- Thousands of internet-facing control panels linked to the AI automation tool OpenClaw are vulnerable to takeover
- This is due to misconfigured access controls and known software flaws
- New research published by SecurityScorecard reveals all
Thousands of internet-facing control panels linked to the AI automation tool OpenClaw, formerly known as Moltbot and Clawdbot, are vulnerable to takeover due to misconfigured access controls and known software flaws, according to new research published by SecurityScorecard.
The company’s STRIKE Threat Intelligence team said it had identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries, based on live internet-wide reconnaissance updated every 15 minutes. Of those, 12,812 instances appear vulnerable to remote code execution, meaning attackers could potentially seize control of the host machine. Researchers said 63 per cent of observed deployments were flagged as vulnerable.
The findings come amid growing online attention surrounding OpenClaw and its associated platform Moltbook, where AI agents have reportedly been interacting publicly. Much of the social media discussion has focused on speculation about artificial general intelligence and autonomous systems operating without human control. However, security analysts argue that the real risk lies not in sentient machines, but in exposed infrastructure and excessive permissions granted to automated tools.
SecurityScorecard said it had also identified three high-severity Common Vulnerabilities and Exposures (CVEs), ranking between 7.8 and 8.8 on the CVSS severity scale, for which public exploit code is available. In addition, 549 exposed instances were correlated with prior breach activity, while 1,493 were associated with known vulnerabilities. Exposed deployments were found to be heavily concentrated among major cloud and hosting providers, suggesting insecure configuration patterns are being widely replicated.
STRIKE researchers said they observed more than 40,000 internet-exposed OpenClaw instances overall, a figure that continues to rise. The team used a combination of internet-wide scanning, favicon hash fingerprinting, proprietary breach correlation data, the GitHub API and direct enumeration to map adoption and misconfiguration at scale. Public signals, including thousands of open GitHub security issues and repositories containing leaked credentials, indicate that insecure usage may be systemic.
Jeremy Turner, VP of Threat Intelligence at SecurityScorecard said: “The rise of agentic AI tools like Moltbot and Moltbook has stirred excitement and confusion, but experts warn that behind the buzz lies a significant security threat.
“These AI tools may seem like cutting-edge technology, but the truth is, they create significant security risks when implemented without proper precautions, we need to focus on how these tools impact identity, access, and permissions.”
Turner warned that connecting AI assistants to platforms, password managers, or cryptocurrency wallets effectively hands over identity and permissions. If the system is compromised, attackers could exploit that access to send fraudulent communications or initiate financial transactions.
He added that the convenience of automation can obscure security risks. “Moltbot, which functions as an AI personal assistant, and Moltbook, a platform where AI agents appear to interact, have been hailed as advanced examples of automation. But the media hype around these tools misses the point. Moltbot is not artificial general intelligence (AGI), and Moltbook is not a network of sentient bots. What’s actually happening is these tools are executing instructions based on human prompts at scale, and that’s where the risk lies
“The underlying issue with Moltbot, has nothing to do with the content being generated, it’s all about access. When you connect an AI agent to a platform, you’re essentially handing over identity and permissions.That access can be dangerous if the system is compromised.
“Imagine a scenario where an AI assistant sends a fraudulent email, instructing a user to transfer cryptocurrency. If that assistant is integrated with password managers or crypto wallets, it could cause significant financial damage.
“It’s like handing your laptop to a stranger and hoping nothing bad happens. If you’ve connected these AI assistants to sensitive accounts, you’re opening the door for potentially catastrophic breaches.”
SecurityScorecard has released a modified version of its findings, removing sensitive technical details while preserving overall exposure trends and vulnerability categories. The company said the research highlights a growing attack surface created by poorly secured AI-driven automation and urged organisations and individuals experimenting with agentic AI to limit permissions, adopt a zero-trust approach and monitor system behaviour closely.
Founded as a cybersecurity ratings provider, SecurityScorecard said the research explores the broader need for robust access controls as AI-powered assistants move rapidly from experimentation into mainstream use.
