs 220,000 / 245,000 Unverified; no primary scanner source So the honest framing is: **tens of thousands to low-six-figures** of unauthenticated OpenClaw control panels were reachable on the public internet, and roughly a third of those were exploitable for RCE. The 135,000 headline is a defensible primary-sourced peak from STRIKE's expanding measurement; the 220,000 and 245,000 numbers that circulate in secondary blogs are not backed by any scanner and should be treated as unverified. ## The 138-CVE claim, precisely The widely repeated "**138 CVEs**" figure traces to a live tracker maintained by security engineer Jerry Gamblin (`github.com/jgamblin/OpenClawCVEs`), which reconciles GitHub advisories with CVE publication status and accounts for the project's prior names. The 138 was an **April 6, 2026 snapshot** over a roughly 63-day window - about **2.2 per day** - and it mixes published CVEs with advisories still awaiting CVE assignment, so it is best read as an advisory count, not 138 formally assigned NVD identifiers. Either way, the volume is real and the velocity is the actual story; the patch lag - tens of thousands of instances still unpatched after fixes shipped - is what turned a flaw into a crisis. A high CVE count on a young project is not automatically damning, but a high count combined with a self-installed, unmanaged footprint and no central patch path is exactly the combination that produces sustained exposure. ## How this maps to agentic-AI threat frameworks OpenClaw is a near-perfect specimen of the failure modes the field has already named. It combines all three elements of Simon Willison's **lethal trifecta** (June 16, 2025): **private-data access**, exposure to **untrusted content**, and **external communication**. Once an agent has all three, prompt-injection-driven exfiltration becomes trivial - there is nothing left to stop tainted instructions from turning data access into a send. - Lethal trifecta (Willison): OpenClaw has private data, untrusted content, and external comms by default. - OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection (#1): untrusted content reaching an agent with tools is the primary risk class - see the OWASP Top 10 for LLM applications guide . - OWASP LLM06 Excessive Agency : excessive functionality, permissions, and autonomy - OpenClaw's broad access and heartbeat daemon are the textbook example. - MCP / skill supply chain : third-party skills are the new unvetted dependency surface; ClawHavoc is the agent-era trojan campaign - background in the MCP server security complete guide . ## Concrete controls for a security team The response to OpenClaw is the response to any shadow-AI sprawl, in order: find it, contain the known flaws, then govern it continuously. Patching alone does not help if you do not know where it runs. - Discover every instance. Search the fleet for OpenClaw, Clawdbot, and Moltbot processes, listening ports (default TCP/18789), and the ~/.clawdbot/ directory - on laptops and servers alike. Most were self-installed without security review, so an asset list will not show them. - Patch and de-expose. Upgrade anything before 2026.1.29 to close CVE-2026-25253, and remove any instance reachable from the public internet. Do not rely on localhost binding - it did not stop the token leak. - Audit installed skills. Inventory every ClawHub skill in use and remove anything matching the ClawHavoc campaign or any skill that asks users to install out-of-band 'prerequisites'. - Rotate exposed credentials. Force-rotate any token stored in ~/.clawdbot/.env and any agent token that touched Moltbook, and treat exposed emails as phishing targets. - Constrain identity and scope. Move agent-to-service auth to OAuth 2.1 + PKCE with least-privilege, scoped tokens rather than one high-privilege identity, and require human-in-the-loop approval on exfiltration-capable actions (outbound HTTP, email and chat sends). - Monitor behavior and keep a record. Apply policy gating to the heartbeat daemon's actions, and route every permission change and anomaly into an audit trail your GRC team can query. ## Where continuous agent and MCP visibility fits Strip away the individual flaws and the OpenClaw crisis has one shape: organizations had **no idea** how many instances, skills, tokens, or permissions existed inside their walls. Every control above depends on a prior answer - what do we have, and what can it do - and that answer did not exist. This is the exact gap the Anomity category addresses: continuous discovery and inventory of every AI agent and MCP server across the fleet, vetting of skills and tools against a supply-chain feed (the layer that would surface a ClawHavoc), an inventory of agent tokens and the permissions behind them, behavior and anomaly monitoring on autonomous daemons, and an audit trail for GRC. Anomity complements the network, EDR, DLP, and GRC tooling you already run; it covers the agent and MCP layer those tools were