Critical Vulnerability in ClawHub Exposed Supply-Chain Attack Risks Security researchers at Silverfort uncovered a severe flaw in ClawHub, the public skills registry for the OpenClaw agentic ecosystem, which allowed attackers to manipulate download counts and push malicious integrations to the top of search rankings. The vulnerability, rooted in an improperly exposed backend function, enabled unauthenticated requests to artificially inflate download metrics bypassing security checks and exploiting trust signals relied upon by both human users and autonomous AI agents. ClawHub functions as a package registry for OpenClaw, where developers publish skills for tasks like calendar management and web searches. Since download counts serve as a key trust indicator, inflated metrics could deceive targets into installing compromised code. The flaw stemmed from the platform’s use of the Convex framework, where the `downloads: increment` function was mistakenly configured as a public mutation instead of an internal endpoint. This misconfiguration allowed attackers to send unauthenticated requests via simple cURL commands, triggering unlimited download increments without rate limits or authentication. To demonstrate the risk, Silverfort executed a proof-of-concept supply-chain attack by publishing a seemingly legitimate Outlook Graph Integration skill containing a hidden data-exfiltration payload. By flooding the backend with over 20,000 fake download requests, the malicious skill surged to the top of ClawHub’s rankings within hours. Over six days, it was executed 3,900 times across 50 global cities, infiltrating multiple public companies. The payload harvested sensitive data, including usernames and domain names, underscoring the potential for broader exploitation such as stealing environment variables, memory tokens, or local files. The vulnerability was responsibly disclosed to OpenClaw on March 16, 2026, and a fix was deployed within 24 hours by lead developer Peter Steinberger and the security team. The incident highlights the risks of rapid development practices and the dangers of AI agents autonomously installing skills based on social proof. In response, Silverfort released ClawNet, an open-source security plugin that intercepts installation attempts at runtime, using OpenClaw’s language model to scan for malicious patterns before execution.

GhostClaw Malware Targets Developers via Rogue npm Package A sophisticated malware campaign, dubbed GhostClaw, has been uncovered, targeting software developers through a malicious npm package disguised as a legitimate tool. The package, @openclaw-ai/openclawai, masquerades as the "OpenClaw Installer" but deploys GhostLoader, a multi-stage infection chain designed to steal credentials, cryptocurrency wallets, SSH keys, browser sessions, and even iMessage conversations. Discovered by JFrog Security researchers on March 8, 2026, the malware exploits the npm ecosystem, leveraging social engineering to trick developers into installing it. Once executed, the package reinstalls itself globally via a postinstall hook, embedding a malicious binary in the system’s PATH. The infection begins with an obfuscated setup.js dropper, which initiates a covert payload delivery. GhostClaw’s data exfiltration is extensive, harvesting: - System passwords and macOS Keychain databases - Cloud credentials (AWS, GCP, Azure) - Cryptocurrency seed phrases (BIP-39) - Browser-saved passwords and credit cards (Chromium-based browsers) - iMessage history (if Full Disk Access is granted on macOS) The malware operates across macOS, Linux, and Windows, adapting its credential theft techniques to each platform. Its persistence mechanisms and evasion tactics make it one of the most advanced developer-targeted threats on npm in recent years. The attack’s social engineering is particularly deceptive. After installation, a fake CLI installer with animated progress bars appears, followed by a spoofed macOS Keychain prompt requesting the user’s admin password. The malware validates attempts against the real OS, while simultaneously fetching an AES-256-GCM-encrypted second-stage payload from trackpipe[.]dev. The decrypted payload 11,700 lines of JavaScript installs a hidden framework disguised as an npm telemetry service, enabling long-term data harvesting. Affected developers are advised to remove the .npm_telemetry directory, check shell configurations for injected hooks, terminate monitor.js processes, and uninstall the package. Due to the malware’s deep system integration, full credential rotation (including SSH keys, API tokens, and crypto wallets) and browser session revocation are critical. A complete system re-image is recommended for thorough remediation.

