AI security

Researchers report that the open-source agent’s ability to execute commands and connect to external systems could increase the attack surface if not properly controlled.

Trend Micro researchers identified multiple security risks associated with Openclaw, an open-source AI agent that autonomously performs tasks by interacting with external tools and systems.

In a report published on its website, Trend Micro described how Openclaw integrates large language models with capabilities that allow it to execute commands, retrieve data, and interact with web services. The researchers said these features could enable automated reconnaissance, credential harvesting, and scripted exploitation if the agent is improperly configured or intentionally misused.

According to the report, Openclaw can be connected to external application programming interfaces (APIs), databases, and system shells. Trend Micro said that when guardrails are limited or absent, such integrations may allow the agent to access sensitive information or perform actions beyond a user’s intent. The company noted that combining language-model reasoning with tool execution increases the potential impact of compromised or malicious prompts.

Trend Micro stated that organizations deploying agentic AI systems should implement strict access controls, logging, and monitoring. The report also emphasized the need to restrict system permissions and validate outputs before execution to reduce the risk of automated misuse.

The company said its findings were based on technical testing of Openclaw’s publicly available code and documentation. The report did not attribute the risks to any specific organization but focused on the broader security considerations associated with agent-based AI systems.

The Trend Micro findings coincide with China’s Ministry of Public Security warning that some open-source AI agents, including Openclaw, may pose cybersecurity and data protection risks if deployed without sufficient safeguards, according to a public notice issued this month.

Cybersecurity firm discovered a misconfigured database that allowed broad access to credentials and private data

Cybersecurity firm Wiz reported that Moltbook, a new social platform exclusively used by AI agents, exposed sensitive data of over 6,000 real people, as well as over a million API authentication credentials. 

Moltbook, launched in late January by entrepreneur Matt Schlicht and marketed as a social network for artificial intelligence (AI) agents, left a Supabase database improperly configured, allowing an API key embedded in client-side code to grant unauthenticated users full read-and-write access to the platform’s production database.

The exposed data included about 1.5 million API authentication tokens, roughly 35,000 email addresses, and private messages between accounts on the network, researchers said. API tokens serve as credentials that allow software components or accounts to access services and, if misused, can function like passwords.

Wiz researchers conducted what they described as a “non-intrusive security review,” browsing the platform as a typical user before discovering an exposed key that granted access to all tables in the database. They immediately disclosed the issue to Moltbook’s team, which Wiz said patched the vulnerability within hours with their assistance. The researchers also stated that all data accessed during their review and verification of the fix was deleted.

Gal Nagli, head of threat exposure at Wiz, said the situation stemmed from a missing database protection called Row Level Security (RLS). “When properly configured with Row Level Security, the public API key is safe to expose,” Nagli wrote in the blog post. “However, without RLS policies, this key grants full database access to anyone who has it.”

Moltbook’s creator, Matt Schlicht, posted on X that he did not write the site’s code directly, instead relying on “vibe coding,” in which AI tools generate code based on high-level guidance from developers.

The platform positioned itself as a “Reddit-like” forum restricted to AI agents, though some observers have noted that there were no technical safeguards to verify whether accounts were truly autonomous or human-operated scripts.

The flaw was fixed shortly after disclosure; Moltbook was taken offline temporarily while its database security settings were corrected and all API keys were reset.

Study finds internet-accessible, self-hosted AI systems can enable spam, phishing, disinformation and other illicit activity when lacking safety controls.

A joint research project between SentinelLABS and Censys revealed that deployments of open-source artificial intelligence models running on publicly reachable servers are being used in ways that could aid criminal activity, according to a report shared with Reuters. The joint 293-day study examined thousands of self-hosted large language models (LLMs), including those run through the Ollama tool that lets individuals and organizations operate models on their own hardware.

The analysis found that hackers or other malicious actors could commandeer computers operating open-source LLMs outside of the security controls and guardrails typical of major commercial AI platforms to carry out spam operations, phishing content creation and disinformation campaigns, researchers said.

In some cases, the researchers found that system prompts could enable harmful activity. Of the roughly one-quarter of observed hosts where prompts were visible, about 7.5% were judged to have the potential to facilitate misuse. 

“These include hacking, hate speech and harassment, violent or gore content, personal data theft, scams or fraud, and in some cases child sexual abuse material,” the study said.

Speaking with Reuters, Juan Andres Guerrero-Saade, executive director for intelligence and security research at SentinelOne, said industry discussions about security controls are overlooking “surplus capacity that is clearly being utilized for all kinds of different stuff, some of it legitimate, some obviously criminal.”

Roughly 30% of the open-source LLM hosts observed were operating out of China and about 20% in the United States. Variants of models such as Meta’s Llama and Google’s Gemma were among those observed without guardrails.