Every few months, the AI world crowns a new darling, and right now that crown sits firmly on OpenClaw. The open-source agent that started as Clawdbot, passed through a Moltbot rebrand, and now claims around two million monthly users has become the poster child for what personal AI assistants should feel like: chat with it on Telegram, Slack, or WhatsApp, and it books meetings, tidies files, and runs errands on your computer while you sleep.
That convenience is precisely why the latest campaign against it is so unsettling. Security researchers at Trellix have detailed an operation they call ClawHavoc, one that does not bother exploiting a clever software flaw. Instead, it walks in through the platform's own skill marketplace and asks the victim to grant it access. The result is the strongest evidence yet that the tool being sold as the future of automation is quietly becoming a supply chain attack surface.
Hiding in plain sight on ClawHub
The attack starts the way most modern supply chain compromises do: by poisoning the well. ClawHub, OpenClaw's official skill registry, was flooded with more than 350 malicious packages, according to Trellix. They were named to look like legitimate utilities, including clawhubb, clawhub-cli, and openclawcli, and pitched at people searching for cryptocurrency automation, software updates, and social media integrations. Several were artificially boosted to appear popular or trustworthy, an old marketplace trick transplanted into a new ecosystem.
When a user installed one and asked the agent to run it, the malicious skill did not try to break out of a sandbox. It used a ClickFix-style lure, instructing the agent to tell its human operator they needed to install a supposed security component named AuthTool. On Windows, victims were walked toward a password-protected ZIP archive. On macOS and Linux, they were told to paste a Base64-encoded terminal command directly. The user, convinced they were fixing a security issue, did the dirty work themselves.
That command fetched NovaStealer v2, a macOS-focused information stealer tied to the Atomic macOS Stealer family. The malware then digs through the machine looking for anything valuable, and its author clearly knew where the money lives.
- Data from more than 60 crypto wallets, including MetaMask, Phantom, Exodus, and Electrum.
- Browser cookies and saved login information.
- SSH keys, cloud credentials from providers like AWS, and .env files.
The breadth is the point. One pasted command, and an attacker potentially walks away with wallets, developer credentials, and cloud access in a single shot. Trellix notes this fits a broader pattern of attacks against Apple users, where deceptive prompts push people into running terminal commands on their own machines.
The uncomfortable truth about agent permissions
What makes ClawHavoc more than just another malware story is what it reveals about the trust model underneath these agents. In testing, Trellix found that OpenClaw could read clipboard contents, download and execute files, and create scheduled tasks when given commands. That is powerful automation. It is also, in the wrong hands, a remote administration tool with a friendly face.
The researchers warn that poisoned skills are only part of the problem. There is also indirect prompt injection, where hidden instructions sit inside emails, documents, web pages, or chat messages an agent is asked to process. Because the agent cannot easily tell attacker-controlled text from legitimate instructions, a hostile paragraph can turn it into an unwitting accomplice. This is not a speculative scenario. Similar prompt injection attacks against coding agents have demonstrated that hostile repository content can lead to unauthorized command execution.
For a platform that has grown this fast, the security tally has piled up in parallel. CertiK has gone so far as to call OpenClaw a primary supply chain attack vector at scale and advised ordinary users who are not security professionals to hold off installing it until the platform matures. Its researchers point to more than 280 GitHub Security Advisories and over 100 CVEs since the November launch, plus a string of ecosystem-level attacks. Independent surveys paint the same picture: within weeks of launch, security firms identified tens of thousands of internet-exposed OpenClaw instances, a meaningful share of them vulnerable to remote code execution.
OpenClaw founder Peter Steinberg, who recently joined OpenAI, told a Tokyo event that the team has spent the last two months focusing on security and that things are a lot better on that front. It is a reassuring message, and it may even be true. But it is exactly the kind of claim the community has heard before from fast-moving projects whose growth outraced their hardening.
What to do if you run it anyway
For those who cannot give it up, Trellix offers practical guardrails that read like the checklist for any privileged application, because that is what an agent effectively is.
- Update older OpenClaw deployments and avoid running it on a primary workstation.
- Place it on an isolated device or virtual server, restrict network access, and connect only low-risk accounts.
- Audit installed skills and watch for suspicious child processes, such as node.exe spawning PowerShell, curl, nc.exe, or schtasks.exe.
- Treat AI-generated tool requests as untrusted until verified, enforce approval gates on sensitive actions, and keep external content separate from privileged commands.
The uncomfortable gap between the promise and the reality is the story here. OpenClaw is genuinely impressive, and dismissing it entirely would be as naive as trusting it blindly. But ClawHavoc is a reminder that an agent with broad permissions and a trusting skill marketplace is only ever one bad package away from turning your savings into an attacker's payday. The hype says your personal assistant can do everything. The security research says that includes, apparently, emptying your wallet.
Comments