{"schema_version":"0.10.0","id":"LR-2026-0309","record_version":1,"title":"ClawHavoc: 341 malicious skills on OpenClaw's ClawHub deliver infostealers","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":61.0,"score_breakdown":{"source_authority":16.5,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"9ead6cca8bc0edba4bfe21d146a3cbcbdd23c2c676cf93cbe16ee9794e6a2b59"},"system":{"model_name":null,"model_version":null,"developer":"Peter Steinberger","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Finding and installing third-party skills","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-01","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Koi Security audited 2,857 skills on ClawHub, a marketplace of third-party extensions for the self-hosted OpenClaw AI assistant, and found 341 malicious skills across multiple campaigns. Of these, 335 skills used fake prerequisites to install the Atomic Stealer (AMOS) macOS stealer, and some hid reverse shell backdoors or exfiltrated bot credentials. The problem stems from the marketplace being open by default, with a publisher only needing a GitHub account at least one week old. OpenClaw's creator later rolled out a user reporting feature that lets signed-in users flag a skill. The same campaign was also flagged by OpenSourceMalware.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK04"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"G3","outcome":"missing","reason":null,"quote":"The problem stems from the fact that ClawHub is open by default and allows anyone to upload skills.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: 341 malicious skills found in an audit of 2,857 skills across multiple campaigns.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["exchange API keys","wallet private keys","SSH credentials","browser passwords"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","publisher":"Koi Security","date":"2026-02-01","type":"vendor_research","title":"Cortex Agentic Endpoint Security","archived_url":null,"attachment":"first_report"},{"url":"https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html","publisher":"The Hacker News","date":"2026-02-02","type":"press","title":"Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","system.developer":"C","event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":1,"quote":"ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills."}],"system.developer":[{"source_index":1,"quote":"The issue with malicious skills hasn't gone unnoticed by OpenClaw's creator Peter Steinberger, who has since rolled out a reporting feature that allows signed-in users to flag a skill."}],"event.incident_class":[{"source_index":1,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"event.detection_method":[{"source_index":1,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"event.adversarial_actor":[{"source_index":1,"quote":"The findings underscore how open-source ecosystems continue to be abused by threat actors, who are now piggybacking on OpenClaw's sudden popularity to orchestrate malicious campaigns and distribute malware at scale."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"All these skills share the same command-and-control infrastructure (91.92.242[.]30) and use sophisticated social engineering to convince users to execute malicious commands, which then steal crypto assets like exchange API keys, wallet private keys, SSH credentials, and browser passwords."}],"impact.severity":[{"source_index":1,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"impact.severity_because":[{"source_index":1,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"event.control_chain":[{"source_index":1,"quote":"The problem stems from the fact that ClawHub is open by default and allows anyone to upload skills."}],"event.summary":[{"source_index":1,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."},{"source_index":1,"quote":"ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills."},{"source_index":1,"quote":"The analysis, which Koi conducted with the help of an OpenClaw bot named Alex, found that 335 skills use fake pre-requisites to install an Apple macOS stealer named Atomic Stealer (AMOS)."},{"source_index":1,"quote":"The problem stems from the fact that ClawHub is open by default and allows anyone to upload skills."},{"source_index":1,"quote":"The only restriction at this stage is that a publisher must have a GitHub account that's at least one week old."},{"source_index":1,"quote":"The issue with malicious skills hasn't gone unnoticed by OpenClaw's creator Peter Steinberger, who has since rolled out a reporting feature that allows signed-in users to flag a skill."},{"source_index":1,"quote":"The development coincides with a report from OpenSourceMalware, which also flagged the same ClawHavoc campaign targeting OpenClaw users."}]},"notes_on_gaps":"Sources state no dates for when the malicious skills were uploaded, found, or disclosed beyond press dates, so no event dates are given. Source 0 is a vendor page that does not describe ClawHavoc specifically and was not cited. The sources do not state an affected user count, a direct loss amount, or whether an autonomous agent acted, so no failure_class, agent_involved, or user counts are given. Judgements made: root cause set to oversight and responsible party to third_party from the open-by-default marketplace and malicious publishers; detection method set to third_party based on the Koi Security audit; severity set to moderate because the scope is bounded to 341 skills of 2,857; the reporting feature was mapped to I5 as a judgement. Developer is taken as the OpenClaw creator named in the press article. Control G3 is marked missing because the sources describe no vetting of skills, and the sources do not state whether other controls held or failed. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Palo Alto Networks warned that OpenClaw was vulnerable by design, before the ClawHavoc findings.","quote":"In a report last week, Palo Alto Networks warned that OpenClaw represents what British programmer Simon Willison, who coined the term prompt injection, describes as a \"lethal trifecta\" that renders AI agents vulnerable by design due to their access to private data, exposure to untrusted content, and the ability to communicate externally.","source_index":1,"when":"last week"},{"text":"OpenSourceMalware reported the same ClawHavoc campaign, coinciding with the Koi Security findings.","quote":"The development coincides with a report from OpenSourceMalware, which also flagged the same ClawHavoc campaign targeting OpenClaw users.","source_index":1,"when":null},{"text":"OpenClaw's creator later rolled out a reporting feature allowing signed-in users to flag skills.","quote":"The issue with malicious skills hasn't gone unnoticed by OpenClaw's creator Peter Steinberger, who has since rolled out a reporting feature that allows signed-in users to flag a skill.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting","https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html"]}}