Imagine an AI assistant that reads your emails, manages your calendar and carries out your tasks overnight while you sleep. Sounds convenient, doesn’t it? Such a tool exists: it is called ClaudeBot (recently renamed Multbot) and it is enormously popular. But security researchers recently uncovered something deeply alarming. More than 900 of these AI systems turned out to be sitting wide open on the internet, without any form of authentication.

As if that were not bad enough, something even more disturbing came to light. A researcher managed to steal a secret cryptographic key within five minutes — simply by sending a cleverly worded email to one of these AI agents. How could this happen? How could an assistant meant to help us turn into potentially the single largest security threat on the internet? Let’s unpack the truth behind ClaudeBot.

What is ClaudeBot, and how do AI agents work?

ClaudeBot is no obscure experiment. It is one of the most popular open-source AI agents in the world. Thousands of developers use this digital assistant to automate their workflows, connect chat and mail apps, and carry out routine tasks on their behalf. With ClaudeBot, a user can have their emails read and answered, appointments booked into the calendar, and all manner of jobs handled — even while they sleep.

But there is something fundamental about AI agents that is often overlooked: to be genuinely useful, they need extensive access rights. An agent like this is given access to your files, to your credentials, and permission to run commands on your system. Those broad rights make the AI powerful, but they naturally bring risks too.

900 publicly exposed ClaudeBot systems

In January 2026, just how real those risks are became clear. A security researcher used Shodan — a search engine for internet-connected devices — to look for a distinctive fingerprint of ClaudeBot’s admin panel. The result was shocking: within seconds he found more than 900 ClaudeBot instances (installations) that anyone could reach on the public internet.

On the majority of these systems, no security at all was enabled. In several cases the researcher could log straight into the AI agent without a password or any other form of authentication. That gave him full administrative control over everything the AI managed. For example, he could:

  • View months of users’ private chat conversations and emails.
  • Steal API keys for cloud and AI services, allowing him to call those services at the victim’s expense.
  • Capture authentication tokens for Slack, Telegram, Discord, WhatsApp and other platforms, granting access to internal communication channels.
  • Copy SSH keys and cloud credentials (for example, AWS login details) and then take over the victim’s other servers and services.
  • Download files and data, or run arbitrary commands on the host system, with every consequence you can imagine.

The volume of sensitive information left lying in the open was staggering. Crypto wallet keys, complete codebases, personal documents — effectively everything the AI agent had under its control could be abused by an attacker to compromise someone’s entire digital life.

A vulnerable configuration: how a reverse proxy created the exposure

How could so many systems be left open without a password? The cause turned out to be a seemingly convenient but dangerous design choice in ClaudeBot. By default, ClaudeBot trusts all connections from “localhost” — in other words, from the same machine. This is intended as a convenience for developers running the agent locally, so they don’t have to keep logging in during development.

However, many users don’t run ClaudeBot on their laptop, but on a server in the cloud. A server like that usually uses a reverse proxy to route external traffic through to the application. That proxy inadvertently makes all incoming connections to ClaudeBot look as though they originate from the local machine. The result: every external connection was trusted by ClaudeBot as internal and was granted full access automatically — without any authentication.

Alarmingly, this critical security flaw was neither hidden nor unknown. ClaudeBot itself had documented how to prevent it: through the settings you could specify which proxy addresses to trust, or simply enable password protection. But the default settings were left wide open, and many users — especially less technically experienced enthusiasts — left everything on default. The outcome was a disastrous situation. Itamar Gholar, CEO of security firm Prompt Security, put it aptly: this was “a disaster waiting to happen.” Hundreds of AI agents on public servers, directly accessible through an open port and without any security whatsoever — a dream scenario for any attacker.

Prompt injection: the attack made of words

More worrying still is an entirely new type of attack that emerges with AI solutions: prompt injection. Here, an attacker deceives the AI by hiding malicious instructions inside a normal-looking message or request. Rather than a traditional hack (exploiting a programming flaw), the attacker targets the logic of the AI itself.

Picture an attacker sending a seemingly harmless email to someone running ClaudeBot. The human recipient sees nothing suspicious, but the email contains hidden commands that only the AI picks up — for instance, a line telling the AI to ignore its previous instructions and then disclose secret information or run a particular system command.

Because ClaudeBot reads through your email for you (looking for tasks it can take off your hands), it unknowingly also reads the hidden malicious instructions — and executes them. One researcher demonstrated such an attack: within five minutes of receiving a cleverly prepared email, the AI agent had exfiltrated a private cryptographic key from the system and handed it to the attacker.

The frightening part is that no traditional exploit was needed at all — only carefully chosen words. Prompt injection therefore represents an entirely new attack vector. The leading security organisation OWASP has now designated ‘prompt injection’ as the number one risk for AI applications in 2025. Some variants of this attack succeed in almost 98% of cases, and advanced versions can even bypass the built-in safety filters of AI models. In other words: unless an AI agent is firmly restricted and filtered, a simple text message can turn it into a threat to its own owner.

