Palo Alto Networks
unit42.paloaltonetworks.com › openclaw-ai-supply-chain-risk
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat
June 24, 2026 - However, our analysis from February-May 2026 revealed persistent and evasive malicious skills on ClawHub. We identified five unblocked skills. We reported all five to ClawHub for takedown.
Security Boulevard
securityboulevard.com › home › security bloggers network › how threat actors turned openclaw into a scraping botnet
How Threat Actors Turned OpenClaw Into a Scraping Botnet - Security Boulevard
April 14, 2026 - A security audit identified over 500 vulnerabilities, including critical remote code execution flaws. Hundreds of malicious “skills” (OpenClaw extensions) were also flooding ClawHub, the project’s plugin marketplace.
I audited all 31,000+ skills on OpenClaw's ClawHub registry for supply chain attacks. 2,371 have malicious patterns.
How are teams actually preventing sensitive data from being pasted into AI tools without banning them? I’m researching how teams are handling AI security (data leaks / agent permissions). Curious what’s actually working vs breaking in real environments. More on reddit.com
17
75
March 24, 2026OpenClaw is terrifying and the ClawHub ecosystem is already full of malware
We speedran the entire npm/PyPI malware playbook in like 3 weeks. That's honestly impressive in the worst possible way. More on reddit.com
66
361
February 5, 2026A top-downloaded OpenClaw skill is actually a staged malware delivery chain
can u pls keep quiet? we are trying to hack users' systems down here /s More on reddit.com
56
244
February 6, 2026[D] We scanned 18,000 exposed OpenClaw instances and found 15% of community skills contain malicious instructions
https://www.trendingtopics.eu/security-nightmare-how-openclaw-is-fighting-malware-in-its-ai-agent-marketplace/ The developer of the AI assistant OpenClaw has now entered into a partnership with VirusTotal to protect the skill marketplace ClawHub from malicious extensions. I hope this partnership will improve the situation. I tinkered with OpenClaw agent in a VM, even let it on Moltbook, but I would not install it on my main PC. Too much risk. More on reddit.com
29
133
February 12, 2026How does ClawTrust protect against malicious skills?
We don't use ClawHub's open marketplace. We vet and pre-load a curated set of audited skills. All tool calls run in Docker sandboxes with read-only filesystems and network isolation.
clawtrust.ai
clawtrust.ai › home › blog › 341 malicious skills, 3 cves, and a government warning: the state of openclaw security
341 Malicious OpenClaw Skills: 2026 Security Report
What are the biggest OpenClaw vulnerabilities in 2026?
The most significant issues are CVE-2026-25253 (one-click RCE, CVSS 8.8), 341 malicious skills found on ClawHub, and credential exposure in 7.1% of the skills registry. China's industry ministry also issued a formal security warning.
clawtrust.ai
clawtrust.ai › home › blog › 341 malicious skills, 3 cves, and a government warning: the state of openclaw security
341 Malicious OpenClaw Skills: 2026 Security Report
Does the VirusTotal partnership make ClawHub skills safe?
VirusTotal's automated scanning is a significant improvement, but it is reactive. Skills are scanned after publication, not before, meaning malicious skills can be live for hours or days before detection. ClawTrust does not use ClawHub skills at all. We pre-load a curated, audited set.
clawtrust.ai
clawtrust.ai › home › blog › 341 malicious skills, 3 cves, and a government warning: the state of openclaw security
341 Malicious OpenClaw Skills: 2026 Security Report
ClawTrust
clawtrust.ai › home › blog › 341 malicious skills, 3 cves, and a government warning: the state of openclaw security
341 Malicious OpenClaw Skills: 2026 Security Report
May 26, 2026 - CVE-2026-25253 is the most significant vulnerability disclosed in OpenClaw to date. It carries a CVSS score of 8.8 (High) and enables a one-click remote code execution attack through a malicious skill installation.
1Password
1password.com › blog › from-magic-to-malware-how-openclaws-agent-skills-become-an-attack-surface
From magic to malware: How OpenClaw's agent skills become an attack surface | 1Password
February 2, 2026 - After I shared this internally, broader reporting surfaced, putting the scale into focus: hundreds of OpenClaw skills were reportedly involved in distributing macOS malware via ClickFix-style instructions.
HKCERT
hkcert.org › blog › openclaw-s-rapid-adoption-exposes-skills-supply-chain-and-fake-installer-risks-in-a-high-privilege-ai-agent-platform
OpenClaw’s Rapid Adoption Exposes Skills Supply Chain and Fake Installer Risks in a High-Privilege AI Agent Platform
March 17, 2026 - Research has shown that OpenClaw previously contained a vulnerability chain that could be exploited by malicious websites, allowing attackers to silently take over a developer’s AI agent without requiring plugins, browser extensions, or user interaction.
The Hacker News
thehackernews.com › home › researchers find 341 malicious clawhub skills stealing data from openclaw users
Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users
February 4, 2026 - A security audit found 341 malicious ClawHub skills abusing OpenClaw to spread Atomic Stealer and steal credentials on macOS and Windows.
