Moltbot security concerns continue to dominate discussions among cybersecurity experts, even after the agentic AI assistant rebranded from Clawdbot following trademark disputes with Anthropic. The open-source personal assistant has gone viral in AI and developer circles, but security professionals are questioning whether users should trust it with access to their most sensitive accounts and credentials.

The AI assistant operates through messaging apps like WhatsApp and Telegram, offering agentic capabilities that allow it to manage emails, calendars, phone calls, and restaurant reservations with minimal user intervention. However, this functionality requires users to grant the system access to encrypted messenger apps, phone numbers, email accounts, and even banking credentials.

Public Exposure Vulnerabilities

Jamieson O’Reilly, founder of red-teaming company Dvuln, discovered hundreds of Clawdbot instances exposed to the web, potentially leaking sensitive information. His Shodan scans revealed that many installations suffered from proxy misconfigurations and localhost connections that auto-authenticated, creating serious security vulnerabilities.

“Of the instances I’ve examined manually, eight were open with no authentication at all and exposing full access to run commands and view configuration data. The rest had varying levels of protection.”

Jamieson O’Reilly, Founder of Dvuln

The attack model O’Reilly reported to Moltbot’s developers has since been fixed, but the vulnerability could have allowed attackers to access months of private messages, account credentials, and API keys from compromised instances.

Supply Chain Exploit Demonstration

O’Reilly later published a proof-of-concept supply chain exploit targeting ClawdHub, the AI assistant’s skills library. He successfully uploaded a publicly available skill, artificially inflated its download count to over 4,000, and watched as developers from seven countries downloaded the package. While his payload was benign, it demonstrated that malicious actors could execute commands on Moltbot instances and exfiltrate SSH keys, AWS credentials, and entire codebases.

ClawdHub currently treats all downloaded code as trusted, with no moderation process in place. This places the burden of security vetting entirely on developers, many of whom may lack the expertise to properly assess risks.

Moltbot Security Concerns and Technical Expertise Gap

Eric Schwake, director of cybersecurity strategy at Salt Security, highlighted the disconnect between consumer enthusiasm and the technical knowledge required for safe operation. While Moltbot may install like a typical Mac app, proper configuration demands thorough understanding of API posture governance to prevent credential exposure.

“A significant gap exists between the consumer enthusiasm for Clawdbot’s one-click appeal and the technical expertise needed to operate a secure agentic gateway.”

Eric Schwake, Director of Cybersecurity Strategy at Salt Security

Researchers at Hudson Rock discovered that Moltbot stores some user secrets in plaintext Markdown and JSON files on the local filesystem. This means that if a host machine becomes infected with infostealer malware like Redline, Lumma, or Vidar, all credentials stored by the AI assistant could be compromised. These malware families are already implementing capabilities to target local-first directory structures used by Moltbot.

The Broader Implications for AI Agents

Security experts view Moltbot as a harbinger of challenges facing the wider deployment of AI agents. Wendi Whitmore, chief security intelligence officer at Palo Alto Networks, warned that AI agents could represent a new era of insider threats as they gain autonomous access to organizational systems.

  • AI agents require access to files, credentials, and external services
  • They bypass traditional security boundaries like sandboxing and process isolation
  • Compromised agents inherit all user access privileges
  • Least privilege principles must be enforced for each agent

Heather Adkins, VP of security engineering at Google Cloud, has urged people to avoid installing Moltbot entirely, citing concerns that it resembles infostealer malware disguised as a personal assistant. The Moltbot security concerns underscore the need for rethinking cybersecurity frameworks in the agentic AI era, ensuring proper monitoring and privilege management before widespread adoption.