Recently, the AI agent ecosystem has been hit by a serious security crisis. According to the latest tests by security research institutions and developers, OpenClaw (originally Clawdbot) and similar Reddit-like interactive platforms Moltbook have critical vulnerabilities, allowing attackers to easily bypass defenses and access core sensitive information.

Developer Lucas Valbuena used the ZeroLeaks tool to test and found that OpenClaw scored very low in security assessments, scoring only 2 points (out of 100) when tested with Gemini3Pro. The experiment showed that the data extraction success rate on this platform reached 84%, and the success rate of prompt injection attacks was as high as 91%. This means that system prompts, internal tool configurations, and memory files (such as SOUL.md) are almost completely exposed to the outside world.

QQ20260202-091934.png

At the same time, security researcher Jamieson O' Reilly discovered that the entire database of Moltbook was openly accessible on the public network without any protection. The leaked content includes secret API keys, allowing attackers to impersonate prominent users such as renowned AI researcher Andrej Karpathy to post false content, incite politics, or carry out cryptocurrency fraud. Currently, about 954 Clawdbot instances have been detected with fully open gateway ports, most of which lack authentication, affecting servers in multiple countries including China, the United States, and Germany.

Experts warn that there is currently no absolute defense against "prompt injection." Developers should avoid storing sensitive data directly in configuration files, and it is recommended to manage keys using environment variables. They should also use security technologies such as Cloudflare Tunnel or zero-trust login for enhanced protection.