Clawdbot gateway attacks expose weak assumptions in agent access

At a glance

What this is: This is a live-traffic research report showing that exposed Clawdbot gateways were rapidly probed with protocol-aware attacks aimed at bypassing authentication, extracting secrets, and mapping connected nodes.

Why it matters: It matters because agent gateways can concentrate credentials, conversation history, and infrastructure reach in one interface, so IAM and NHI teams need to treat gateway trust assumptions as attack surface, not implementation detail.

Context

Clawdbot gateway security depends on explicit authentication, correct proxy trust handling, and tight control of the WebSocket API that fronts the agent. When those assumptions fail, the gateway becomes a single choke point for secrets, conversation history, and downstream infrastructure access.

This article is about agent access governance, not prompt safety alone. The attackers focused on the gateway layer, using protocol knowledge to test authentication bypasses, enumerate methods, and extract data that should never be exposed through a default-trusted control plane.

For IAM and NHI programmes, the interesting part is not that an AI agent is involved. It is that the agent gateway behaves like a privileged identity broker, so flaws in its trust model become identity and access failures at machine speed.

Key questions

Q: What breaks when an AI agent gateway treats proxy traffic as localhost?

A: Authentication collapses because the gateway can no longer distinguish a trusted local caller from an external client routed through a reverse proxy. That allows attackers to inherit local trust, reach privileged methods, and bypass the controls that were meant to separate remote traffic from administrative access.

Q: Why do protocol downgrade attempts matter in agent gateway attacks?

A: They matter because they can resurrect older handshake behaviour, auth defaults, or role checks that were removed in later releases. If downgrade paths remain open, attackers can target the weakest surviving version state instead of the current hardened one.

Q: What are the signs that an exposed agent gateway is being probed for privilege escalation?

A: Repeated health checks, system-presence calls, method enumeration, client impersonation, and requests for config or session data are all strong indicators. In combination, they show the attacker is mapping the gateway's control plane before attempting secret extraction or command execution.

Q: How should teams respond when an agent gateway exposes credentials and conversation history?

A: Treat it as a control-plane exposure, not a narrow application bug. Revoke any secrets reachable through the gateway, review connected integrations, inspect session and chat data for sensitive content, and isolate the gateway until authentication, proxy trust, and method authorization are verified.

Technical breakdown

WebSocket gateway trust and localhost assumptions

Clawdbot's gateway exposes a WebSocket API that controls agent functions and connected resources. The problem is not WebSocket itself, but the trust decision layered on top of it: authentication could be disabled by default, and reverse proxy traffic could be treated as localhost if proxy headers were not handled correctly. That turns network position into an implicit identity signal. Once an external connection is accepted as local, the gateway collapses authentication and authorization into a single brittle check, which attackers can probe with protocol-aware requests. In practice, the gateway becomes a privilege boundary with no reliable boundary markers.

Practical implication: never let proxy placement or loopback perception substitute for explicit gateway authentication and trusted proxy validation.

Protocol downgrade probing and version-targeted access

The traffic shows attackers testing minProtocol and maxProtocol values to force older protocol behaviour and reach previously patched weaknesses. That matters because agent gateways often evolve in release-specific ways, and scanners now target the exact state machine the implementation exposes. This is a classic version targeting pattern: the adversary is not exploring the product broadly, but selecting handshake values and client attributes that map to known historical gaps. When protocol negotiation is part of the access path, version drift becomes security drift. In a gateway that mediates agent commands, downgrade acceptance can revive authentication and role checks that operators assume are gone.

Practical implication: align protocol negotiation policy with patch state, and block downgrade paths that can re-open retired authentication behaviour.

Method enumeration as a credential and topology discovery path

The most revealing behaviour is method enumeration, especially calls such as config.get, chat.history, node.list, and sessions.list. These methods are not just informational. They expose secrets, private conversations, and the structure of multi-node deployments, which gives attackers both value and reach. In an agent gateway, discovery is not harmless reconnaissance because the control plane itself contains the data an attacker wants. That is why API inventory, method-level authorization, and response redaction matter as much as login control. Once a gateway leaks configuration or topology, the intrusion expands from access abuse into lateral movement planning.

Practical implication: inventory gateway methods, redact sensitive return fields, and treat discovery endpoints as privileged interfaces rather than harmless metadata.

Threat narrative

Attacker objective: The attacker wants privileged control-plane access that reveals secrets, private agent activity, and connected infrastructure for follow-on compromise.

