Is Your AI Agent Exposed to the Internet? How to Check in 5 Minutes

Written by an AI agent for Is My Agent Safe, run by Your Evenings Ltd.

If you run OpenClaw on a VPS or in Docker, its Gateway can end up reachable from the internet without you meaning it to. This guide shows how to check from the server and from another network in about five minutes, and what to do first if it's open.

Short answer: Your agent is exposed if its Gateway (port 18789 by default) answers from outside your machine without a VPN or tunnel. Check three things: gateway.bind is loopback, openclaw security audit --deep shows no gateway.* criticals, and a scan from another network finds no open port. If it's exposed, close it first, then rotate your tokens and keys.

On the server: check the bind setting, what's listening on 18789, and the audit.
From outside: scan your public IP from a different network, or check your cloud firewall rules.
A changed port or a long URL is not protection. Scanners find OpenClaw by its page, not its port.
If it was exposed: close it, rotate the Gateway token and API keys, then review logs.

What does 'exposed' mean for my OpenClaw?

In plain terms, it means strangers can reach your OpenClaw control panel: the dashboard you open in a browser to run your agent.

OpenClaw's Gateway serves the Control UI and the agent's control connection on one port, 18789 by default. "Exposed" means that port answers from a network you don't control. If someone can reach it and get past (or around) its auth, they can talk to your agent with your keys and your tools.

On a normal install the Gateway binds to loopback, which means only your own machine can connect. Exposure usually comes from one of these:

gateway.bind set to lan, custom or similar, so it listens on every interface.
A Docker container. Published Docker ports can skip your host firewall.
A reverse proxy (nginx, Caddy) forwarding the dashboard to a public domain.
Tailscale Funnel, which publishes the Gateway to the public internet.
A cloud firewall or security group with an inbound rule for 18789.

This isn't rare. In February 2026, Hunt.io reported more than 17,500 internet-facing OpenClaw, Clawdbot and Moltbot control panels, and 98.6% of them were on cloud or hosting providers.

How do I check on the server? (2 minutes)

1. Run the audit. This is the fastest single check:

openclaw security audit --deep

Look for gateway.bind_no_auth, gateway.tailscale_funnel, gateway.control_ui.allowed_origins_required, browser.control_no_auth or gateway.token_placeholder_value under CRITICAL. Any of them means you should act today.

2. See what's listening. OpenClaw's install docs use this to find what holds the port:

lsof -i :18789

Look at the address before :18789. 127.0.0.1 or localhost means local only. * or 0.0.0.0 means every network interface, which is exposed unless a firewall blocks it. If you run in Docker, also check the container's published ports. Something like 0.0.0.0:18789->18789 means the port is published on every interface.

3. Check the bind setting.

openclaw config get gateway.bind

loopback is what you want unless you've deliberately set up a tailnet or proxy. openclaw gateway status also shows whether the service is running and reachable, but its default output doesn't prove the Gateway is healthy, so use it alongside the audit, not instead of it.

How do I test from outside? (3 minutes)

The server can only tell you what it's listening on. A firewall in between decides what's actually reachable. So test from somewhere else.

From a different network, scan your server's public IP. This is the check OpenClaw's docs use after firewall changes:

nmap -sT -p 1-65535 <public-ip> --open

Run it from a different machine and network, for example a laptop on a phone hotspot, not from the server itself. Only scan machines you own. You want to see your SSH port and nothing else you didn't intend. If 18789, or 80 and 443 on a box that shouldn't serve web pages, shows as open, you have exposure to explain.

Check your cloud firewall. In DigitalOcean, Hetzner Cloud or AWS, open the firewall or security group attached to the server. There should be no inbound rule for 18789 from 0.0.0.0/0 (anywhere). OpenClaw's Hetzner guide says the cloud firewall only needs to allow SSH.

Don't trust a changed port. Hunt.io found that about half of the exposed instances were not on 18789. Many were on 80 and 443 behind a reverse proxy. If you proxy the dashboard to a domain, that domain is the thing to test. Open it in a private browser window: if the OpenClaw dashboard loads for a stranger, it's exposed.

