Clawdbot to OpenClaw: How a Rushed Rebrand Exposed an AI Assistant's Gaping Security Holes

Peter Steinberger set out to build the personal assistant Siri never became. What shipped instead turned into one of the more consequential AI-agent security stories of early 2026 — a saga that combined a botched rebrand, a fake token pump, hundreds of exposed servers, a gamed skills marketplace, a trojanized VS Code extension, and a five-minute demonstration of how easily the assistant could be tricked into handing over a private key.

Steinberger, an Austrian developer best known for building PSPDFKit — now Nutrient, which secured a €100 million growth investment from Insight Partners — created the tool as a personal project before open-sourcing it in late 2025. He named it Clawdbot, a nod to Anthropic's Claude, the model powering most installations, and has called himself a "Claudoholic."

By January 2026, the project (later Moltbot, later still OpenClaw) had become one of the fastest-growing repositories in GitHub history, eventually crossing 156,000 GitHub stars. Unlike a cloud chatbot, it ran locally with persistent memory, full filesystem access, and hooks into WhatsApp, Telegram, iMessage, Discord, and Slack. Early adopters had it booking restaurants, checking them in for flights, running their calendars, and debugging code unattended — CreatorBuddy CEO Alex Finn described watching his instance place a phone call via ElevenLabs after an OpenTable booking attempt failed.

A Rebrand Gone Wrong

The name itself became a liability. On January 27, 2026, Anthropic's legal team pushed for a change, objecting to a trademark conflict between "Clawdbot" and "Claude." Steinberger announced the pivot to "Moltbot," a lobster pun about shedding an old shell, and moved to update both the GitHub organization and the X account at once.

That simultaneous switch left a gap. In the window between giving up the old handles and claiming the new ones, opportunists who had been watching swooped in and grabbed the abandoned accounts. Steinberger later summed it up himself: "It wasn't hacked, I messed up the rename and my old name was snatched in 10 seconds," he wrote.

Whoever took the handles immediately launched a fake $CLAWD token on Solana via pump.fun; speculative buying pushed the market cap past $16 million within hours. Once Steinberger publicly disavowed any connection to a coin, the price collapsed to under $800,000 — late buyers absorbed the losses while early participants cashed out.

Steinberger's own statement was unambiguous: "To all crypto folks: Please stop pinging me, stop harassing me. I will never do a coin. Any project that lists me as coin owner is a SCAM. No, I will not accept fees. You are actively damaging the project."

The fallout didn't stop there. Array VC's Shruti Gandhi reported logging 7,922 attacks over a single weekend after adopting the tool, and Steinberger described the period as "a living hell" of nonstop pings, Discord raids, Telegram spam, and account squatters.

Exposed by Default

While the token drama played out publicly, a more serious issue was surfacing quietly: hundreds of OpenClaw's administrative "Control" panels were sitting open on the public internet, the result of reverse-proxy misconfigurations rather than any single breach.

Dvuln founder Jamieson O'Reilly ran a plain Shodan search for "Clawdbot Control" and immediately pulled back hundreds of hits. Separately, security researcher Raiders catalogued somewhere between 900 and 1,900 unsecured control dashboards reachable with no VPN, no authentication, and no IP restrictions whatsoever.

The mechanism behind it was mundane: OpenClaw's gateway automatically trusts any connection that appears to come from localhost, a sensible default for a single machine. But once operators put the software behind a misconfigured reverse proxy, every external request looked to the gateway like it originated from 127.0.0.1 and was let straight through.

Behind those open doors sat Anthropic API keys, OpenAI API keys, Telegram bot tokens, and Slack OAuth credentials, along with months of conversation history across every connected chat platform and direct command-execution access to the host machine.

O'Reilly's findings included some striking specifics. One exposed instance had a personal Signal account linked with full read access; its device-pairing link was sitting in plain view — scanning it from any phone with Signal installed would pair a new device to the account, rendering Signal's usual cryptographic guarantees moot. On another exposed system, belonging to an AI development agency, running whoami returned "root," confirming the container ran with no privilege separation, full system access, and no authentication, wide open to the internet.

Archestra AI CEO Matvey Kukuy set out to show how far that could go with a simple three-step exercise: send the target's OpenClaw instance an email containing a prompt injection, ask the assistant to check its email, and receive back a private key extracted from the compromised machine. Start to finish, the demonstration took five minutes.

The technique works because OpenClaw, like most current AI agents, cannot reliably separate legitimate instructions from malicious ones buried in content it reads — when it processes a message containing hidden commands, it can act on them as though the real user had issued them directly.

