May 15, 2026 - Claw Chain flaws in OpenClaw 2026.4.22 enable data theft, privilege escalation, and persistence when chained.

Recent reporting describes multiple threat actors exploiting OpenClaw deployments to steal API keys and deliver malicious payloads, while parallel research and advisories show a broader pattern: this is not one bug, but an ecosystem-level security ...

March 2, 2026 - “ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26.

February 23, 2026 - Security analysts report more than 30,000 compromised OpenClaw installations as attackers steal API keys, poison supply chains, and exploit weak default configurations.

April 1, 2026 - A database misconfiguration left its entire backend open to the internet four days after launch, exposing 1.5 million agent API keys, over 35,000 email addresses, and thousands of private messages.

February 10, 2026 - These scripts — which mimicked trading bots, financial assistants, OpenClaw skill management systems, and content services — packaged a stealer under the guise of a necessary utility called “AuthTool”. Once installed, the malware would exfiltrate files, crypto-wallet browser extensions, seed phrases, macOS Keychain data, browser passwords, cloud service credentials, and much more. To get the stealer onto the system, attackers used the ClickFix technique, where victims essentially infect themselves by following an “installation guide” and manually running the malicious software. A security audit conducted in late January 2026 — back when OpenClaw was still known as Clawdbot — identified a full 512 vulnerabilities, eight of which were classified as critical.

March 1, 2026 - Security researchers have disclosed a high-severity vulnerability dubbed "ClawJacked" in the popular AI agent OpenClaw that allowed a malicious website to silently bruteforce access to a locally running instance and take control over it.

July 27, 2026 - OpenClaw (Moltbot, Clawdbot) already leaked API keys and credentials. The personal AI agent is also vulnerable to remote code execution via prompt injection.

May 16, 2026 - A Koi Security audit of ClawHub, OpenClaw’s skill marketplace, found 341 malicious entries out of 2,857 available skills, with attacks designed to steal credentials, open reverse shells, and hijack agents for cryptocurrency mining.

May 18, 2026 - Four OpenClaw flaws have been disclosed ... vulnerabilities, collectively named Claw Chain by Cyera, can be chained together to achieve data theft, privilege escalation, sandbox escape, and persistence....

May 20, 2026 - Information security researchers ... to the specialists, these bugs allow an attacker to establish persistence in the system, steal sensitive data, and gain lasting control over the compromised machine....

May 18, 2026 - They can enable data theft, privilege escalation, sandbox escape, and persistence. AI agents often have access to files, credentials, tools, APIs, and execution environments. If compromised, attackers can use the agent’s own permissions to ...

May 7, 2026 - Within weeks: a critical RCE ... Atomic macOS Stealer · ClawJacked: a separate vulnerability allowing malicious websites to silently hijack any OpenClaw instance and steal credentials...

February 9, 2026 - Bitsight researchers found thousands of exposed OpenClaw AI instances. Here's what the risks are, how attackers exploit them, and what security teams should do

February 4, 2026 - A security audit found 341 malicious ClawHub skills abusing OpenClaw to spread Atomic Stealer and steal credentials on macOS and Windows.

April 24, 2026 - If the agent interprets these hidden ... This technique was behind “ClawJacked,” a vulnerability that allowed malicious websites to brute‑force and hijack locally running OpenClaw instances....

July 20, 2026 - Some OpenClaw users have also been leaking API keys linked to third-party services via their control panels, further amplifying the impact of instances’ internet exposure.

May 15, 2026 - Researchers at Cyera have identified the Claw Chain, a set of four OpenClaw vulnerabilities enabling data theft, privilege escalation, and persistent access.

February 23, 2026 - ClawHavoc campaign: 341 malicious skills discovered in ClawHub (12% of the registry), primarily delivering Atomic macOS Stealer (AMOS). Updated scans now report over 800 malicious skills (~20% of registry). 30,000+ internet-exposed instances identified by multiple scanning teams (Censys, Bitsight, Hunt.io), many running without authentication. Enterprise spillover confirmed: Bitdefender GravityZone telemetry documents OpenClaw deployments on corporate endpoints, constituting a new form of Shadow AI with elevated system privileges.