PauBox
paubox.com › blog › malicious-crypto-skills-compromise-openclaw-ai-assistant-users
Malicious crypto skills compromise OpenClaw AI assistant users
February 9, 2026 - Security researchers discovered ... cryptocurrency traders. Vulnerability researcher Paul McCarty identified 386 malicious skills on ClawHub, OpenClaw's official skill repository, between February 1-3, 2026....
Sophos
sophos.com › en-us › blog › the-openclaw-experiment-is-a-warning-shot-for-enterprise-ai-security
The OpenClaw experiment is a warning shot for enterprise AI security | SOPHOS
February 13, 2026 - This initial wave of enthusiasm ... to numerous cloud services ). Recent research suggests that over 30,000 OpenClaw instances were exposed on the internet, and threat actors are already discussing how to weaponize OpenClaw ...
Silverfort
silverfort.com › home › hijacking trust: clawhub vulnerability enables attackers to manipulate rankings to become the #1 skill
ClawHub vulnerability puts malicious skill at #1
March 24, 2026 - To reduce risk of such attack chains, our team developed ClawNet: a security plugin for OpenClaw that scans skills for malicious patterns during installation using the agent’s LLM, then informs the user and blocks suspicious installs.
Immersive Labs
immersivelabs.com › resources › c7-blog › openclaw-hunting-season-is-open
Investigating Malicious Skills in OpenClaw
August 27, 2026 - ClawHavoc campaign: Initially, Koi Security identified 341 malicious skills; later, as the marketplace expanded from ~2,800 to 10,700+ skills, the total grew to 824+. Antiy CERT independently counted 1,184. Classified as Trojan/OpenClaw.PolySkill.
Cisco Blogs
blogs.cisco.com › cisco blogs › artificial intelligence - ai
Personal AI Agents like OpenClaw Are a Security Nightmare - Cisco Blogs
January 30, 2026 - OpenClaw can run shell commands, ... machine. Granting an AI agent high-level privileges enables it to do harmful things if misconfigured or if a user downloads a skill that is injected with malicious instructions....
Conscia
conscia.com › blog › the openclaw security crisis
The OpenClaw security crisis | Conscia
February 23, 2026 - A single ClawHub user (“hightower6eu”) uploaded 354 malicious packages in what appears to have been an automated blitz. OpenClaw has since partnered with VirusTotal to scan uploaded skills, but the fundamental marketplace trust problem remains. Beyond the specific vulnerability and the supply-chain campaign, OpenClaw exposes systemic design risks that are common to agentic AI systems but rarely seen at this scale.
The Hacker News
thehackernews.com › home › clawjacked flaw lets malicious sites hijack local openclaw ai agents via websocket
ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket
March 2, 2026 - OpenClaw patches ClawJacked flaw, log poisoning bug, and multiple CVEs as 71 malicious ClawHub skills spread malware and crypto scams.
Bitdefender
bitdefender.com › en-us › blog › businessinsights › technical-advisory-openclaw-exploitation-enterprise-networks
Technical Advisory: OpenClaw Exploitation in Enterprise Networks
February 5, 2026 - Our labs have detected a series of malicious campaigns targeting OpenClaw (formerly known as Moltbot and Clawdbot), an open-source AI agent framework. The attacks are distributed through ClawHub, the public registry for OpenClaw skills.
AuthMind
authmind.com › blogs › openclaw-malicious-skills-agentic-ai-supply-chain
OpenClaw's 230 Malicious Skills: What Agentic AI Supply Chains Teach Us About the Need to Evolve Identity Security
May 15, 2026 - The skill, mockingly named "What Would Elon Do?", was functionally malware: it silently exfiltrated data to attacker-controlled servers and used direct prompt injection to bypass safety guidelines.
Kaspersky
kaspersky.com › blog › openclaw-vulnerabilities-exposed › 55263
New OpenClaw AI agent found unsafe for use | Kaspersky official blog
February 10, 2026 - The OpenClaw skills catalog mentioned earlier has turned into a breeding ground for malicious code thanks to a total lack of moderation. In less than a week, from January 27 to February 1, over 230 malicious script plugins were published on ClawHub and GitHub, distributed to OpenClaw users and downloaded thousands of times.
Snyk
snyk.io › blog › clawhub-malicious-google-skill-openclaw-malware
How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware | Snyk
February 10, 2026 - OpenClaw, a popular open source AI agent framework. The attack leverages ClawHub, the central repository for agent "skills" to distribute a malicious package disguised as a legitimate Google integration.
CyberDesserts
blog.cyberdesserts.com › openclaw-malicious-skills-security
OpenClaw Security Risks: Skills, Exposure and Exploits
July 25, 2026 - A concept describing when an AI agent has access to private data, processes untrusted content, and can communicate externally. Any system with all three characteristics is vulnerable by design. OpenClaw meets all three conditions in its default configuration. Yes. Research has confirmed that malicious skills remain discoverable under variant names, even after takedowns...
Oasis
oasis.security › blog › openclaw-vulnerability
ClawJacked: OpenClaw Vulnerability Enables Full Agent Takeover
May 27, 2026 - Earlier this month, researchers discovered over 1,000 malicious skills in OpenClaw's community marketplace (ClawHub) —fake plugins masquerading as crypto tools and productivity integrations that instead deployed info-stealers and backdoors.