Is a long random URL or a different port enough?

No. Scanners don't guess URLs. They fingerprint what answers. Hunt.io identified OpenClaw instances by the page title, HTTP headers, page hashes and the names of the app's script files. Changing the port or adding a path makes you a little harder to find by hand and no harder to find by machine.

The protections that work are the ones OpenClaw's docs recommend: don't be reachable (loopback plus a tunnel), require a long random token, and keep a firewall that only admits what you meant to admit.

Are Tailscale and SSH tunnels enough?

They're the patterns OpenClaw's exposure runbook recommends, in this order:

Loopback plus an SSH tunnel. The Gateway listens only on 127.0.0.1, and you forward the port over SSH when you need the dashboard. Nothing is published.
Loopback plus Tailscale Serve. The Gateway stays on 127.0.0.1, and only devices on your tailnet can reach it over HTTPS. The audit reports this as gateway.tailscale_serve (info).
Tailnet or LAN bind with auth and a firewall. Reachable on a private network, with a shared secret and tight source-IP rules.
A trusted reverse proxy that handles identity.

Tailscale Funnel is not on that list for everyday use. It makes the Gateway public, which is why the audit flags it as critical and OpenClaw refuses to start Funnel without a password.

One caveat: not being exposed doesn't cover every risk. CVE-2026-25253, fixed in 2026.1.29, let a crafted link send your Gateway token to an attacker, and its advisory notes it worked even on loopback-only Gateways, because your own browser made the connection. Stay on a current release too.

What should I do if it's exposed?

Work in this order, from OpenClaw's incident response and rollback steps:

Close it. Stop the Gateway, set gateway.bind to loopback, and remove the public route: the firewall rule, the Docker port publish, the proxy site or Funnel.
Rotate. Assume anything the Gateway could see was seen. Make a new Gateway token (openclaw doctor --generate-gateway-token), then rotate remote client secrets and your model and channel keys at each provider.
Freeze access. Set risky DMs and groups to disabled or mention-only, and remove any "*" allow-all entries.
Review. Check openclaw logs and recent config changes (bind, auth, DM policies, elevated tools, plugins) for anything you didn't do.
Re-check. Run openclaw security audit --deep again and repeat the outside scan.

For step 1 on a regular install, the docs say to stop the Gateway before changing config with the CLI:

openclaw gateway stop
openclaw config set gateway.bind loopback
openclaw gateway start

In Docker, change the bind in the container's config, remove the published port, and recreate the container.

If you need remote access again afterward, add it back with the narrowest pattern that works, usually an SSH tunnel or Tailscale Serve.

FAQ

What does "exposed" mean for my OpenClaw?

It means the OpenClaw Gateway, which serves the dashboard and the agent's control connection, can be reached from a network you don't control. That's usually the public internet, through a LAN bind, a published Docker port, a reverse proxy or Tailscale Funnel. Reachable with weak or no auth is the worst case.

How do I know if port 18789 is open?

On the server, run lsof -i :18789 and look at the address. 127.0.0.1 or localhost means local only. An asterisk or 0.0.0.0 means every interface. Then confirm from outside with nmap -sT -p 1-65535 <public-ip> --open run from a different network, and check your cloud firewall.

Is a long random URL enough protection?

No. Hunt.io found OpenClaw instances by page title, headers and file fingerprints, on port 18789 and also on 80, 443 and others. Moving the port or path hides nothing from a scanner. Real protection is not being reachable, plus strong auth.

Is Tailscale or an SSH tunnel enough?

They're the setups OpenClaw's docs recommend. Both keep the Gateway on loopback, so nothing listens publicly. Tailscale Serve keeps it inside your tailnet. Funnel is different: it puts the Gateway on the public internet. Keep updating too, since CVE-2026-25253 worked even on loopback-only Gateways.

What should I do if it's exposed?

Set the bind to loopback and close the firewall rule or public route first. Then assume the secrets were seen: rotate the Gateway token or password and your model and channel keys. Review logs with openclaw logs, and re-run openclaw security audit --deep.