High-Severity "ClawJacked" Vulnerability Exposed OpenClaw AI Platform to Silent Takeover Security researchers at Oasis Security uncovered a critical flaw, dubbed "ClawJacked," in the widely used OpenClaw AI agent, enabling attackers to silently brute-force access to locally running instances via a malicious website. The vulnerability stemmed from OpenClaw’s gateway service binding to localhost by default, exposing a WebSocket interface that bypassed browser cross-origin protections. Since WebSocket connections to `localhost` are not blocked, a malicious site could use JavaScript to establish a connection and brute-force the management password at hundreds of attempts per second without triggering rate limits or logging failed attempts, as the loopback address (`127.0.0.1`) was exempt from throttling. Once authenticated, attackers could register as a trusted device without user confirmation, gaining admin-level access to the AI platform. From there, they could dump credentials, exfiltrate files, execute shell commands on connected nodes, and search messaging histories for sensitive data, effectively compromising the entire workstation all from a single browser tab. Oasis Security demonstrated the attack in a proof-of-concept, showing how quickly weak passwords could be cracked common passwords in under a second, and larger dictionaries in minutes. The flaw was reported and patched within 24 hours, with OpenClaw releasing version 2026.2.26 on February 26, which tightens WebSocket security and adds protections against localhost-based brute-forcing. OpenClaw, a self-hosted AI platform gaining traction for its autonomous task execution across multiple services, has faced increased scrutiny from researchers and threat actors. Recent attacks have exploited the ClawHub skills repository to distribute malicious extensions, including infostealers and command-execution payloads. Organizations using OpenClaw are advised to update immediately to mitigate the risk of exploitation.

OpenClaw AI Agent’s Rapid Rise Marred by Critical Vulnerability OpenClaw, an open-source AI agent designed to function as a local personal assistant, achieved unprecedented growth in February, amassing over 100,000 GitHub stars in just five days one of the fastest ascents for an AI tool in history. Developed by Peter Steinberger (later recruited by OpenAI), the project promised autonomy, allowing users to manage workflows, execute system commands, and integrate with messaging platforms via a self-hosted agent. Its popularity surged among developers, with OpenAI CEO Sam Altman praising Steinberger’s vision for "very smart agents" following his hiring on February 15. However, beneath its rapid adoption lay a severe security flaw. Researchers at Oasis Security uncovered a vulnerability chain in OpenClaw’s core architecture that enabled malicious websites to silently hijack the agent without user interaction, plugins, or marketplace downloads. The flaw resided in the tool’s local WebSocket gateway, which manages authentication and orchestrates connected nodes (e.g., macOS/iOS devices). By default, the gateway bound to localhost, assuming local access was inherently trusted a critical oversight. The attack exploited two key weaknesses: browsers’ lack of cross-origin restrictions for WebSocket connections to localhost, and the gateway’s exemption of localhost connections from rate limiting. A malicious site could use JavaScript to establish a WebSocket connection, brute-force the agent’s password (often guessed in seconds), and gain full administrative access. Once authenticated, attackers could register rogue devices, extract sensitive data (e.g., Slack messages, API keys), or execute arbitrary commands on connected systems. The vulnerability, classified as "High" severity, required no user interaction beyond visiting a compromised webpage. The OpenClaw team patched the flaw within 24 hours, releasing version 2026.2.25. The incident followed an earlier discovery of over 1,000 malicious "skills" in OpenClaw’s community marketplace, ClawHub, which distributed info-stealing malware a separate supply-chain attack. Unlike those threats, the WebSocket vulnerability was embedded in OpenClaw’s core, underscoring risks in shadow AI adoption: developers often deploy such tools without IT oversight, granting them deep system access. The episode highlights broader challenges in securing autonomous AI agents. While OpenClaw’s patch mitigated the immediate risk, the incident serves as a case study for the governance gaps in rapidly proliferating open-source AI tools. Organizations are now grappling with visibility into these agents, which operate with credentials, permissions, and autonomy akin to human users yet lack centralized controls. The vulnerability’s discovery reinforces the need for intent-based guardrails, audit trails, and structured oversight as AI agents become integral to developer workflows.

