{"schema_version":"0.10.0","id":"LR-2026-0406","record_version":1,"title":"Infostealer steals OpenClaw agent configuration files and gateway tokens","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"5018aac8de2f29b321bb9aef0e4108ef9d23e1d27f80bb7cb9cd7db9a470da4c"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":["access local files","log in to email and communication apps on the host","interact with online services"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"help manage everyday tasks and act as an AI assistant","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-02-13","date_disclosed":"2026-02-16","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"An OpenClaw personal AI agent ran on a victim's local machine, keeping a persistent configuration and memory environment. An infostealer, believed by Hudson Rock to be a variant of Vidar, used a broad file-grabbing routine rather than an OpenClaw-specific module and copied the agent's configuration files, including a gateway authentication token and device keys. The data was stolen on February 13, 2026. Hudson Rock detected the live infection and reported it. Researchers noted that the stolen token could let an attacker connect to the local instance if its port was exposed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/02/infostealer-steals-openclaw-ai-agent.html","publisher":"The Hacker News","date":"2026-02-16","type":"press","title":"Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/","publisher":"BleepingComputer","date":"2026-02-16","type":"press","title":"Infostealer malware found stealing OpenClaw secrets for first time - BleepingComputer","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.date_occurred":"C","event.incident_class":"C","event.detection_method":"C","system.intended_use":"C","system.tools_granted":"C","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":1,"quote":"Alon Gal, co-founder and CTO of Hudson Rock, told BleepingComputer that it is believed to be a variant of the Vidar infostealer, with the data stolen on February 13, 2026, when the infection took place."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim's OpenClaw (formerly Clawdbot and Moltbot) configuration environment."}],"event.detection_method":[{"source_index":1,"quote":"Hudson Rock has now detected a live infection where an infostealer successfully exfiltrated a victim's OpenClaw configuration environment,"}],"system.intended_use":[{"source_index":1,"quote":"Since its release, OpenClaw has seen widespread adoption worldwide, with users using it to help manage everyday tasks and act as an AI assistant."}],"system.tools_granted":[{"source_index":1,"quote":"The tool can access local files, log in to email and communication apps on the host, and interact with online services."}],"impact.severity":[{"source_index":1,"quote":"Hudson Rock has now detected a live infection where an infostealer successfully exfiltrated a victim's OpenClaw configuration environment,"}],"event.summary":[{"source_index":1,"quote":"OpenClaw (formerly ClawdBot and MoltBot) is a local-running AI agent framework that maintains a persistent configuration and memory environment on the user's machine."},{"source_index":0,"quote":"That said, the cybersecurity company said the data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a \"broad file-grabbing routine\" that's designed to look for certain file extensions and specific directory names containing sensitive data."},{"source_index":0,"quote":"device.json, which contains cryptographic keys for secure pairing and signing operations within the OpenClaw ecosystem."},{"source_index":1,"quote":"Alon Gal, co-founder and CTO of Hudson Rock, told BleepingComputer that it is believed to be a variant of the Vidar infostealer, with the data stolen on February 13, 2026, when the infection took place."},{"source_index":1,"quote":"Hudson Rock has now detected a live infection where an infostealer successfully exfiltrated a victim's OpenClaw configuration environment,"},{"source_index":0,"quote":"It's worth noting that the theft of the gateway authentication token can allow an attacker to connect to the victim's local OpenClaw instance remotely if the port is exposed, or even masquerade as the client in authenticated requests to the AI gateway."}]},"notes_on_gaps":"Sources are press only; no victim or vendor report is included. Not stated: model name and version, developer, harness, permissions scope, autonomy level, deployment context, lifecycle stage, date detected (Hudson Rock detection is undated), direct loss, records exposed, affected-party count, remediation hours, duration, time to contain, threat actor, trigger, and root cause. Judgements: agent_involved set false because the agent took no autonomous action and was only a theft target, so no failure_class is assigned; severity set to moderate because one victim's data of a third party was touched within a bounded scope; detection method set to third_party as Hudson Rock is a security firm, not the victim; date_occurred taken from the February 13, 2026 statement in source 1. No control is stated as held, failed, got around or missing, so links is empty. Maintainer measures against ClawHub skills in source 0 are not stated as responses to this incident, so no remediation is recorded. Unrelated items in source 0 and source 1 (Moltbook, exposed instances, nanobot flaw, vendor advertising) are omitted. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}