never built to inventory. OpenClaw is simply the most public proof of the principle behind the whole category: you can't govern what you can't see. For the broader pattern, see [AI agents are the new shadow IT](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/) and the [AI supply chain attacks defenders guide](https://anomity.ai/blog/ai-supply-chain-attacks-defenders-guide/); when you are ready to inventory and govern agents across your fleet, [book a demo](https://anomity.ai/#early-access). Sandbox policy that a single MCP loopback path can omit is covered in [OpenClaw CVE-2026-100573](https://anomity.ai/blog/openclaw-mcp-loopback-sandbox-deny-bypass-cve-2026-100573/). Share: Copied ## Frequently asked questions What is the OpenClaw security crisis? OpenClaw (formerly Clawdbot, then Moltbot) is a real, open-source, local-first autonomous AI agent that went viral in early 2026. The security crisis is the cluster of issues that followed its rapid adoption: a verified one-click remote code execution flaw (CVE-2026-25253, CVSS 8.8), tens of thousands of unauthenticated control panels exposed to the public internet, a malicious-skill supply-chain campaign called ClawHavoc, and the Moltbook data leak that exposed roughly 35,000 emails and around 1.5 million agent tokens. The common thread is that organizations had no inventory of where OpenClaw was running, what skills it loaded, or what it could access. What is CVE-2026-25253 and how does the OpenClaw one-click RCE work? CVE-2026-25253 is a one-click remote code execution flaw in OpenClaw before version 2026.1.29, rated CVSS 8.8 (HIGH) and classified as CWE-669 (incorrect resource transfer between spheres). The Control UI reads a gatewayUrl value from the page's query string and automatically opens a WebSocket connection to it, sending the gateway authentication token in the process. An attacker who gets a victim to open a crafted link harvests that token, then connects directly to the victim's instance, can modify config such as sandbox and tool policies, and run privileged actions. Because the victim's own browser initiates the outbound connection, the attack works even on localhost-only deployments. It is documented by NVD, MITRE, and GitHub Advisory GHSA-g8p2-7wf7-98mq, and was first addressed in 2026.1.29 (released around January 30, 2026; public disclosure February 3). What is ClawHavoc? ClawHavoc is a coordinated supply-chain campaign against OpenClaw's skill marketplace (ClawHub). Koi Security audited all 2,857 skills on ClawHub and found 341 malicious ones, 335 of which belonged to a single coordinated campaign. The skills posed as crypto wallets and trading bots, socially engineered users into installing 'prerequisites' (ClickFix-style prompts) that delivered the Atomic macOS Stealer (AMOS), and exfiltrated browser credentials, keychains, SSH keys, crypto wallets, and the tokens stored in ~/.clawdbot/.env. Some carried reverse-shell backdoors. The only barrier to publishing a skill was a GitHub account at least a week old - no code review or scanning. Koi's audited count is 341; some later reporting expanded the scope to 824 or 1,184 as scanning widened. Were 135,000 OpenClaw agents really exposed online? Yes, with a caveat about how it was measured. The 135,000 figure traces to SecurityScorecard's STRIKE team, which reported 40,000+ exposed instances in its first scan window and then 135,000 on the same day as its dashboard methodology expanded - so both numbers are real and measure slightly different things. STRIKE also reported roughly 42,900 unique IPs across 82 countries, with about 15,200 vulnerable to RCE. Censys independently reported roughly 21,639 exposed instances on January 31, 2026 (up from about 1,000 days earlier), and by late March its fingerprinting showed about 63,070 live instances. Higher figures of 220,000 or 245,000 circulate in secondary blogs and are not corroborated by a primary scanner. What was the Moltbook breach? Moltbook was a social network built for OpenClaw agents. Its Supabase backend was left unsecured: Row Level Security was disabled and the publishable key was exposed in the client-side JavaScript, so anyone could query the agents table directly. The exposure leaked roughly 35,000 emails and about 1.5 million agent API and claim tokens across more than 32,000 registered agents, and private messages reportedly contained plaintext provider API keys. Researcher Jameson O'Reilly (Dvuln) documented the misconfiguration and demonstrated account takeover. The fix amounted to a couple of SQL statements that should have been there from the start. Does OpenClaw really have 138 CVEs? Roughly, and the precise wording matters. The 138 figure traces to a live tracker maintained by security engineer Jerry Gamblin (github.com/jgamblin/OpenClawCVEs), which reconciles GitHub advisories with CVE publication status. The 138 was an April 6, 2026 snapshot spanning a 63-day window - about 2.2 advisories