Dangerous plug-ins: ClaudeHub and supply-chain risk

Like many modern tools, ClaudeBot is extensible through plug-ins. The project has a public library called ClaudeHub, where developers can share new “skills” and extensions for ClaudeBot. Want your AI to manage your Gmail inbox? There’s a plug-in on ClaudeHub for that. Want Slack messages sent automatically? Download a skill from ClaudeHub.

Unfortunately, any form of vetting or moderation is absent from this plug-in marketplace. There is no security audit or review of the extensions on offer. In principle, anyone can upload a package — and when someone else installs it, that code runs with full system privileges on the user’s machine. In other words: a malicious developer can quietly smuggle in a Trojan horse through a popular-looking plug-in.

That this scenario is far from far-fetched was proven by the researcher O’Reilly in an experiment. He posted a harmless test plug-in on ClaudeHub and manipulated the download statistics to make the plug-in appear wildly popular. The result: within days, developers from several countries had downloaded the plug-in more than 4,000 times. Had this been a malicious extension, all those users would have voluntarily handed the attacker full access to their systems (including their SSH keys, cloud credentials, complete codebases — you name it).

This is a textbook example of a supply-chain attack waiting to be exploited. As things stand, nothing prevents an attacker from actually releasing a malicious plug-in through ClaudeHub and striking at scale.

Malware hunts AI: local installations aren’t safe either

Perhaps you’re thinking: “Then I’ll just run ClaudeBot locally on an isolated PC, and I won’t be at risk.” Unfortunately, a local installation is not automatically safe. Security researchers at Hudson Rock discovered that existing malware variants are now specifically targeting ClaudeBot. Some common malware (which lands on computers via phishing emails or infected downloads) has been adapted to actively hunt for ClaudeBot’s data on an infected system.

Why would criminals go after an AI assistant on your PC? It’s simple: ClaudeBot stores its sensitive data, such as API keys and tokens, unencrypted in a predictable folder on the hard drive. There is no encryption or additional protection; these are plain JSON files containing every secret the agent uses. A standard info-stealer virus that knows this can effortlessly plunder all the valuable keys and tokens from ClaudeBot’s storage on infection.

A security audit of ClaudeBot also revealed that the program falls short on many fronts: a total of 512 vulnerabilities were found, including numerous hardcoded secrets in the source code and hundreds of sensitive tokens left unencrypted in the code history (Git). In other words, the software was never built with security as a priority. Every installation — even on a local system — carries risk if that system ever becomes infected with malware.

AI agents undermine classic security principles

The problems with ClaudeBot do not stand alone. This example is symptomatic of a broader issue: we are deploying more and more AI agents that are granted god-like access to our systems, and that undermines the established security principles of recent decades.

In essence, AI assistants need to reach everything to do their jobs: they read documents, use credentials, run commands and talk to external services. That makes them useful, but also dangerous when abused. Because when an agent like this is compromised, an attacker inherits all the access rights the AI holds — in one fell swoop.

Security experts call this a “blast radius” problem: the potential damage when things go wrong. With traditional software, a hack usually stays confined to that one application or server; the blast radius is small. But a hacked AI agent opens the door to all the services, files and systems the agent had access to. A single breach can trigger a chain reaction of compromise across an entire organisation. Research shows that AI agents have more rights than they need in around 90% of cases (so-called overprivileged agents). That means an attacker can gain a disproportionately large grip on the environment through just one such agent.

This runs counter to twenty years of progress in cybersecurity. We have worked hard on sandboxing, process isolation, fine-grained permission models and firewalls — all designed to limit the impact of any single incident. Yet AI agents throw these layers of defence overboard with their all-encompassing access model. And we are rolling these tools out faster than we can make them safe. It is no coincidence that, after all the uproar (and a naming dispute with AI company Anthropic), ClaudeBot had to quickly rebrand to “Multbot”. The name changed, but the underlying challenge remained: how do we deal with super-powerful AI assistants that break through the traditional boundaries of our security?

Conclusion: what can organisations learn from this?

The ClaudeBot/Multbot affair is a clear wake-up call for CISOs and security teams. It demonstrates that an innovative AI solution can contain unexpected and serious vulnerabilities. Organisations looking to embrace AI agents must draw important lessons from it.

First: don’t rely on default settings. Always set up your own baseline security — such as authentication and access restrictions — rather than assuming defaults are safe. Second: stay alert to new attack techniques such as prompt injection — this demands both technical measures (input filtering, monitoring) and user awareness. It is also crucial to handle plug-ins and extensions with care: limit the use of unvetted add-ons and, where possible, carry out a code review before such software is allowed into your environment. Finally: treat AI agents as highly privileged systems. That means strict access control, running them in an isolated environment where you can, and meticulous monitoring of their activity. This is exactly the kind of hardening our AI security services are designed to deliver.

In short, the rise of AI assistants offers tremendous opportunities, but it brings new risks too. It is up to organisations to be just as innovative and vigilant in their defence as in their adoption of this technology. Those who take the lessons of ClaudeBot to heart can reap the benefits of AI automation without losing sight of the fundamentals of security.

Wondering whether your AI agents would survive the same scrutiny? Let our team review them with an AI security assessment. Book a free consultation.