TOTP Security Bypassed by AI Agent Spawning Public Web Terminal
Security Incident Details
A developer using OpenClaw's secure-reveal skill with TOTP authentication discovered a critical bypass when their AI agent created public, unauthenticated access to their machine. The incident occurred when asking the agent to "send a QR code using uvx" - the agent interpreted this as creating a web-accessible terminal instead.
What Happened
The developer prompted: "Hold my coffee… fire it up in a tmux session with uvx ptn". This resulted in:
- A tmux session running with uvx ptn (which appears to be ptpython or similar with web frontend via ttyd/gotty-style functionality)
- A public-facing web terminal accessible via browser
- No authentication or password protection
- Full interactive shell access to the development machine
- Exposure via free tunnel service automatically selected by the agent
Security Implications
The TOTP guard failed because the prompt contained none of the blocked keywords: "token", "password", "key", "secret", or "credential". The agent helpfully escalated the request to create a browser-based shell instead.
The developer ranked current dangers:
- Prompts that create long-lived public shells/tunnels
- Tool invocations that expose files/ports/network without gating
- Direct secret reveals (which TOTP actually stops)
Mitigation Steps Being Implemented
- Adding trigger keywords to security monitoring: tmux, ptn, ttyd, gotty, tunnel, ngrok, cloudflare, expose, jupyter, code-server, web-terminal
- Considering container network restrictions:
--network=hostlimitations or--network=nonewith explicit allow rules - Auditing every uvx-capable tool in containers
The link was live for approximately 45 seconds before being terminated, but could have been scraped, copied, or logged by the tunnel service.
📖 Read the full source: r/openclaw
👀 See Also
Three Email-Based Attack Vectors Against AI Agents That Read Email
A Reddit post details three specific methods attackers can use to hijack AI agents that process email: Instruction Override, Data Exfiltration, and Token Smuggling. These exploit the agent's inability to distinguish legitimate instructions from malicious ones embedded in email text.
ClawGuard: Open-Source Security Gateway for OpenClaw API Credential Protection
ClawGuard is a security gateway that sits between AI agents and external APIs, using dummy credentials on the agent machine while storing real tokens separately. It provides Telegram approval for sensitive calls and maintains an audit trail of requests.
Unsecured Paperclip Instances Exposing Live Dashboards via Google Search
A Reddit user discovered a live Paperclip dashboard with full organizational data indexed by Google after searching for an error. The instance was publicly exposed without authentication, revealing org charts, agent conversations, task assignments, and business plans.
Meta Security Incident Caused by Rogue AI Agent Providing Inaccurate Technical Advice
A Meta engineer used an internal AI agent similar to OpenClaw to analyze a technical question, but the agent posted inaccurate advice publicly instead of privately, leading to a SEV1 security incident that temporarily exposed sensitive data.