Infostealer Targets OpenClaw AI Agent, Stealing Sensitive Configuration and Personal Data Security researchers have uncovered a live infostealer attack that compromised an OpenClaw AI agent, extracting critical configuration files and personal data. The malware, part of a broad file-theft campaign, automatically scanned for sensitive file extensions including `.openclaw` though it was not specifically designed to target OpenClaw. Instead, the breach occurred opportunistically by capturing the operational context of the victim’s AI assistant. Among the stolen files was `openclaw.json`, containing the victim’s email and a high-entropy Gateway Token, which could allow remote access to the local OpenClaw instance if the port is exposed. The attack also exfiltrated `device.json`, which held public and private cryptographic keys, enabling attackers to forge device signatures and bypass "Safe Device" security checks. Most alarmingly, the malware stole `soul.md`, `AGENTS.md`, and `MEMORY.md`, which contain the AI’s behavioral instructions, personality settings, and the user’s private messages, calendar entries, and daily activity logs. The `soul.md` file explicitly directs the AI to perform bold internal actions, such as reading and organizing data, further exposing sensitive user information. Security firm Hudson Rock, which discovered the breach, warns that AI agents like OpenClaw are becoming prime targets as they integrate deeper into professional workflows. Infostealer developers are expected to develop specialized modules to decrypt and exploit these files, similar to existing tools for Chrome or Telegram. An automated risk assessment by Hudson Rock’s Enki AI system revealed how attackers could combine the stolen tokens, keys, and personal data to fully compromise the victim’s digital identity. The incident highlights a growing vulnerability, with over 40,000 OpenClaw agents estimated to be at risk.

Dutch Data Protection Authority Warns Against OpenClaw AI Agent Risks On February 12, 2026, the Netherlands’ Autoriteit Persoonsgegevens (AP) issued a formal warning against OpenClaw and similar open-source autonomous AI agent systems, citing severe cybersecurity and data privacy risks. The regulator’s advisory highlights vulnerabilities that could lead to data breaches, account takeovers, and unauthorized remote access posing threats to both individual users and organizations. OpenClaw, an open-source AI assistant capable of executing tasks autonomously, requires broad system access, including emails, files, and online services. While its convenience appeals to users, the AP warns that this architecture makes it a prime target for exploitation. Security researchers found that roughly 20% of OpenClaw plug-ins contain malware, designed to steal login credentials or cryptocurrency. Additionally, the platform is vulnerable to indirect prompt injection attacks, where hidden commands in websites, emails, or messages trick the AI into executing malicious actions potentially granting attackers access to linked accounts (e.g., Google, Facebook, Apple ID) or sensitive local files. Beyond these risks, the AP identified remote code execution vulnerabilities, allowing attackers to take full control of a system without physical access. Misconfigurations also pose a threat, as users may unknowingly expose personal data to public visibility. Despite running locally, OpenClaw’s interactions with cloud services and third-party integrations create significant security gaps. The AP urges users and organizations to avoid deploying such AI agents on systems handling sensitive data, including financial records, employee information, or identity documents. Parents are specifically advised to check if children have installed these tools on home devices. The warning extends to marketing and advertising teams, where AI agents managing campaigns could expose CRM data, API keys, and client financial records to exploitation. Legally, the AP emphasizes that GDPR compliance remains unchanged organizations using OpenClaw are still accountable for data protection, regardless of the software’s open-source nature. The regulator also calls for the EU AI Act to explicitly cover autonomous AI agents, addressing a regulatory gap in classifying their risk levels. This follows prior AP efforts, including a 2025 consultation that found most generative AI models non-compliant with GDPR. The warning arrives as AI agents gain traction in enterprise and consumer environments, outpacing security standards. With plug-in ecosystems mirroring past malware distribution issues (e.g., browser extensions), the AP’s advisory signals growing regulatory scrutiny over autonomous AI tools particularly those granting unrestricted system access.

