Hundreds of malicious ClawHub skills for OpenClaw agents deliver infostealer malware
In early 2026 attackers published hundreds of malicious skills to ClawHub, the skill marketplace for the OpenClaw personal agent, disguised as tools for crypto analytics, finance tracking, social media and auto-updates. The skills instructed users to download and run external code during setup, delivering malware including a variant of the Atomic Stealer macOS infostealer; VirusTotal linked 314 malicious skills to one publisher, and Koi Security found 341 malicious skills out of 2,857. OpenClaw responded by scanning every published skill with VirusTotal and blocking those flagged as malicious.
OpenClaw warned that scanning is not a silver bullet, because a skill that uses natural language to instruct an agent to do something malicious will not trigger a virus signature. Skills run in the agent's context with access to the user's tools and data.
What would have stopped it
Scan and review third-party agent skills before publication and never let a skill's setup run downloaded code.
Guardrails
- G1 Least privilege Failed Skills run in the agent's context with access to the user's tools and data.
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Failed Agents loaded skills whose instructions directed downloading and running external code from untrusted sources.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Failed ClawHub had no malware scanning until after hundreds of malicious skills were found.
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“Over the last few days, VirusTotal has detected hundreds of OpenClaw skills that are actively malicious.”
-
“We’ve already seen documented cases of malicious actors attempting to exploit AI agent platforms.”
-
“With the help of an OpenClaw bot, security vendor Koi audited the skills files on ClawHub, and found that out of 2857, 341 were malicious.”
Confidence 91% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 3 sources