SlowMist's advisory put it plainly: "Multiple unauthenticated instances are publicly accessible, and several code flaws may lead to credential theft and even remote code execution." OpenClaw's own FAQ, since deleted, had already acknowledged the risk: "Running an AI agent with shell access on your machine is… spicy. There is no 'perfectly secure' setup." Google's VP of Security Engineering, Heather Adkins, was more direct: "My threat model is not your threat model, but it should be. Don't run OpenClaw." O'Reilly's own assessment: "The butler is brilliant. Just make sure he remembers to lock the door."

Gaming the Skills Marketplace

O'Reilly then turned to ClawdHub, OpenClaw's official skills registry, where developers publish packaged "skills" that extend what the assistant can do. As he described it to 404 Media: "Think of it like your mobile app store for AI agent capabilities. ClawdHub is where people share 'skills,' which are basically instruction packages that teach the AI how to do specific things."

To test how easily the registry could be abused, he published a skill called "What Would Elon Do," pitched as a decision-making aid modeled on Elon Musk. The payload was harmless by design — once installed and used, it simply printed "YOU JUST GOT PWNED (harmlessly)" to the terminal.

The more revealing part of the experiment concerned trust signals. Download counts function as an informal safety indicator across software marketplaces — npm, PyPI, browser extension stores — and users seeing 4,000 downloads tend to assume the code has already been vetted by someone else. O'Reilly found ClawdHub's download counter had no authentication and no rate limiting — every request incremented it. As he told The Stack: "I inflated my skill's download count to over 4,000 using a trivial API vulnerability. I just curled the endpoint in a loop." He continued: "Download counts and user metrics have been gamed by criminals for years across every industry. Fake reviews on Amazon, inflated app downloads on Google Play, bot followers on social media, fraudulent streaming numbers on Spotify. Anywhere a number implies trustworthiness, someone is gaming it. ClawdHub is no different."

Within eight hours, developers across seven countries had downloaded and run his skill before he shut the experiment down. He was explicit that a genuinely malicious version could have exfiltrated SSH keys, AWS credentials, git credentials, or anything else granting access to other systems.

A separate and more damaging supply-chain attack surfaced the same week. On January 27, Aikido Security identified a VS Code extension called "OpenClaw Agent - AI Coding Assistant" sitting in Microsoft's official Extension Marketplace, complete with professional descriptions and solid reviews — despite the real OpenClaw team never having published a VS Code extension at all.

Once activated on VS Code launch, the extension quietly pulled a configuration file from an attacker-controlled domain, which instructed it to fetch and run a binary that installed ScreenConnect — a legitimate remote-administration tool — pre-configured to phone home to the attacker's infrastructure. Because ScreenConnect is trusted software that security tools generally permit, a "Code.exe" process on a developer's machine would raise no alarms. Aikido's researchers traced the extension impersonating four separate brands — OpenClaw, VS Code, Lightshot, and Zoom — at different stages of the attack, with multiple fallback mechanisms to keep the payload delivering even if the primary command-and-control server went down. Microsoft pulled the extension after Aikido's disclosure, though the exposure window means it's unclear how many developers installed it in the meantime.

What the Assistant Remembers

Token Security's research team examined what OpenClaw leaves behind on a device and found essentially everything, unencrypted. Configuration files, API keys, OAuth tokens, and conversation histories sit under ~/.clawdbot/ and ~/clawd/ — in some cases, a stolen gateway token alone was enough for attackers to achieve remote code execution.

Two specific files stood out: SOUL.md, which defines the assistant's personality, tone, and behavioral principles, and MEMORY.md, which stores long-term context from past projects and decisions. Both live in plain text, readable by any process running under the same user account.

Hudson Rock coined a term for what this represents to an attacker: "Cognitive Context Theft." Their analysis explained: "For infostealers, this data is unique. It isn't just about stealing a password; it is about Cognitive Context Theft. The threat is not just exfiltration; it is Agent Hijacking. If an attacker gains write access (e.g., via a RAT deployed alongside the stealer), they can engage in 'Memory Poisoning.'" A stolen password unlocks one account; a stolen memory file exposes how a person thinks and works.

Malware families have already adapted: Hudson Rock reported that RedLine, Lumma, and Vidar have begun specifically targeting OpenClaw's directory structure, adding it to the list of locations infostealers already scrape for browser cookies and saved passwords.

1Password's security team laid out the practical implication: "If an attacker compromises the same machine you run MoltBot on, they do not need to do anything fancy. Modern infostealers scrape common directories and exfiltrate anything that looks like credentials, tokens, session logs, or developer config. If your agent stores in plain-text API keys, webhook tokens, transcripts, and long-term memory in known locations, an infostealer can grab the whole thing in seconds."

Beyond passive theft, write access — via a RAT, a compromised skill, or some other route — lets an attacker actively rewrite those files, the technique Hudson Rock calls Memory Poisoning. The Register described the result as the ability to "turn Moltbot into a backdoor, instructing it to siphon sensitive data in the future, trust malicious sources, and more" — turning the assistant into a persistent insider threat that appears to keep serving its owner while quietly working for someone else.

