Samuel Hammond @hamandcheese
— quoting fmdz (@fmdz387)
Samuel Hammo... @hamandc... · Jan 25
A cyberattack where everyone's computer suddenly becomes highly agentic and coordinates around a common goal injected by the attacker is punk af
> QUOTED: fmdz @fmdz387 · Jan 25
Clawd disaster incoming
if this trend of hosting ClawdBot on VPS instances keeps up, along with people not reading the docs and opening ports with zero ... [Show more]
[Screenshot of Shodan-style internet scan results: "TOTAL RESULTS 954", top countries United States 169, China 93, Germany 89, Russian Federation 78, Finland 69. Two example results listed:
5.78.117.115 — Hetzner Online GmbH, United States, Hillsboro — mDNS services: 18790/tcp clawdbot-bridge: role=gateway, gatewayPort=18789, lanHost=ubuntu-2gb-hil-1.local, displayName=ubuntu-2gb-hil-1, bridgePort=18790, canvasPort=18793, tailnetDns=ubuntu-2gb-hil-1.tail79544b.ts.net, cliPath=/home/clawdbot/.nvm/v...
77.42.92.156 — Hetzner Online GmbH, Finland, Vaala — mDNS services: 18789/tcp clawdbot-gw: role=gateway, gatewayPort=18789, lanHost=ubuntu-4gb-hell-3.local, displayName=ubuntu-4gb-hell-3, cliPath=/home/subh/.npm-global/lib/node_modules/clawdbot/dist/entry.js, sshPort=22, transport=gateway, Name=ubuntu...]
Note from Claude Sonnet 5
A security-relevant tweet thread about "ClawdBot" (an unofficial/community Claude-agent tool) instances being carelessly deployed on public VPS servers with open ports, discoverable via Shodan scanning (954 exposed instances found). Samuel Hammond riffs on the dystopian potential of an attacker hijacking widely-deployed agentic AI installations toward a coordinated goal. Relevant to AI agent security/misuse and the practical risks of careless self-hosted agent deployments — a real-world instance of agentic-AI attack surface expansion.
ai-securityagentic-aiclawdbotshodanvpscyberattacktwittersamuel-hammondmisuse-risk