In late January 2026, the technology world was briefly swept up in infectious excitement. An open-source project then called Clawdbot — a persistent, always-on AI agent that could take commands via WhatsApp, automate your server, write its own code, and act on your behalf across every app you connected to it — accumulated over 20,000 GitHub stars in a single 24-hour period. Within weeks, it had surpassed 100,000 stars, outpacing the adoption trajectory of React, Vue, and nearly every other repository in GitHub’s history.

Anthropic, unhappy with the name’s similarity to their Claude branding, prompted a rebrand to “Moltbot,” and then days later to the current “OpenClaw.” The lobster icon became a viral symbol of an exciting new era of autonomous AI. Then the security researchers arrived.

What followed has been described by Cisco as a “security nightmare” — a cascading, multi-vector crisis involving a critical remote code execution vulnerability, a large-scale supply-chain poisoning campaign in its plugin marketplace, and deep architectural weaknesses that make every instance a potential springboard for attackers.

The fundamental problem is not subtle. OpenClaw grants itself full disk access, terminal permissions, browser control, and OAuth tokens for every service you integrate — by design, because that is precisely what makes it useful. But it binds its control interface to 0.0.0.0:18789 by default, meaning it listens on every network interface, including the public internet. For a tool with administrator-level power over your system, the correct default would be 127.0.0.1 (localhost only). It is not.

A researcher using the handle @fmdz387 was among the first to quantify the damage, running a Shodan scan in late January to discover nearly 1,000 OpenClaw instances sitting open on the public internet with zero authentication. Researcher Jamieson O’Reilly went further, gaining access to Anthropic API keys, Telegram bot tokens, Slack accounts, complete months of private chat histories, and — most critically — the ability to execute arbitrary commands with full system administrator privileges on victim machines.

By January 31, Censys had tracked growth from approximately 1,000 to over 21,600 publicly exposed instances — a 21x increase in one week. Bitsight independently observed over 30,000 instances during a January 27–February 8 analysis window, with a honeypot they stood up on port 18789 immediately attracting scanner traffic. An independent study by security researcher Maor Dayan identified 42,665 exposed instances, of which 5,194 were actively verified as vulnerable, with 93.4% of those exhibiting authentication bypass conditions.

Then SecurityScorecard’s STRIKE team published internet-wide scan data in early February. The number: over 135,000 exposed OpenClaw instances across 82 countries. More than 50,000 of those are vulnerable to remote code execution as of this writing. The majority run on cloud infrastructure — DigitalOcean, Alibaba Cloud, and Tencent are the most common hosts — meaning many are organizational deployments, not hobbyist home setups.