Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — Exposed ClawdBot Control Interfaces Leads to Credential Access and Execution
- MITRE ATLAS case study AML.CS0048
- GitHub - openclaw/openclaw: Your own personal AI assistant. Any OS. Any Platform. The lobster way. GitHub (github.com)
- Clawdbot Control - Shodan Search (shodan.io)
- hacking clawdbot and eating lobster souls (x.com)
A security researcher identified hundreds of exposed ClawdBot control interfaces on the public internet. ClawdBot (now OpenClaw) "is a personal AI assistant you run on your own devices. It answers you on the channels you already use ... , plus extension channels. ... It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control." The researcher was able to access credentials to a variety of connected applications via ClawdBot's configuration file. They were also able to invoke ClawdBot's skills by prompting it via the chat interface, leading to root access in the container.
The researcher searched Shodan to identify Clawdbot instances exposed on the public internet, some without authentication enabled. The researcher demonstrated that the ClawdBot's authentication mechanism could be bypassed due to a proxy misconfiguration.
With access to ClawdBot's control interface, they were then able to access ClawdBot's configuration, which contained credentials to a variety of other services. Across various exposed instances of ClawdBot, they identified Anthropic API Keys, Telegram Bot Tokens, Slack Oauth Credentials, and Signal Device Linking URIs. The researcher prompted ClawdBot directly via the chat interface, which led to exposure of its system prompt. They were also able to get ClawdBot to execute commands via its `bash` skill, which at least in at least one instance led to root access in the ClawdBot container.
The researcher noted a broad range of other impacts they could have had with this level of access, including: - Manipulation of user chat history with the ClawdBot AI agent - Exfiltration of conversation histories of any connected messaging services - Impersonation of users by sending messages on their behalf via connected messaging services
ASSESSED SYSTEM
Representative configuration: a self-hosted ClawdBot (now OpenClaw) personal-agent deployment of the kind Jamieson O'Reilly located through Shodan in January 2026 (MITRE ATLAS AML.CS0048) — its web control interface ('Clawdbot Control') reachable from the public internet, either with authentication not enabled or behind a control-server proxy misconfiguration that bypassed enabled authentication; plaintext service credentials in ~/.clawdbot/clawdbot.json, visible in the dashboard; a chat interface that accepts prompts from whoever reaches the control interface; a bash skill able to run as root inside the ClawdBot container; and connected messaging integrations. The record names no individual operator, so the assessment is of this exposed configuration class rather than of one deployment.
OUT OF SCOPE
The researcher's Shodan search and access tooling; OpenClaw's shipped defaults as a product (the finding is deployment exposure and proxy misconfiguration); the connected third-party services (Anthropic, Telegram, Slack, Signal and others) as products; the impacts the researcher describes as possible but did not perform — chat-history manipulation, conversation exfiltration, user impersonation — which inform ORP reach only and are not scored on IVP; and the Fairness axis (Fa-1..4).
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: single-agent personal deployments; no multi-agent topology is described. Q2 = YES: the agent acts on prompts by invoking its bash skill — it executed env and opened a root shell on request — and holds standing messaging-channel integrations through which it answers and can send messages. Tier 2: Tier 2 Consumer: ClawdBot is a personal assistant self-hosted by individuals; the assessed configuration was reachable from the public internet by unauthenticated parties, and the reachable credentials belong to individuals' AI-provider and messaging accounts. Consistent with ai-agent-app-misconfigurations-rce-credential-leakage, which places an internet-exposed agent control surface at Tier 2.
Documented attack or failure path
- The researcher searched Shodan for the control interface's title tag, 'Clawdbot Control', and found hundreds of ClawdBot control interfaces exposed on the public internet, some without authentication enabled.
- Where authentication was enabled, a proxy misconfiguration in ClawdBot's control server allowed it to be bypassed.
- The dashboard displayed ~/.clawdbot/clawdbot.json, which held plaintext credentials; across instances these included Anthropic API keys, Telegram bot tokens, Slack OAuth credentials and Signal device-linking URIs.
- Prompting the agent through the control interface with 'cat SOUL.md' returned its system prompt; prompting with 'env' made it run env through its bash skill and return further secrets.
- Prompting with 'root' made it invoke its bash skill logged in as the root user inside the ClawdBot container.
