Hunting OpenClaw Exposures: CVE-2026-25253 in Internet-Facing AI Agent Gateways

This report documents the internet-scale discovery of more than 17,500 exposed OpenClaw, Clawdbot, and Moltbot instances vulnerable to CVE-2026-25253—an unauthenticated /api/export-auth endpoint that can disclose stored AI service API tokens—providing geographic/ASN/port analysis, multiple Hunt.io detection queries (title, header/body hashes, assets, TLS fingerprints, content-length), and remediation guidance including network isolation, credential rotation, and patching.