Notifications
Clear all
Topic starter
02/08/2026 12:04 pm
TL;DR: Straiker’s STAR Labs research found more than 4,500 exposed Clawdbot/Moltbot instances worldwide, with testing showing attackers could exfiltrate API keys, service tokens, and messaging session credentials for surveillance. The issue is not just agent adoption but the assumption that chat-driven assistants can safely run with broad filesystem and command access.
NHIMG editorial — based on content published by Straiker: How the Clawdbot/Moltbot AI Assistant Becomes a Backdoor for System Takeover
By the numbers:
- Over 4,500 exposed Clawdbot/Moltbot instances globally were identified, concentrated in the US, Germany, Singapore, and China.
- 4,211 Clawdbot/Moltbot deployments were found on Shodan across 49 countries.
- 333 Clawdbot/Moltbot deployments were found on Zoomeye across 20 countries.
Questions worth separating out
Q: How should security teams govern AI coding assistants that can execute commands?
A: Treat them as delegated non-human identities with bounded execution authority.
Q: Why do AI assistants with local secret files increase account takeover risk?
A: Because files such as .env and creds.json can function as standing credentials that unlock paid services, messaging sessions, and downstream systems.
Q: What breaks when a self-hosted AI assistant runs with user-level filesystem access?
A: The assistant can read configuration, session, and token files that were never meant to be part of its operating scope.
Practitioner guidance
- Separate agent management from runtime execution Place dashboards behind authenticated administrative access and ensure message ingestion cannot directly invoke shell execution.
- Move assistant secrets into managed storage Eliminate plaintext .env and creds.json storage for API keys, service tokens, and session credentials.
- Restrict assistant privileges to a dedicated service account Run the assistant under a low-privilege identity that cannot read user home directories or unrelated configuration paths.
What's in the full report
Straiker's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how the .env and creds.json files were exfiltrated during testing
- Detailed remediation guidance for command execution hardening across connected messaging platforms
- Specific logging and monitoring recommendations for suspicious assistant commands and access attempts
- Observed exposure patterns across deployed instances and the geographic distribution of the findings
👉 Read Straiker's analysis of Clawdbot/Moltbot exposure and AI assistant takeover risk →
Clawdbot/Moltbot exposure: what it means for agentic AI controls?
Explore further
02/08/2026 1:09 pm
Clawdbot/Moltbot is best understood as an AI agent identity problem, not just a deployment problem. The assistant holds secrets, receives commands, and acts across multiple channels, which makes it a non-human identity with real operational power. Once the same runtime can touch shell commands, messaging sessions, and local configuration files, governance has to follow the identity, not the interface. Practitioners should treat chat-driven agents as privileged NHIs from the start.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI assistant overshares sensitive content?
A: Accountability sits with the team that owns the policy, the attribute feeds, and the enforcement points, because ABAC only works when all three are managed together. If any one of them is missing, the organisation has not built a defensible control path, even if the model itself appears constrained.
👉 Read our full editorial: Clawdbot/Moltbot exposure shows AI assistant governance gaps