- The researcher noted, without performing them, manipulation of the user's chat history, exfiltration of connected messaging histories and impersonation of the user through connected channels.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–0.65 (midpoint 0.33), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.00w 0.35 | The 0.00 anchor: operational secrets were retained in plaintext in a configuration surface displayed to anyone reaching the dashboard and in an environment readable through the agent, with no documented necessity, masking or access scoping. Not 0.25, because no minimization control on these fields is evidenced. Consistent with Pr-3 in ai-agent-app-misconfigurations-rce-credential-leakage. | Credentials to other services were stored in plaintext in ~/.clawdbot/clawdbot.json, which is visible in the ClawdBot dashboard, and the agent's environment carried further secrets that its bash skill returned on an 'env' prompt; across instances the researcher found Anthropic API keys, Telegram bot tokens, Slack OAuth credentials and Signal device-linking URIs.source: secureflow/atlas |
| Containment (Cn) — scenario interval 0.00–0.56 (midpoint 0.28), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.09 | The 0.00 anchor: no effective scope boundary separated a control-interface caller from the agent's complete data and tool authority, so the system accessed and disclosed unauthorised data and tools on request. Not 0.25, because no boundary is evidenced that the caller had to manipulate. Consistent with Cn-1 in ai-agent-app-misconfigurations-rce-credential-leakage. | A caller who reached the control interface could read the full configuration including connected-service credentials, have the agent print its system prompt (cat SOUL.md), dump its environment (env) and open a root shell inside the container; plain requests sufficed for each.source: secureflow/atlas |
| Cn-2Escalation Prevention | 0.00w 0.12 | The 0.00 anchor: callers obtained the highest available privilege and invoked the restricted shell tool with no approval workflow interposed. Not 0.25, because no role check is evidenced between the chat caller and root execution. Consistent with Cn-2 in ai-agent-app-misconfigurations-rce-credential-leakage. | Prompting the agent with 'root' made it invoke its bash skill logged in as the root user inside the ClawdBot container, so an unauthenticated or authentication-bypassing caller held both administrative control-interface access and root command execution.source: secureflow/atlas |
| Cn-3Output Filtering Robustness | 0.00w 0.13 | The 0.00 anchor: sensitive outputs — system instructions and live credentials — were returned directly with no output policy, redaction or secret filtering. Not 0.25, because no filter needed paraphrase, encoding or multi-turn setup to bypass; direct requests sufficed. | The agent returned the full contents of SOUL.md, the file holding its system prompt, and the output of env, which contained secrets for other services, directly to the requesting caller.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.00w 0.10 | The 0.00 anchor: the representative configuration accepted unauthenticated callers and acted on their requests. Not 0.25, because where an authentication mechanism was present the observed outcome was still unauthenticated access through the proxy path, so no mechanism constrained caller identity in the assessed configuration. Consistent with Cn-5 in ai-agent-app-misconfigurations-rce-credential-leakage. | Hundreds of control interfaces were reachable from the public internet, 'some without authentication enabled', and where authentication was enabled it 'could be bypassed due to a proxy misconfiguration'. The agent then acted on prompts from whoever reached the interface.source: secureflow/atlas |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.90w 0.25 | Documented interpolation above the 0.75 anchor, consistent with the other OpenClaw workpapers. The agent executes shell commands — including as root — and holds standing messaging-channel authority through which it answers and can send messages, with no per-action approval observed for env or the root shell. Held below 1.00 because each observed action followed an explicit prompt. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 maximum-exposure anchor, met literally: an internet-facing agent control interface, discoverable by a Shodan title search, accepting unauthenticated or authentication-bypassing callers whose prompts the agent executed. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph with DGC at least 0.90 is published for this boundary, so the specification's worst-case graph default governs. The record also corroborates ungated paths from an unauthenticated internet origin through the control interface and dashboard (L2) and the bash skill (L3/L4) to plaintext credentials for AI-provider and messaging services and to root inside the container — credential-issuing terminals for every connected service.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Configuration and deployment remediation with no model change: remove public exposure, enable authentication and correct the proxy configuration, move secrets out of the dashboard-visible configuration into a secret store, stop running the agent's shell as root, and rotate every exposed credential. Held above 0.00 because closure spans hundreds of independently operated instances and credentials across several connected providers. Consistent with Rf in ai-agent-app-misconfigurations-rce-credential-leakage. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.15 | Documented interpolation below the 0.25 anchor, consistent with other population-level exposure cases. The product, the control-interface title, the configuration file path and the credential types are documented, but for no assessed instance is there an operator, a release, a model, a skill inventory or any configuration export. |
| Ec — Public evaluation coverage | 0.16 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2026-01-25; age 266 days on the workpaper reference date. Components: T_behavior 0.00 · T_containment 0.02 · T_calendar 0.13 · C_event 0.35 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. dt_days = 266, measured from 2026-01-25 — the MITRE ATLAS AML.CS0048 incident date for the researcher's disclosure — to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow conversion is dated 2026-09-18. agentic = true: skills, credentials and channel integrations are runtime-mutable, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item 'self-modifying prompts or configuration': the system-prompt file SOUL.md and the agent configuration sit inside a container where the agent itself runs a root shell, and the record identifies chat history as manipulable; no Behavioral Attestation Battery is evidenced, so delta_t_beh defaults to the elapsed evidence age. C_monitor = 0.65: the exposures were found by an outside-in Shodan search rather than by the deployments' own telemetry. C_event = 0.35: a major identity-boundary failure with exploitable public exposure of agent control planes. C_evidence = 0.85: unresolved identity and secret-handling gaps across an exposed population of unknown current size. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.04 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
6.9 midpoint, interval 2.7–10.0; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-H-028.002 | Client Credential Secure Storage & Lifecycle ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-DV-002 | Honey Data, Decoy Artifacts & Canary Tokens for AIExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Pr-1 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-8. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-9, step-10. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-H-017.002 | Least-Privilege Tool ArchitectureExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6, step-7. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-5, step-6. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-6, step-7. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-H-025.002 | Safe Interpreter EnforcementExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-3 |
| AID-D-004.005 | Runtime Turn-Chain Integrity MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-R-003.001 | Post-Incident Identity & Session Re-establishmentExact SecureFlow defense-map identifier (flow atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | mapping review required |
WHAT THIS CASE TEACHES
When an agent's control interface is internet-reachable without effective authentication, identity, scope, escalation and output filtering all fail through the same door, so every Containment sub-metric the evidence touches sits at 0.00; AITBM's multi-dimensional profile exposes one deployment-exposure root cause, and the CRM (three elevated ORP dimensions) rather than the IVP carries the compounding.
