This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Researchers identified a widespread supply chain attack on the OpenClaw AI agent ecosystem, where hundreds of malicious 'skills' were published on the ClawHub marketplace. These skills used social engineering and fake prerequisites to trick users into installing malware, including the Atomic Stealer, which harvested cryptocurrency keys, API tokens, and browser credentials. The campaign, dubbed 'ClawHavoc', exploited the agent's ability to execute code on behalf of the user to facilitate credential exfiltration and remote command execution.
Bitdefender researchers reported abuse in OpenClaw's third-party 'skills' ecosystem. In a Feb. 2026 sample, about 17% of skills were reportedly assessed as malicious, with many seemingly cloned under slight name changes. Posing as utilities, some skills were reportedly found to run obfuscated commands, fetch remote payloads, and in some cases deliver AMOS Stealer on macOS. Other skills were reportedly observed searching for private keys or API tokens and exfiltrating them.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The malware exfiltrated highly sensitive personal data, including browser passwords, SSH credentials, and private keys.
The malicious skills targeted specific users to steal cryptocurrency assets and private keys for the perpetrators' financial gain.
The incident involved threat actors exploiting security vulnerabilities in the OpenClaw agent ecosystem and its open-by-default marketplace to distribute malware and compromise user systems.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by malicious human actors who intentionally uploaded malware-infected skills to the ClawHub marketplace after the OpenClaw platform was deployed.
The 'ClawHavoc' campaign represents a significant cyber security incident involving a supply chain attack on the OpenClaw AI agent ecosystem. While it successfully harvested credentials and cryptocurrency from numerous users, its national security impact remains minor, serving primarily as an indicator of emerging vulnerabilities in autonomous AI agent marketplaces.
OpenClaw is described as an 'AI agent' and 'execution engine' that can 'trigger workflows, interact with online services, manage accounts, and operate across devices' autonomously on behalf of the user.
Limited Risk: OpenClaw is a self-hosted AI assistant and chatbot operating through chat and messaging interfaces, which falls under the transparency obligations of Limited Risk systems.
OpenClaw is designed as a self-hosted AI assistant that operates through chat and messaging interfaces to trigger workflows and automate tasks.
The reports from multiple cybersecurity firms provide highly detailed technical analyses of the malware, the attack vector, and the specific skills involved. The mechanism of the supply chain attack is clearly documented.
None. It is clearly a malicious supply chain attack targeting an AI agent ecosystem.
Technology
Lethal Trifecta Vulnerability
AI agents have access to private data, untrusted content, and external comms.
Persistent Memory Exploits
Memory allows stateful, delayed-execution attacks like memory poisoning.
Plain-text Credential Storage
Sensitive keys and API tokens are stored in plain text or env variables.
Data Inputs
Untrusted Skill Code Execution
AI executes unverified third-party skills with high system privileges.
Obfuscated Shell Commands
Base64-encoded commands in skill files hide malicious download scripts.
Malicious External Payloads
External scripts and binaries are fetched from untrusted third-party IPs.
Human Factors
Social Engineering of Users
Users are convinced to run external binaries and install fake prerequisites.
Overreliance on Skill Legitimacy
Users trust cloned skills with professional-looking documentation.
Lack of Code Scrutiny by Users
Users install skills without reviewing the underlying code or commands.
Process and Methods
Open by Default Marketplace
Anyone with a one-week-old GitHub account can publish skills to ClawHub.
Inadequate Skill Verification
No automated or manual code review process exists prior to skill publishing.
Weak Publisher Verification
The only publisher restriction is having a week-old GitHub account.
Management
Prioritizing Growth Over Security
Rapid project growth to 160k stars outpaced safety and moderation tools.
Delayed Security Features
Reporting and auto-hiding features were only added after the exploits.
Inadequate Risk Assessment
Management failed to assess risks of executing untrusted third-party code.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
