A viral AI tool renamed itself twice in the last fourteen days.
It started as Clawdbot, a clever play on Anthropic’s “Claude.” Then, facing a trademark dispute, it panicked and became Moltbot. A week later, realizing that sounded like a shedding reptile, it rebranded again to OpenClaw.
To the marketing team, this was a pivot. To the security world, it was a smoke grenade.
In the chaos of the renaming, the update chains broke. Automated dependency scanners failed. And thousands of users who installed the “viral hit” two weeks ago forgot to update.
Now, they are running a zombie application that is actively being scanned by infostealers.
I spent the weekend analyzing the blast radius on Shodan. The results aren’t just bad; they represent a fundamental shift in how we need to think about “Shadow AI.”
The Scan: Hunting for Ghosts
To understand the scale of the exposure, I didn’t initially look for the current software. I looked for the ghosts.
Using Shodan, a search engine for internet-connected devices, I scanned for the specific HTML “fingerprints” of the admin panels on port 18789 (the default port for the agent’s gateway).
The Search Queries (Dorks): Below are the search queries used to verify these metrics. Note: A Shodan account is required to view full results.
Generation 1 (Abandoned): http.title:"Clawdbot Control" port:18789
Generation 2 (Transition): http.title:"Moltbot Control" port:18789
Generation 3 (Current): http.title:"OpenClaw Control" port:18789
The Metrics (Updated: Feb 4, 2026):
Total Exposed Instances: ~4,350
“Clawdbot” (Unpatched/Critical): ~2,750 (63%)
“Moltbot” (Transition): ~1,100 (25%)
“OpenClaw” (Patched): ~500 (12%)
The data tells a brutal story: Over 60% of the visible infrastructure is running code that is effectively abandonware. These users likely installed the tool when it was trending on X, played with it for an hour, and left it running on a cloud server.
They aren’t looking for patches for “OpenClaw” because they don’t even know that’s what they are running.
⚠️ Legal Warning: While these dashboards are exposed, accessing a system you do not own, even one without a password, is a violation of the Computer Fraud and Abuse Act (CFAA) in the US and similar laws globally. Look, but do not touch.
The “Localhost” Fallacy
So, why are these agents exposed? It isn’t a sophisticated backdoor. It is a collision between modern deployment habits and naive software architecture.
The software was designed to run on your laptop or local workstation (localhost). When running locally, it doesn’t ask for a password because it assumes you are the only one who can reach it.
But users didn’t run it on laptops. They deployed it to DigitalOcean, AWS, and Hetzner droplets so it could run 24/7.
The Mistake: They put a Reverse Proxy (like Nginx or Caddy) in front of it to make it accessible from the web.
The Exploit: The agent sees the request coming from the Reverse Proxy (which is running on the same machine) and thinks, “Oh, this request is from localhost. Come right in.”
It strips the authentication. My analysis shows that 68% of these exposed instances return a 200 OK status on the /api/config endpoint.
The Impact: What Is Actually Being Stolen?
This is where the “AI Agent” threat model diverges from anything we’ve seen with IoT or WordPress. An exposed webcam can watch you. An exposed AI agent can act for you.
Based on current vulnerability reports (CVE-2026-25253), here is what attackers are currently extracting from these zombie instances:
1. The Wallet (Financial Impact) The most immediate target is the config.json file. This plaintext file contains the user’s API keys for OpenAI, Anthropic, and Replicate…and more.
The Attack: Scrapers grab the keys and resell them on the dark web or use them to fine-tune their own malicious models.
The Cost: Because many users enable “Auto-Refill” on these billing accounts, the financial damage can hit five figures in hours before the card declines.
2. The Identity (Social Impact) These agents are designed to integrate. They hold active session tokens for Slack, Telegram, and Discord to “read messages” for the user.
The Attack: An attacker dumps the session token and impersonates the user.
The Impact: They don’t just read your DMs; they can post phishing links to your company Slack as you, bypassing the usual skepticism colleagues might have for external emails.
3. The Hands (Physical/System Impact) This is the critical difference. “Clawdbot” was popular because it had “God Mode”… the ability to execute terminal commands (/bin/bash) and manage the file system.
The RCE: Because the exposed dashboard allows unauthenticated command execution, an attacker has full Remote Code Execution (RCE) privileges on the host server.
The Result: They aren’t just stealing data; they are installing crypto miners, lateral movement tools, or ransomware.
The Signal in the Noise
The lesson here isn’t just “patch your software.” It is about the volatility of the AI ecosystem.
In the Gold Rush of 2026, tools are being built, hyped, rebranded, and abandoned in the span of a single sprint. We are accruing technical debt not over years, but over hours.
How to Fix It: If you are running any version of this tool, you must explicitly bind the port to localhost in your Docker command.
BAD:
-p 18789:18789(Exposes to the world)GOOD:
-p 127.0.0.1:18789:18789(Accessible only to the host)
If you are running OpenClaw, at a minimum, run: openclaw security audit
If you installed a tool named “Clawdbot” two weeks ago: Kill it. Don’t let the noise of a rebrand hide the signal of an open door.
Resources & Further Reading
The Technical Mechanics
Tools and concepts mentioned in the forensic analysis.
Shodan Query Fundamentals - Shodan Help Center
Why it’s relevant: The official guide to using the search filters (
port:,http.title:) demonstrated in the article to find exposed services.
Container Networking & Port Publishing - Docker Documentation
Why it’s relevant: Explains the critical difference between binding to
0.0.0.0(public) versus127.0.0.1(localhost), which is the root cause of the “Zombie Agent” exposure.
OWASP Top 10 for LLM Applications - OWASP Foundation
Why it’s relevant: Specifically looks at “LLM08: Excessive Agency” and “LLM09: Overreliance,” which explain why an exposed AI agent is more dangerous than a passive webcam.
HTTP Host Header Attacks - PortSwigger (creators of Burp Suite)
Why it’s relevant: A deep dive into how reverse proxies and misconfigured headers can trick applications into thinking remote requests are local (the “Localhost Fallacy”).
The Security Landscape
Understanding the broader risks of “Shadow AI” and supply chain volatility.
Securing the Software Supply Chain - CISA
Why it’s relevant: Recommended practices for developers to prevent the kind of “broken update chain” vulnerabilities described in the Moltbot/OpenClaw rebranding chaos.
CISO Guide to Shadow AI - reco
Why it’s relevant: An executive-level overview of how unmanaged, employee-adopted AI tools create invisible risk surfaces in the enterprise.
Legal & Ethical Context
The boundaries of security research.
The Computer Fraud and Abuse Act (18 U.S.C. § 1030) - Cornell Law School
Why it’s relevant: The federal statute that makes “unauthorized access” a crime. It validates the warning that accessing these open dashboards… even without a password… carries significant legal risk.