Vibe coding exposes 140,000+ instances to open internet

A popular but notoriously insecure AI platform has exposed even more people to cyber risk.

The free, open-source AI agent platform OpenClaw has exposed more than 140,000 instances to the open internet, with researchers warning of a systemic security failure.

If you’ve never heard of OpenClaw, you may not be alone. Despite only being launched in November, it’s already had several names: first ClawdBot, then – after trademark complaints by Anthropic – Moltbot. That one stuck for three days before it was rechristened to OpenClaw.

If Moltbot sounds familiar, you’re probably associating it with Moltbook . The “social media network for AI agents” went viral in late January and was built using Moltbot OpenClaw.

So, what is OpenClaw? Simply, it's an agentic interface for LLMs, using messaging platforms like Signal, Telegram and Discord as its UI. That – along with its free and open source (FOSS) licensing model – makes it highly accessible.

Therein lies the problem.

"Our findings reveal a massive access and identity problem created by poorly secured automation at scale," says SecurityScorecard's STRIKE threat intelligence team. “The research underscores how convenience-driven deployment, default settings, and weak access controls have turned powerful AI agents into high-value targets for attackers.”

They added, “Our live reconnaissance data reveals tens of thousands of internet-facing OpenClaw deployments, many running vulnerable versions, many already correlated with prior breaches. Some users are configuring bots with personal names and company names, revealing who is using these tools.”

That’s on top of OpenClaw’s existing vulnerabilities, like its skill store – where people can extensions for the bot – being full of malicious plugins. Its “skills” have also been found to be easy to hack, leaking APIs and personal information.

At the time of Security Scorecard’s report, it had identified 40,000 exposed OpenClaw instances. That number has since increased to 142,000, according to the company’s “Declawed” page , where it tracks OpenClaw threats.

Generative and agentic AI tools are fantastic in theory, giving people access to greater control of tools for their work and personal life than ever before. The problem is that many are deployed without even basic security controls.

OpenClaw is specifically built to create AI agents that can execute tasks, interact with external services and operate continuously. But they have a familiar risk pattern: internet-facing management interfaces; privileged identities tied to automation; weak or missing authentication controls; exposed tokens, API keys and configuration secrets; and they run vulnerable software versions by default.

In addition, “High concentrations of exposed instances appear within a small number of major hosting providers, suggesting insecure deployment templates are being reused at scale. Forty-five percent are hosted on Alibaba Cloud, with 37% of instances in China.”

The research adds, “These findings point to a systemic security failure, not a niche issue affecting few.”

SecurityScorecard's VP of threat intelligence and research, Jeremy Turner, told The Register that many of these issues are there by design. That’s because OpenClaw is built to make system changes and expose additional services to the web by its nature:

"It's like giving some random person access to your computer to help do tasks. If you supervise and verify, it's a huge help. If you just walk away and tell them all future instructions will come via email or text message, they might follow instructions from anyone."

While the AI industry races to build and promote AI agents, “the security model is largely uncharted,” the report authors warn.

“Attackers will follow the same path they did with cloud consoles, exposed databases, and file transfer software, targeting convenience, defaults, and scale. The attackers won’t get command-line access. They’ll get a conversational interface to your entire digital life.”

Security teams should act now and, at least, ensure they have full visibility of AI agents in their infrastructure.