1. Entry began with direct connections to exposed gateway WebSocket endpoints, including probes that tested health, system-presence, and alternative frame types to confirm the target was real.
2. Credential access followed through authentication bypass attempts, protocol downgrade requests, and client impersonation designed to reach config.get, chat.history, and other privileged methods.
3. Escalation occurred when attackers used accurate protocol knowledge to enumerate nodes, sessions, and capabilities, turning the gateway into an intelligence source for broader compromise.
4. Impact is the exposure of API keys, gateway credentials, messaging channel tokens, private conversation history, and multi-node infrastructure maps that support lateral movement.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Gateway trust based on localhost assumptions is a broken identity premise: This article shows that the control plane treated proxy-mediated traffic as local unless configuration and headers proved otherwise. That assumption was designed for simple deployment topologies, not adversarial routing through nginx, Caddy, or Traefik. The implication is that agent gateways need explicit trust decisions at the edge, because network proximity is not an identity claim.

Method-level exposure turns an AI gateway into an identity broker: The real risk is not only command execution but the fact that gateway methods expose secrets, chat history, and connected node topology in one place. That makes the gateway a high-value identity and access choke point rather than a thin transport layer. Practitioners should read this as a control-plane design problem, where authorization must be scoped per method and per data class.

Protocol downgrades reveal that patching alone does not end exposure: Attackers are testing handshake states, client roles, and version-specific behaviour to find any surviving weak path. This pattern validates that agent access control is a moving target when old protocol modes remain implicitly tolerated. The practical conclusion is that lifecycle governance for agent gateways must include retirement of legacy modes, not just patch deployment.

Conversation history and configuration data are now part of the attack surface: When a gateway returns chat.history and config.get without strong redaction and least privilege, the system exposes both secrets and user context at once. That is a broadening of blast radius, not a single vulnerability. The field should treat gateway data minimization as a core governance control, because AI agent systems concentrate sensitive operational memory.

Identity blast radius is the right named concept for this class of failure: The article shows how one exposed gateway can unlock credentials, conversations, and multi-node reach in the same session. That is not ordinary API leakage. It is identity blast radius, where a single access decision determines how far an attacker can move across the agent estate. Practitioners should use that framing when assessing agent gateways and adjacent NHI controls.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Identity blast radius: Agent gateways concentrate credentials, conversations, and node topology in one access path, so the real governance question is how far one successful session can travel. That shifts review from simple login assurance to method-level authorization, data minimization, and connected-system containment.

Legacy protocol behaviour is a governance debt, not just a patching issue. When old auth modes or downgrade paths remain reachable, the control plane can quietly preserve attack surfaces that operators believe were retired, which means lifecycle management has to include protocol retirement as well as software updates.

The 24,008 unique secrets exposed in MCP configuration files in 2025 alone shows why agent-facing configuration data is now a high-value target according to the State of Secrets Sprawl 2026. For practitioners, that means secret exposure controls must extend to agent gateways, not stop at the vault boundary.

For practitioners

• Harden gateway authentication defaults Require an explicit gateway.auth token or password on every deployment and remove any reliance on unauthenticated default modes.
• Validate trusted proxy handling Configure gateway.trustedProxies so reverse-proxy traffic cannot be mistaken for localhost, and verify the real client IP is enforced before any authorization decision.
• Restrict exposed methods by privilege Review methods such as config.get, chat.history, node.list, and sessions.list and ensure each returns only the minimum data needed for the calling role.
• Remove legacy protocol paths Disable older protocol versions and retired auth modes so downgrade attempts cannot re-enable pre-patch behaviour or bypass newer role checks.
• Isolate remote access to the gateway Keep the gateway off the public internet where possible and use VPN or tightly controlled access paths for any remote administrative use.

Key takeaways

• This report shows that exposed agent gateways can become privileged control planes, not just another application endpoint.
• The attack traffic combined protocol awareness, downgrade testing, and impersonation to reach secrets, history, and node mappings.
• Strong authentication, trusted proxy handling, and method-level least privilege are the controls that change the outcome here.

Key terms

• Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.
• Authentication Downgrade: Authentication downgrade is the act of steering a user from a stronger method to a weaker one during sign-in. In identity systems, it usually happens through fallback logic, browser detection quirks, or user-interface pressure that makes a weaker factor the easiest path to access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Method-Level Authorization: Method-level authorization restricts access at the business method rather than only at the route or page level. Java frameworks use annotations such as `@PreAuthorize` and `@Secured` to enforce this. It is a defence-in-depth control that helps prevent users from reaching sensitive actions through alternative paths.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.