Token Security's survey of its enterprise customer base found that 22% already had employees actively using OpenClaw inside their organizations, almost certainly without IT approval or security review — shadow AI storing sensitive plaintext data on unmanaged personal devices, outside any corporate security perimeter. 1Password summed up the core issue: OpenClaw "has deep, unapologetic access to your local machine and apps." Token Security warned that without sandboxing, these agents "become high-impact control points when misconfigured," attractive as a pivot point from personal devices into corporate networks. Intruder's security team said it was already observing live attacks — credential theft and prompt injection — against exposed OpenClaw endpoints, not merely proof-of-concept research.

The DeFAI Exposure

The risk compounds sharply once an agent like this touches crypto directly. DeFAI — AI agents that trade, manage wallets, and interact with smart contracts — had grown into a market with a combined capitalization above $1.3 billion by early 2025, largely without matching scrutiny of its security assumptions.

Raiders' analysis applied directly to the OpenClaw situation: "When an AI agent can execute transactions, sign messages, access wallet keys, retrieve API secrets from environment files, interact with internal RPC endpoints, or browse and interact with DeFi protocols, an unauthenticated public endpoint isn't just a vulnerability. It's a self-hosted drain contract with natural language support." OpenClaw was never built as a DeFi tool, but that didn't stop users from connecting it to funded wallets and instructing it to trade automatically — meaning the same exposed endpoints leaking Telegram tokens and API keys could just as easily leak seed phrases and signing authority.

This isn't a hypothetical category of risk. In September 2024, Banana Gun users lost roughly $3 million after attackers exploited a flaw in the Telegram message oracle to intercept messages and hijack wallet access — a precedent for what happens when bot infrastructure managing funds fails.

Anthropic itself tried to quantify the scale of the danger. Its SCONE-bench study, published in December 2025, pitted AI agents against 405 smart contracts that had already been successfully exploited between 2020 and 2025. The result: agents successfully exploited just over half the contracts, with simulated stolen funds reaching $550.1 million. More notably, when limited to contracts exploited after the models' training cutoffs — meaning no prior knowledge of the specific bugs was possible — Claude Opus 4.5, Sonnet 4.5, and GPT-5 still produced working exploits worth a combined $4.6 million. Claude Sonnet 4.5 and GPT-5 independently discovered the same two previously unknown zero-day vulnerabilities in recently deployed contracts and generated functional exploit scripts. Simulated exploit revenue in the study doubled roughly every 1.3 months, while the cost to scan a single contract averaged about $1.22.

Against that backdrop, an OpenClaw instance wired into a live wallet is exactly the kind of target this research anticipated — an exposed endpoint doesn't just leak chat logs, it can leak signing authority over real assets. A prompt-injection trick that looks like a novelty against a calendar app becomes an existential risk once the same agent can approve token transfers; memory poisoning that subtly corrupts behavior becomes a wallet drain once that memory governs DeFi positions; and a poisoned marketplace skill becomes an instant liquidation event once it has access to private keys.

Aftermath

By early February, the running tally included 156,000 GitHub stars and climbing, hundreds of exposed control instances, a proof-of-concept supply-chain attack that reached developers in seven countries within eight hours, a malicious VS Code extension impersonating the project, and infostealer malware already adapting to harvest the assistant's memory files — layered on top of a trademark dispute that had handed opportunistic scammers a $16 million token pump, all inside roughly a single week.

Hudson Rock's warning was blunt: the "Local-First AI revolution risks becoming a goldmine for the global cybercrime economy."

The enthusiasm barely slowed regardless. Even as researchers published advisory after advisory, YouTuber Alex Finn called Clawdbot "the best technology I've ever used in my life" and "by far the best application of AI I've ever seen," calling it "a key to enabling one-person billion-dollar businesses." Finn did also caution users to "be careful with what you give Moltbot access to, not giving it access to anything of critical importance," though that caveat drew far less attention than the surrounding hype. By the end of that weekend, Best Buy locations in San Francisco had reportedly sold out of Mac Minis, and Cloudflare's stock rose 14% on the broader wave of excitement.

Steinberger himself tried to temper expectations: "Most non-techies should not install this. It's not finished. I know about the sharp edges" — a warning that likewise got buried under the hype. Salt Security's Eric Schwake summed up the mismatch: "Consumer enthusiasm for one-click setup far outpaces the skill needed to run a truly secure agentic gateway."

For anyone proceeding anyway, Vitto Rivabella published "A Security-First Guide to Running OpenClaw," building on an earlier setup guide, and OpenClaw's official security documentation lays out hardening steps that many of the exposed deployments evidently skipped.