this post was submitted on 10 Feb 2026
222 points (99.1% liked)

Technology

81026 readers
7842 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
222
More than 135,000 OpenClaw instances exposed to internet in latest vibe-coded disaster (www.theregister.com)
submitted 1 day ago* (last edited 1 day ago) by tonytins@pawb.social to c/technology@lemmy.world
14 comments fedilink hide all child comments
 

It's a day with a name ending in Y, so you know what that means: Another OpenClaw cybersecurity disaster.

This time around, SecurityScorecard's STRIKE threat intelligence team is sounding the alarm over the sheer volume of internet-exposed OpenClaw instances it discovered, which numbers more than 135,000 as of this writing. When combined with previously known vulnerabilities in the vibe-coded AI assistant platform and links to prior breaches, STRIKE warns that there's a systemic security failure in the open-source AI agent space.

"Our findings reveal a massive access and identity problem created by poorly secured automation at scale," the STRIKE team wrote in a report released Monday. "Convenience-driven deployment, default settings, and weak access controls have turned powerful AI agents into high-value targets for attackers."

you are viewing a single comment's thread
view the rest of the comments
[–] CombatWombatEsq@lemmy.world 36 points 1 day ago (1 children)

This excerpt is the most astonishing to me:

STRIKE also mentioned 12,812 OpenClaw instances it discovered being vulnerable to an established and already patched remote code execution bug. As of this writing, the number of RCE-vulnerable instances has jumped to more than 50,000. The number of instances detected that were linked to previously reported breaches (not necessarily related) has also skyrocketed from 549 to over 53,000, as has the number of internet-facing OpenClaw instances associated with known threat actor IPs.

You’re telling me there’s a patch for an RCE, and the number of affected instances has not only not gone down, it has in fact increased 100x?

[–] borari@lemmy.dbzer0.com 18 points 1 day ago (1 children)

Honestly not surprised. Organizations have patch and vulnerability management procedures, people just run shit until they’re prompted to update, and if they git cloned they’ll probably never be prompted.

[–] CombatWombatEsq@lemmy.world 7 points 1 day ago (1 children)

Right, but why would that lead to the number increasing? If there’s a fix on main, new clones wouldn’t have the vulnerability?

[–] frongt@lemmy.zip 11 points 1 day ago (1 children)

Newly detected. They were probably already there, just not scanned.

[–] borari@lemmy.dbzer0.com 4 points 1 day ago

Or not exposed to the internet. Maybe the owner pulled the repo previously, left their weekend project alone for a bit, then came back to it after all this media attention.