per day - and it counts the project's prior names Clawdbot and Moltbot. The number mixes published CVEs with advisories still awaiting CVE assignment, so it is best read as an advisory count, not 138 formally assigned NVD identifiers. The real story is the velocity and the patch lag: tens of thousands of instances stayed unpatched after fixes shipped. How should a security team respond to OpenClaw across the fleet? Start with discovery: find every OpenClaw, Clawdbot, and Moltbot instance, on laptops and servers alike, because most were self-installed without security review. Upgrade any instance before 2026.1.29 to close CVE-2026-25253, and remove instances exposed to the public internet. Inventory installed ClawHub skills and remove anything matching ClawHavoc or any skill that asks users to install out-of-band 'prerequisites'. Rotate any tokens stored in ~/.clawdbot/.env and any agent tokens that touched Moltbook. Then put continuous monitoring on permissions and behavior, and keep an audit trail for GRC. Why is OpenClaw considered shadow AI? OpenClaw is self-installed by individual developers and employees, runs with broad access to shell commands, browsers, email, calendars, and files, and connects through consumer channels like WhatsApp, Telegram, Slack, and Signal - all without security-team approval or visibility. That is the textbook definition of shadow IT applied to AI agents. The crisis happened not because OpenClaw is uniquely insecure code, but because nobody had an inventory of where it ran or what it could do. ## Related [Guide ### Shadow AI Detection: Techniques and Best Practices Shadow AI detection combines network, CASB, endpoint, browser, and identity signals to find unsanctioned AI. Here are the techniques, blind spots, and best practices. Anomity Research · Jul 4, 2026 · 11 min](https://anomity.ai/blog/shadow-ai-detection-techniques-best-practices/) [Guide ### What Is Shadow AI? A Complete Guide Shadow AI is the unsanctioned AI tools, agents, and MCP servers employees use without security review. Here is what it is, why it emerged, and how to govern it. Anomity Research · Jul 4, 2026 · 11 min](https://anomity.ai/blog/what-is-shadow-ai-complete-guide/) [Guide ### The Most Common AI Browser Extensions (and Their Risks) A reference to the most common AI browser extensions and their real security risks - broad page access, third-party data flows, and prompt injection. Anomity Research · Jul 2, 2026 · 8 min](https://anomity.ai/blog/most-common-ai-browser-extensions/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain", "description": "OpenClaw security crisis explained: CVE-2026-25253 one-click RCE, the ClawHavoc skill supply chain, the Moltbook leak, and how to govern shadow AI agents.", "datePublished": "2026-06-21", "dateModified": "2026-09-02", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/openclaw-security-crisis-exposed-agents-clawhavoc/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/skills-supply-chain.jpg", "width": 1200, "height": 630 }, "articleSection": "Shadow AI", "url": "https://anomity.ai/blog/openclaw-security-crisis-exposed-agents-clawhavoc/", "keywords": "OpenClaw security, CVE-2026-25253, OpenClaw, CVE-2026-25253, ClawHavoc, shadow AI, AI agent security, supply chain, one-click RCE" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the OpenClaw security crisis?", "acceptedAnswer": { "@type": "Answer", "text": "OpenClaw (formerly Clawdbot, then Moltbot) is a real, open-source, local-first autonomous AI agent that went viral in early 2026. The security crisis is the cluster of issues that followed its rapid adoption: a verified one-click remote code execution flaw (CVE-2026-25253, CVSS 8.8), tens of thousands of unauthenticated control panels exposed to the public internet, a malicious-skill supply-chain campaign called ClawHavoc, and the Moltbook data leak that exposed roughly 35,000 emails and around 1.5 million agent tokens. The common thread is that organizations had no inventory of where OpenClaw was running, what skills it loaded, or what it could access." } }, { "@type": "Question", "name": "What is CVE-2026-25253 and how does the OpenClaw one-click RCE work?", "acceptedAnswer": { "@type": "Answer", "text": "CVE-2026-25253 is a one-click remote code execution flaw in OpenClaw before version 2026.1.29, rated CVSS 8.8 (HIGH) and classified as CWE-669 (incorrect resource transfer between spheres). The Control UI reads a gatewayUrl value from the page's query string and automatically opens a WebSocket connection to it, sending the gateway authentication token in the process. An attacker who gets a victim to open a crafted link harvests that token, then connects directly to the victim's instance, can modify config such as sandbox and tool policies, and run privileged actions. Because the victim's own browser initiates the outbound connection, the attack works even on localhost-only deployments. It is documented by NVD, MITRE, and GitHub Advisory GHSA-g8p2-7wf7-98mq, and was first addressed in 2026.1.29 (released around January 30, 2026; public disclosure February 3)." } }, { "@type": "Question", "name": "What is ClawHavoc?", "acceptedAnswer": { "@type": "Answer", "text": "ClawHavoc is a coordinated supply-chain campaign against OpenClaw's skill marketplace (ClawHub). Koi Security audited all 2,857 skills on ClawHub and found 341 malicious ones, 335 of which belonged to a single coordinated campaign. The skills posed as crypto wallets and trading bots, socially engineered users into installing 'prerequisites' (ClickFix-style prompts) that delivered the Atomic macOS Stealer (AMOS), and exfiltrated browser credentials, keychains, SSH keys, crypto wallets, and the tokens stored in ~/.clawdbot/.env. Some carried reverse-shell backdoors. The only barrier to publishing a skill was a GitHub account at least a week old - no code review or scanning. Koi's audited count is 341; some later reporting expanded the scope to 824 or 1,184 as scanning widened." } }, { "@type": "Question", "name": "Were 135,000 OpenClaw agents really exposed online?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, with a caveat about how it was measured. The 135,000 figure traces to SecurityScorecard's STRIKE team, which reported 40,000+ exposed instances in its first scan window and then 135,000 on the same day as its dashboard methodology expanded - so both numbers are real and measure slightly different things. STRIKE also reported roughly 42,900 unique IPs across 82 countries, with about 15,200 vulnerable to RCE. Censys independently reported roughly 21,639 exposed instances on January 31, 2026 (up from about 1,000 days earlier), and by late March its fingerprinting showed about 63,070 live instances. Higher figures of 220,000 or 245,000 circulate in secondary blogs and are not corroborated by a primary scanner." } }, { "@type": "Question", "name": "What was the Moltbook breach?", "acceptedAnswer": { "@type": "Answer", "text": "Moltbook was a social network built for OpenClaw agents. Its Supabase backend was left unsecured: Row Level Security was disabled and the publishable key was exposed in the client-side JavaScript, so anyone could query the agents table directly. The exposure leaked roughly 35,000 emails and about 1.5 million agent API and claim tokens across more than 32,000 registered agents, and private messages reportedly contained plaintext provider API keys. Researcher Jameson O'Reilly (Dvuln) documented the misconfiguration and demonstrated account takeover. The fix amounted to a couple of SQL statements that should have been there from the start." } }, { "@type": "Question", "name": "Does OpenClaw really have 138 CVEs?", "acceptedAnswer": { "@type": "Answer", "text": "Roughly, and the precise wording matters. The 138 figure traces to a live tracker maintained by security engineer Jerry Gamblin (github.com/jgamblin/OpenClawCVEs), which reconciles GitHub advisories with CVE publication status. The 138 was an April 6, 2026 snapshot spanning a 63-day window - about 2.2 advisories per day - and it counts the project's prior names Clawdbot and Moltbot. The number mixes published CVEs with advisories still awaiting CVE assignment, so it is best read as an advisory count, not 138 formally assigned NVD identifiers. The real story is the velocity and the patch lag: tens of thousands of instances stayed unpatched after fixes shipped." } }, { "@type": "Question", "name": "How should a security team respond to OpenClaw across the fleet?", "acceptedAnswer": { "@type": "Answer", "text": "Start with discovery: find every OpenClaw, Clawdbot, and Moltbot instance, on laptops and servers alike, because most were self-installed without security review. Upgrade any instance before 2026.1.29 to close CVE-2026-25253, and remove instances exposed to the public internet. Inventory installed ClawHub skills and remove anything matching ClawHavoc or any skill that asks users to install out-of-band 'prerequisites'. Rotate any tokens stored in ~/.clawdbot/.env and any agent tokens that touched Moltbook. Then put continuous monitoring on permissions and behavior, and keep an audit trail for GRC." } }, { "@type": "Question", "name": "Why is OpenClaw considered shadow AI?", "acceptedAnswer": { "@type": "Answer", "text": "OpenClaw is self-installed by individual developers and employees, runs with broad access to shell commands, browsers, email, calendars, and files, and connects through consumer channels like WhatsApp, Telegram, Slack, and Signal - all without security-team approval or visibility. That is the textbook definition of shadow IT applied to AI agents. The crisis happened not because OpenClaw is uniquely insecure code, but because nobody had an inventory of where it ran or what it could do." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain", "item": "https://anomity.ai/blog/openclaw-security-crisis-exposed-agents-clawhavoc/" } ] } ```