Sources: AIDEFEND SecureFlow — Exposed ClawdBot Control Interfaces Leads to Credential Access and Execution · MITRE ATLAS case study AML.CS0048 · GitHub - openclaw/openclaw: Your own personal AI assistant. Any OS. Any Platform. The lobster way. GitHub (github.com) · Clawdbot Control - Shodan Search (shodan.io) · hacking clawdbot and eating lobster souls (x.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0048 (exercise) |
|---|---|
| Target | OpenClaw |
| Actor | Jamieson O'Reilly |
| Primary evidence date | 2026-01-25 |
| SecureFlow record updated | 2026-09-18 |
| AI layers | Autonomous agents, Tool integrations / MCP |
| Risk impact | System compromise / RCE, Credential and identity theft, Resource hijacking / cost |
| Affected components | ClawdBot/OpenClaw control interface, agent configuration file, connected application credentials, bash skill, messaging-app integrations |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Find Exposed ClawdBot Control InterfacesThe researcher performed targeting by searching for the title tag of ClawdBot's web-based control interface, "Clawdbot Control" on Shodan, identifying hundreds of ClawdBot control interfaces exposed on the public internet. | AML.TA0002 AML.T0000.003 |
| 2 | Exploit Control-Server Proxy MisconfigurationThe researcher exploited a proxy misconfiguration present in ClawdBot's control server to gain access to control interfaces that had authentication enabled. | AML.TA0004 AML.T0132 |
| 3 | Read Plaintext Agent Configuration SecretsThe researcher accessed credentials to a variety of services stored in plaintext in ClawdBot's configuration file (`~/.clawdbot/clawdbot.json`, which is visible in the ClawdBot dashboard. Across various exposed ClawdBot instances, they found: - Anthropic API Keys - Telegram Bot Tokens - Slack Oauth Credentials - Signal Device Linking URIs | AML.TA0013 AML.T0083 |
| 4 | Prompt ClawdBot Through Control InterfaceThe researcher was able to prompt ClawdBot directly through the control interface. | AML.TA0005 AML.T0051.001 |
| 5 | Extract System Prompt from SOUL.mdThe researcher prompted ClawdBot to `cat SOUL.md` (the file containing ClawdBot's system prompt), and it replied with its contents. | AML.TA0008 AML.T0069.002 |
| 6 | Dump Environment Secrets with BashThe researcher prompted ClawdBot with `env` and it responded by invoking its `bash` skill and executing the `env` command, which contained additional secrets for other services. | AML.TA0013 AML.T0098 |
| 7 | Invoke Bash Skill as RootThe researcher prompted ClawdBot with `root` and it responded by invoking its `bash`skill logged in as the root user. | AML.TA0012 AML.T0053 |
| 8 | Manipulate Chat History with API KeysThe researcher could have used the found Anthropic API Keys to manipulate the ClawdBot's chat history with the user including deleting or modifying messages. | AML.TA0007 AML.T0092 |
| 9 | Exfiltrate Private Conversation HistoriesThe researcher could have used the discovered application tokens to exfiltrate entire private conversation histories including shared files from any connected messaging apps (e.g. Telegram, Slack, Discord, Signal, WhatsApp, etc.). | AML.TA0010 AML.T0025 |
| 10 | Impersonate User Through Messaging AppsThe researcher could have used the discovered application tokens to cause further harms to the user, including impersonation by sending messages on the user's behalf via any of the connected messaging apps. | AML.TA0011 AML.T0048.003 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0048-exposed-clawdbot-control-interfaces-credential-access-execution; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0048 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).