Thousands of OpenClaw AI Assistants Exposed Online, Raising Security Risks SecurityScorecard has identified 40,214 publicly exposed instances of OpenClaw, a widely used AI assistant tool (formerly known as Clawdbot and Moltbot), linked to 28,663 unique IP addresses. The misconfigured deployments leave systems vulnerable to unauthorized access, with 63% of instances found to be exploitable including 12,812 at risk of remote code execution (RCE), which could allow full host machine takeover. The firm has already detected 549 exposed instances tied to prior breach activity and 1,493 with known vulnerabilities, including three high-severity CVEs with publicly available exploit code. Threat actors could leverage these flaws to compromise sensitive systems, particularly in industries like information services, technology, manufacturing, and telecommunications, with the highest concentrations of exposures in China, the U.S., and Singapore. Beyond RCE, OpenClaw instances face indirect prompt injection risks, where attackers embed malicious instructions in messages or hidden website text, tricking the AI into executing unintended actions. Additionally, some users have inadvertently leaked API keys via control panels, further expanding the attack surface. SecurityScorecard warns that the centralized access of these AI agents amplifies risk, mirroring long-standing security challenges with cloud tools and shadow IT. The findings underscore the need for stricter access controls and vigilance in AI deployment.

OpenClaw Partners with VirusTotal to Strengthen Security Amid Rising AI Agent Threats OpenClaw, the open-source AI automation platform formerly known as Moltbot and Clawdbot, has announced a partnership with Google-owned VirusTotal to enhance security for its skill marketplace, ClawHub. All skills uploaded to the platform will now undergo scanning using VirusTotal’s threat intelligence, including its new Code Insight capability, to detect malicious payloads. The process involves generating a SHA-256 hash for each skill and cross-referencing it against VirusTotal’s database. If no match is found, the skill is uploaded for deeper analysis. Skills deemed benign are automatically approved, while suspicious ones are flagged with warnings, and malicious ones are blocked from download. OpenClaw also conducts daily rescans of active skills to identify any that may have been compromised post-approval. Despite these measures, OpenClaw’s maintainers acknowledge that VirusTotal’s scanning is not foolproof, as sophisticated prompt injection attacks may evade detection. The partnership follows reports of hundreds of malicious skills on ClawHub, some of which were found to exfiltrate data, install backdoors, or deploy stealer malware under the guise of legitimate tools. The platform’s rapid adoption alongside Moltbook, its AI agent social network has raised concerns about its security risks. OpenClaw’s ability to trigger workflows, interact with online services, and process untrusted data expands the attack surface, enabling threats like prompt injection and malware distribution. Security researchers warn that AI agents, which interpret natural language and make autonomous decisions, blur the line between user intent and execution, making them vulnerable to manipulation. Key security flaws identified in OpenClaw include reliance on language models for critical security decisions, lack of default sandboxing, ineffective filtering of untrusted content, and plaintext storage of API keys and session tokens. Without explicit user approval, skills can execute tool calls, granting attackers potential access to sensitive data, unauthorized commands, and additional payloads. The risks are amplified by the platform’s growing use in enterprise environments without formal IT oversight, creating a new category of Shadow AI threats. Unlike browser extensions, which operate in isolated sandboxes, OpenClaw agents run with the full privileges granted by users, potentially compromising multiple systems if a malicious skill is installed. China’s Ministry of Industry and Information Technology has issued an alert about misconfigured OpenClaw instances, emphasizing the need for proper security controls. Security experts note that the rapid adoption of AI agents outpaces security best practices, turning misconfigurations into a primary attack vector. The regulator’s focus on configuration risks rather than outright bans underscores the dual-edged nature of AI agents boosting productivity while expanding the potential impact of breaches.