28/01/2026
/ AI can be deployed on macOS, Windows, or Linux, and integrates with Telegram, WhatsApp, Discord, Slack, and Signal. Core capabilities include:
- Execute shell commands
- Control and automate browsers
- Read and write the local file system
- Manage email and calendars
- Integrate with Gmail, GitHub, Spotify, and smart home services
- Use AI models from Anthropic, OpenAI, Google, and others
Because it combines long-term memory with real-world system control, its permission model creates a very large attack surface. Security researchers warn that misconfiguration can allow attackers to gain full system control within minutes, including theft of cryptocurrency private keys.
Publicly exposed servers without authentication
- Many users deploy ClawdBot on VPS or public networks without enabling auth
- Reverse proxies often misclassify external traffic as localhost
- Full admin backends become openly accessible
- Exposed data includes API keys, OAuth secrets, bot tokens, chat histories, and signing keys
- Instances can be trivially discovered via Shodan
Prompt injection attacks
ClawdBot parses emails, documents, web pages, and chat messages
Attackers can embed malicious instructions in normal content
AI can be coerced to:
- Exfiltrate sensitive files
- Leak private keys
- Execute arbitrary system commands
- Upload data to attacker-controlled servers
Underlying protocol vulnerabilities (MCP)
- CVE-2025-49596 (CVSS 9.4): Unauthenticated system access
- CVE-2025-6514 (CVSS 9.6): Command injection
- CVE-2025-52882 (CVSS 8.8): Arbitrary file access and code ex*****on
Full system takeover risk
ClawdBot has:
- Shell access
- Browser automation
- Full filesystem permissions
REAL-WORLD ATTACKS AND OBSERVATIONS
- Researchers demonstrated private key exfiltration via malicious email prompts
- Public scans found instances exposing full chat histories and allowing message impersonation
- Signal pairing credentials have been observed stored in plaintext
- Multiple identity theft and account compromise cases likely remain unreported
MITIGATION AND HARDENING GUIDANCE
Immediate actions:
- Run the built-in security audit tool
- Enforce OAuth 2.1 or equivalent authentication
- Update Node.js and apply CVE-patched versions
- Correctly configure reverse proxy headers
- Bind services to localhost only and enforce strict firewall rules
DEFENSE-IN-DEPTH BEST PRACTICES
Deployment isolation:
- Use a dedicated physical machine or isolated VM
- Never install on a primary work or personal device
Network controls:
- Enforce strict IP allowlists
- Do not expose services directly to the internet
- Access only via VPN
Permissions and input handling:
- Treat all inputs as untrusted
- Require human approval for high-risk actions
- Disable unnecessary integrations
Credential management:
- Use least-privilege API keys
- Never store secrets in plaintext
- Regularly audit logs and configuration