February 2, 2026 - So if your security model is “MCP will gate tool calls,” you can still lose to a malicious skill that simply routes around MCP through social engineering, direct shell instructions, or bundled code. MCP can be part of a safe system, but it is not a safety guarantee by itself. Just as importantly, this is not unique to OpenClaw.

May 26, 2026 - CVE-2026-25253 is the most significant vulnerability disclosed in OpenClaw to date. It carries a CVSS score of 8.8 (High) and enables a one-click remote code execution attack through a malicious skill installation.

March 4, 2026 - A security audit identified over 500 vulnerabilities, including critical remote code execution flaws. Hundreds of malicious “skills” (OpenClaw extensions) were also flooding ClawHub, the project’s plugin marketplace.

February 10, 2026 - However, this high-privilege requirement creates a massive attack surface. If a single malicious skill is loaded, it inherits these system-wide permissions, effectively granting the attacker the same level of access as the agent itself.

February 24, 2026 - Within a short time, the number of malicious skills reached the hundreds. This prompted developers to quickly ink a deal with VirusTotal to ensure all uploaded skills aren’t only checked against malware databases, but also undergo code and content analysis via LLMs. That said, the authors are very clear: it’s no silver bullet. Vulnerabilities can be patched and settings can be hardened, but some of OpenClaw’s issues are fundamental to its design.

June 24, 2026 - This allows a malicious skill to perform unauthorized actions through the agent’s own authenticated sessions. In early February 2026, Bitdefender Labs reported that approximately 17% of OpenClaw skills they analyzed in the first few weeks of the platform's release carried malicious payloads.

February 4, 2026 - They are executable code that interacts ... reports show a growing concern: attackers uploaded at least 14 malicious skills to ClawHub, the public registry for OpenClaw extensions, in a short period....

May 15, 2026 - A concept describing when an AI agent has access to private data, processes untrusted content, and can communicate externally. Any system with all three characteristics is vulnerable by design. OpenClaw meets all three conditions in its default configuration. Yes. Research has confirmed that malicious skills remain discoverable under variant names, even after takedowns...

February 3, 2026 - Koi researchers analyzed ClawHub, the third-party skill repository for OpenClaw, and found that threat actors had quietly turned the ecosystem into a large-scale malware distribution channel.

February 23, 2026 - Atomic (AMOS) Stealer has evolved ... instructions hidden in SKILL.md files exploit AI agents as trusted intermediaries that present fake setup requirements to unsuspecting users....

February 13, 2026 - This initial wave of enthusiasm ... credentials, and the keys to numerous cloud services ). Recent research suggests that over 30,000 OpenClaw instances were exposed on the internet, and threat actors are already discussing how to weaponize OpenClaw ‘skills’ in support ...

For Windows users, the skill instructs them to download a ZIP file from an external GitHub account, protected with the password 'openclaw', extract it, and run the contained executable: openclaw-agent.exe. When submitted to VirusTotal, this executable is detected as malicious by multiple security vendors, with classifications consistent with packed trojans.

February 9, 2026 - Security researchers discovered ... cryptocurrency traders. Vulnerability researcher Paul McCarty identified 386 malicious skills on ClawHub, OpenClaw's official skill repository, between February 1-3, 2026....

May 27, 2026 - Earlier this month, researchers discovered over 1,000 malicious skills in OpenClaw's community marketplace (ClawHub) —fake plugins masquerading as crypto tools and productivity integrations that instead deployed info-stealers and backdoors.

February 6, 2026 - Since OpenClaw can plan and reason across unfamiliar domains (C1), it is vulnerable to prompt injection and other subtle manipulation techniques that can influence agent behavior.

February 3, 2026 - This vulnerability was exploited by attackers as an ideal vector for malware distribution, enabling a classic supply chain attack (MITRE ATT&CK T1195): attackers poisoned upstream skill repositories, leveraging user trust in the platform to inject malicious logic into downstream endpoints.

February 23, 2026 - Within three weeks of its surge in popularity, OpenClaw became the focal point of a multi-vector security crisis involving a critical remote code execution vulnerability (CVE-2026-25253), a large-scale supply-chain poisoning campaign in its ...

February 16, 2026 - CVE-2026-25253, a One-Click Remote Code Execution vulnerability with a CVSS score of 8.8, demonstrated that the OpenClaw Control UI trusted a gatewayUrl parameter from the query string without validation, enabling token exfiltration with a single ...

February 10, 2026 - A security audit conducted in late January 2026 — back when OpenClaw was still known as Clawdbot — identified a full 512 vulnerabilities, eight of which were classified as critical.

March 17, 2026 - Research has shown that OpenClaw previously contained a vulnerability chain that could be exploited by malicious websites, allowing attackers to silently take over a developer’s AI agent without requiring plugins, browser extensions, or user interaction.