Cases › security breach › LR-2026-0309
ClawHavoc: 341 malicious skills on OpenClaw's ClawHub deliver infostealers
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: 341 malicious skills found in an audit of 2,857 skills across multiple campaigns.
Koi Security audited 2,857 skills on ClawHub, a marketplace of third-party extensions for the self-hosted OpenClaw AI assistant, and found 341 malicious skills across multiple campaigns. Of these, 335 skills used fake prerequisites to install the Atomic Stealer (AMOS) macOS stealer, and some hid reverse shell backdoors or exfiltrated bot credentials. The problem stems from the marketplace being open by default, with a publisher only needing a GitHub account at least one week old. OpenClaw's creator later rolled out a user reporting feature that lets signed-in users flag a skill. The same campaign was also flagged by OpenSourceMalware.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary24 incidents
Rising: 4 vs 0.2 a week
Read from the sources; not yet reviewed by a person.
Controls
ApplicationDid not exist Vetting of plug-ins, skills and dependencies
Control failure chain
L1 · ModelPeter SteinbergerModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Sandboxed code execution.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Signed and verified components, AI bill of materials, Vulnerability scanning of AI components, Model provenance checks, Least-privilege access for the agent.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Sandboxed code execution | L2 Harness | Not stated in sources |
| Vetting of plug-ins, skills and dependencies | L3 Application | Did not exist |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Signed and verified components | L3 Application | Not stated in sources |
| AI bill of materials | L3 Application | Not stated in sources |
| Vulnerability scanning of AI components | L3 Application | Not stated in sources |
| Model provenance checks | L3 Application | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 3 items from the primary sources
What happened, in order
Not dated in the sources:
- Palo Alto Networks warned that OpenClaw was vulnerable by design, before the ClawHavoc findings.
- OpenSourceMalware reported the same ClawHavoc campaign, coinciding with the Koi Security findings.
- OpenClaw's creator later rolled out a reporting feature allowing signed-in users to flag skills.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Sources state no dates for when the malicious skills were uploaded, found, or disclosed beyond press dates, so no event dates are given. Control G3 is marked missing because the sources describe no vetting of skills, and the sources do not state whether other controls held or failed.
LR-2026-0309 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON