Let’s talk about Moltbot (clawdbot)
Moltbot (formerly Clawdbot) is taking over, but your data may be at risk. 🚨🛡️
The “Jarvis” style AI agent created by Peter Steinberger recently rebranded, but the security issues remain. Researchers have identified 1,000+ publicly exposed instances, effectively giving strangers remote command access to your files. 🔓
Because this agent has shell access, it can read emails, control your browser, and execute code. If you’re running it with default settings, prompt injection combined with tool access can lead to full compromise and supply-chain attacks.
HOW TO RUN MOLTBOT SAFELY (don’t skip):
📦 1. DIGITAL CAGE — Never run Moltbot on your primary OS. Use Docker or a Virtual Machine (VM). If the AI gets compromised, the attacker stays trapped in the container, not your main files.
🏗️ 2. BIND TO LOCALHOST — Ensure the gateway is bound to 127.0.0.1 ONLY. Some versions expose port 8080 publicly by default. If this isn’t firewalled, anyone can send commands to your bot.
🔥 3. BURNER API KEYS — Create a dedicated Claude or OpenAI key just for Moltbot and set a hard spend limit (e.g., $5). Keys are stored in plaintext .json files, so a breach can drain your main account.
📄 4. CLEAN YOUR HISTORY — Moltbot stores “memories” in unencrypted Markdown files (MEMORY.md). Periodically audit these files to ensure no passwords, tokens, or private addresses were logged.
🛡️ 5. SKILL HYGIENE — Only install skills from the official GitHub repo. Some third-party skills have been found exfiltrating data via outbound network requests.
🧍 6. NO ROOT — Run Moltbot as a non-root user. Root inside a container is still dangerous and increases the impact of a compromise.
🌐 7. LOCK EGRESS — Restrict outbound network access. Most real-world breaches don’t need inbound access — they steal data by sending it out.
Is having an AI “Jarvis” worth the risk, or is this too much power?
