OpenClaw / ClawHub Supply Chain Attack

Between January and February 2026, the OpenClaw artificial intelligence agent ecosystem experienced a coordinated supply chain attack combining marketplace poisoning, architectural security weaknesses, and a critical remote code execution vulnerability. Security researchers identified between 30,000 and 42,665 internet-exposed instances globally, with 93.4% vulnerable to authentication bypass.

More than 1,184 malicious ClawHub packages were discovered, including 341 confirmed ClawHavoc campaign skills delivering Atomic macOS Stealer malware. This convergence of software supply chain compromise, persistent memory exploitation, and shadow AI deployment created systemic enterprise risk distinct from traditional application threats. Autonomous agent platforms operating with privileged access introduced a materially different threat model compared to standard applications.

Key Findings:

• ▸Threat actors deployed legitimate-appearing skills through the ClawHub marketplace with minimal vetting controls
• ▸ClawHavoc campaign weaponized installation documentation by embedding malicious curl commands piped directly into bash
• ▸CVE-2026-25253 enabled one-click RCE via WebSocket token exfiltration, exploitable even on localhost-bound services
• ▸SOUL.md and MEMORY.md agent files were exploited for persistent memory poisoning and delayed execution
• ▸Harvested data included credentials, browser data, cryptocurrency wallets, and SSH keys transmitted to C2 infrastructure
• ▸AI agent platforms with privileged access require a fundamentally different security model than traditional applications

OpenClaw is an open-source autonomous AI agent framework capable of interfacing with messaging platforms, executing shell commands, accessing local file systems, and maintaining persistent state across sessions. The ClawHub marketplace allowed minimally vetted developers to publish skills that executed with system-level privileges, creating a scalable and largely unguarded attack surface with no meaningful supply chain controls.

The ClawHavoc campaign weaponized installation documentation by embedding malicious prerequisite instructions. Users copying curl commands piped directly into bash executed Atomic macOS Stealer malware that harvested credentials, browser data, cryptocurrency wallets, and SSH keys before transmitting compressed archives to command and control infrastructure at 91.92.242.30.

Campaign sophistication was high, demonstrating detailed knowledge of OpenClaw internals, ClawHub marketplace operations, and enterprise deployment patterns. Targeting was opportunistic, ranging from individual developers to large enterprises. Multiple distinct threat clusters were identified with overlapping TTPs, indicating either a single well-resourced actor or coordinated activity across affiliated groups.

The ClawHavoc attack chain progressed through four distinct phases, spanning supply chain infiltration through credential exfiltration. Analysis identified 18 techniques across 11 MITRE ATT&CK tactics, demonstrating coordinated exploitation of supply chain trust, scripting execution, credential theft, and encrypted C2 channels. The infrastructure flow ran: Supplier to Compromised to Organization to ClawHub C2.

MITRE ATT&CK Mapping

Organizations should immediately inventory all OpenClaw installations, isolate affected systems, and rotate all potentially exposed credentials including cloud provider keys, SSH keys, and browser-stored passwords. All instances should be upgraded to version 2026.2.14 or later. Marketplace skill installation should be disabled unless explicitly approved through a formal change control process.

Security teams should investigate the following indicators across host, traffic, file, and network telemetry. Additional indicators include suspicious processes executing from temporary directories, unexpected access to keychain databases, and anomalous encrypted outbound data transfers to cloud storage services.

Effective detection requires layered monitoring across installation, execution, credential access, and network communication phases. Behavioral analytics should focus on deviations within SOUL.md and MEMORY.md files that may indicate persistent memory poisoning or delayed execution logic embedded by attackers during the compromise window.

Organizations experiencing suspected compromise should report incidents to CISA and coordinate with sector-specific information sharing organizations. Incident response teams should preserve forensic evidence, isolate impacted systems, and perform credential revocation across all affected environments. Continuous security architecture review is recommended prior to ongoing deployment of autonomous AI agents within enterprise environments.