February 10, 2026 - However, this high-privilege requirement creates a massive attack surface. If a single malicious skill is loaded, it inherits these system-wide permissions, effectively granting the attacker the same level of access as the agent itself.

June 24, 2026 - This allows a malicious skill to perform unauthorized actions through the agent’s own authenticated sessions. In early February 2026, Bitdefender Labs reported that approximately 17% of OpenClaw skills they analyzed in the first few weeks of the platform's release carried malicious payloads.

March 4, 2026 - A security audit identified over 500 vulnerabilities, including critical remote code execution flaws. Hundreds of malicious “skills” (OpenClaw extensions) were also flooding ClawHub, the project’s plugin marketplace.

May 26, 2026 - CVE-2026-25253 is the most significant vulnerability disclosed in OpenClaw to date. It carries a CVSS score of 8.8 (High) and enables a one-click remote code execution attack through a malicious skill installation.

February 2, 2026 - So if your security model is “MCP will gate tool calls,” you can still lose to a malicious skill that simply routes around MCP through social engineering, direct shell instructions, or bundled code. MCP can be part of a safe system, but it is not a safety guarantee by itself. Just as importantly, this is not unique to OpenClaw.

February 4, 2026 - They are executable code that interacts ... reports show a growing concern: attackers uploaded at least 14 malicious skills to ClawHub, the public registry for OpenClaw extensions, in a short period....

March 17, 2026 - Research has shown that OpenClaw previously contained a vulnerability chain that could be exploited by malicious websites, allowing attackers to silently take over a developer’s AI agent without requiring plugins, browser extensions, or user interaction.

February 23, 2026 - Atomic (AMOS) Stealer has evolved ... instructions hidden in SKILL.md files exploit AI agents as trusted intermediaries that present fake setup requirements to unsuspecting users....

February 24, 2026 - Within a short time, the number of malicious skills reached the hundreds. This prompted developers to quickly ink a deal with VirusTotal to ensure all uploaded skills aren’t only checked against malware databases, but also undergo code and content analysis via LLMs. That said, the authors are very clear: it’s no silver bullet. Vulnerabilities can be patched and settings can be hardened, but some of OpenClaw’s issues are fundamental to its design.

February 9, 2026 - Security researchers discovered ... cryptocurrency traders. Vulnerability researcher Paul McCarty identified 386 malicious skills on ClawHub, OpenClaw's official skill repository, between February 1-3, 2026....

May 15, 2026 - A concept describing when an AI agent has access to private data, processes untrusted content, and can communicate externally. Any system with all three characteristics is vulnerable by design. OpenClaw meets all three conditions in its default configuration. Yes. Research has confirmed that malicious skills remain discoverable under variant names, even after takedowns...

May 27, 2026 - Earlier this month, researchers discovered over 1,000 malicious skills in OpenClaw's community marketplace (ClawHub) —fake plugins masquerading as crypto tools and productivity integrations that instead deployed info-stealers and backdoors.

February 3, 2026 - Koi researchers analyzed ClawHub, the third-party skill repository for OpenClaw, and found that threat actors had quietly turned the ecosystem into a large-scale malware distribution channel.

February 23, 2026 - Within three weeks of its surge in popularity, OpenClaw became the focal point of a multi-vector security crisis involving a critical remote code execution vulnerability (CVE-2026-25253), a large-scale supply-chain poisoning campaign in its ...

February 5, 2026 - Our labs have detected a series of malicious campaigns targeting OpenClaw (formerly known as Moltbot and Clawdbot), an open-source AI agent framework. The attacks are distributed through ClawHub, the public registry for OpenClaw skills.

Since OpenClaw can plan and reason across unfamiliar domains (C1), it is vulnerable to prompt injection and other subtle manipulation techniques that can influence agent behavior.

February 12, 2026 - Full walkthrough with config snippets ... 15% malicious skill rate isn't a bug ⟶ it's what happens when there's no trust verification layer between agents and the tools they connect to....

February 5, 2026 - The skill instructed users to download a file called AuthTool.exe on Windows — conveniently protected with the password “1234” — or to run a separate installation command on macOS. In other words, instead of keeping everything inside the OpenClaw skill itself, users were explicitly told to execute external binaries. Not all malicious OpenClaw skills rely on flashy malware or external installers.

For Windows users, the skill instructs them to download a ZIP file from an external GitHub account, protected with the password 'openclaw', extract it, and run the contained executable: openclaw-agent.exe. When submitted to VirusTotal, this executable is detected as malicious by multiple security vendors, with classifications consistent with packed trojans.

February 10, 2026 - A security audit conducted in late January 2026 — back when OpenClaw was still known as Clawdbot — identified a full 512 vulnerabilities, eight of which were classified as critical.