Hundreds of Clawdbot Gateways Expose API Keys and Private Chats to Security Breach

A significant vulnerability affecting hundreds of publicly exposed Clawdbot Control servers, potentially exposing sensitive API keys, private messaging credentials, and complete conversation histories to unauthorized access.

What is Clawdbot?

Clawdbot is an open-source AI agent gateway that connects large language models to messaging platforms including Telegram, Slack, Discord, Signal, and WhatsApp.

The software operates through two key components: the gateway itself, which handles AI agent logic, message routing, and tool execution, and Clawdbot Control, the web-based administrative interface for managing configurations, viewing conversation histories, and storing API credentials.

O’Reilly identified exposed instances using internet-wide scanning services like Shodan and Censys.

These platforms continuously index publicly accessible hosts across the IPv4 internet.

By searching for Clawdbot’s distinctive HTML fingerprint specifically the “Clawdbot Control” title tag the researcher located hundreds of exposed installations within seconds.

Many deployments lacked proper security configurations, leaving sensitive infrastructure completely accessible to anyone on the internet.

The exposed servers revealed multiple critical security issues. Two instances provided unrestricted access with no authentication whatsoever, immediately granting WebSocket handshake connections.

Exposed data included Anthropic API keys, Telegram bot tokens, Slack OAuth credentials and signing secrets, and months of private conversation histories across multiple platforms.

One particularly alarming case involved a Signal messenger account with full read access, including a device linking URI stored in world-readable temporary files.

Anyone accessing this credential could pair their device to the account and decrypt all messages, completely bypassing Signal’s end-to-end encryption protections.

Another exposed server belonging to an AI software agency had command execution enabled with root privileges.

O’Reilly demonstrated this by extracting the Soul.md configuration file, dumping environment variables containing plaintext API keys, and confirming root-level system access all without authentication.

Technical Vulnerability

The core issue stems from a proxy misconfiguration pattern. Clawdbot’s authentication system auto-approves localhost connections, assuming they originate from trusted local processes.

However, most real-world deployments use reverse proxies like nginx or Caddy on the same host.

These proxies forward all external traffic from 127.0.0.1, causing Clawdbot to treat every internet connection as local and auto-approve access without requiring authentication.

The gateway includes a trusted proxies configuration option that could prevent this bypass, but it defaults to empty.

When unconfigured, the system ignores X-Forwarded-For headers entirely, relying solely on socket addresses which always appear as loopback behind a reverse proxy.

Organizations running Clawdbot should immediately configure gateway authentication by enabling password protection via the CLAWDBOT_GATEWAY_PASSWORD environment variable.

Administrators must also properly configure the gateway.trustedProxies setting to correctly identify real client IP addresses.

All exposed API keys, bot tokens, and OAuth credentials should be rotated immediately. For enhanced security, deployments should use secure tunneling solutions like Tailscale or Cloudflare Tunnels instead of direct public internet bindings.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.