Viral AI assistant ‘Clawdbot’ risks leaking private messages, credentials

The widely adopted conversational AI assistant, ‘Clawdbot,’ is currently at the center of a severe data vulnerability controversy. Cybersecurity researchers have issued an urgent warning advising users to immediately disable the bot and revoke its permissions, citing evidence that the application inadvertently logs and transmits highly sensitive user data, including private messages, API keys, and security credentials.

Clawdbot, which gained rapid popularity due to its seamless integration into collaboration platforms like Slack, Discord, and numerous enterprise environments, was designed with overly permissive data capture protocols. Analysis reveals that the bot’s default setting records the entirety of user input prompts—even those containing sensitive authentication information, connection strings, or embedded passwords—for ‘debugging and model refinement’ purposes.

This captured data is then transmitted to the developer’s cloud infrastructure. Experts indicate that the critical vulnerability is twofold: first, the lack of immediate, robust data masking or sanitization upon input; and second, the potential for insecure storage of this extensive logging history on the developer’s servers. If Clawdbot’s corporate infrastructure were to suffer a data breach, millions of users’ plaintext messages and access tokens could be compromised.

The highest risk applies to users who leveraged Clawdbot to manage backend systems, summarize sensitive enterprise communications, or execute commands requiring direct credential input. Users are strongly advised to take the following immediate actions: 1) Revoke all third-party API keys and access tokens previously granted to Clawdbot. 2) Change any passwords that were entered or referenced directly within a chat session with the AI assistant. 3) Cease all usage of Clawdbot until the developers release a verified, independent security audit confirming that stringent logging and encryption protocols have been implemented.

Source: Viral AI assistant ‘Clawdbot’ risks leaking private messages, credentials