OpenClaw's 1184 Malicious Skills: A $100M+ Crypto Theft Risk

The audit revealed a massive infiltration: 341 malicious skills were found on the ClawHub marketplace, with 335 tied to a single campaign named ClawHavoc. This isn't a minor glitch; it's a coordinated campaign that weaponized the AI agent's own supply chain. The scale is staggering, with the main campaign alone representing over 12% of all skills in the repository at the time of the audit.

The threat is direct and severe. The malware deployed, primarily Atomic macOS Stealer (AMOS), is a commodity tool designed to steal sensitive data. It targets exactly what autonomous AI agents manage: SSH keys, browser credentials, cryptocurrency wallet data, and API keys. This turns every OpenClaw user's always-on machine into a potential vault for attackers. The campaign's focus on crypto tools-over 100 skills posed as Solana or Phantom wallets-shows a clear intent to monetize stolen assets directly.

The breach undermines the core value proposition of platforms like OpenClaw. The promise of secure, autonomous AI is shattered when the ecosystem for adding new capabilities becomes a primary vector for attack. The discovery of additional outlier attacks using reverse shells and hidden backdoors confirms this isn't just about stealing data; it's about establishing persistent control over user systems. For a project built on trust, this is a fundamental vulnerability.

The Attack Vector: Stealing the Agent's "Soul"

The breach translates directly into asset theft by targeting the agent's persistent identity. In a documented case earlier this month, a variant of the Vidar infostealer exfiltrated critical configuration files from a victim's machine. This wasn't a broad scan; the malware's routine successfully captured the agent's core data, including openclaw.json (containing gateway tokens) and device.json (with cryptographic keys). This marks a clear shift in malware behavior: attackers are now hunting the agent's "soul," not just browser passwords.

The attack surface is defined by the agent's required privileges. For OpenClaw to function, it needs total access to both the operating system and command line. This high-privilege vector is exactly what malware exploits. By stealing the configuration files, an attacker gains the keys to the kingdom-potentially enabling remote access to the agent's instance or masquerading as the legitimate client in authenticated requests to the AI gateway.

The financial risk is immediate and severe. The stolen files contain the credentials and tokens that allow the agent to manage user accounts, access APIs, and interact with services. In the context of the earlier discovery of malicious skills posing as crypto wallets, this creates a direct path to monetization. An attacker with the agent's identity can drain connected wallets, initiate unauthorized transactions, and leverage the agent's established access to other platforms, turning the stolen "soul" into a $100M+ theft tool.

The Catalyst and the Risk: Viral Adoption vs. Security Oversight

The project's explosive growth created a perfect window for abuse. OpenClaw's rebranding from Moltbot to OpenClaw in late January 2026 coincided with a viral adoption surge, crossing 180,000 GitHub stars in weeks. This rapid expansion happened against a backdrop of minimal security review for its open skills marketplace. The result was a supply-chain poisoning campaign where malicious add-ons posing as crypto tools proliferated unchecked.

This disconnect is a governance failure. Security researcher Paul McCarty identified 386 malicious skills in early February, contacting the project team multiple times. The response, according to evidence, was that creator Peter Steinberger had 'too much to do' to address the issue. This lack of oversight allowed attackers to weaponize the very ecosystem meant to extend the agent's capabilities, turning a trusted repository into a distribution channel for malware.

The transition to an OpenAI-sponsored foundation may provide organizational stability, but it does not erase the damage. The project's architectural risks-like storing credentials in plaintext and an open marketplace with minimal vetting-remain structural vulnerabilities. The breach has already demonstrated a severe threat to corporate endpoints, and the trust required for autonomous AI agents is now deeply compromised.