Cases › security breach › LR-2026-0419
341 malicious ClawHub skills found stealing data from OpenClaw users
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity moderate: data of others is touched (crypto assets, API keys, wallet keys, SSH credentials, browser passwords) with a bounded scope stated as 341 malicious skills across multiple campaigns.
ClawHub is a marketplace for third-party skills that extend OpenClaw, a self-hosted AI assistant, and OpenClaw users install them. A security audit by Koi Security of 2,857 skills found 341 malicious skills across multiple campaigns. Of these, 335 used fake prerequisites to install the Atomic Stealer macOS malware, and others hid reverse shell backdoors or exfiltrated bot credentials. A report from OpenSourceMalware flagged the same campaign. The marketplace is open by default and lets anyone upload skills, and OpenClaw's creator has since added a reporting feature that hides skills after more than three unique reports.
What happened
What was done
Risks
Primary24 incidents
Rising: 4 vs 0.2 a week
Read from the sources; not yet reviewed by a person.
Controls
ApplicationDid not exist Vetting of plug-ins, skills and dependencies
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Sandboxed code execution.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Signed and verified components, AI bill of materials, Vulnerability scanning of AI components, Model provenance checks, Least-privilege access for the agent.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Sandboxed code execution | L2 Harness | Not stated in sources |
| Vetting of plug-ins, skills and dependencies | L3 Application | Did not exist |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Signed and verified components | L3 Application | Not stated in sources |
| AI bill of materials | L3 Application | Not stated in sources |
| Vulnerability scanning of AI components | L3 Application | Not stated in sources |
| Model provenance checks | L3 Application | Not stated in sources |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 3 items from the primary sources
What happened, in order
Not dated in the sources:
- OpenSourceMalware published a report flagging the same ClawHavoc campaign, coinciding with the Koi findings.
- OpenClaw's creator later rolled out a user reporting feature for flagging skills.
- Palo Alto Networks had earlier warned that OpenClaw carries a lethal trifecta of risks for AI agents.
Show every field, with its source and grade
What happened
Impact
LR-2026-0419 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON