575 poisoned OpenClaw skills: criminals turn AI agents into an attack vector

What it's about

Security vendor Acronis has published its threat report "TRU Cyber Pulse 2026", covered by Help Net Security among others. The most striking number concerns AI agents: the researchers found more than 575 malicious skills for OpenClaw that infected Windows and macOS machines with trojans, crypto miners and so-called infostealers, programs that harvest passwords, credentials and crypto wallets.

OpenClaw is a popular open-source framework for self-hosted AI assistants. It used to be called Clawdbot and then Moltbot. An agent like this doesn't just chat. It can act: read email, edit files, launch programs. It gains new abilities through skills, extension packages that usually consist of instructions for the AI (a file called SKILL.md) and often executable code too. The main hub for them is the ClawHub marketplace, where basically anyone can upload.

Acronis spells out why that's dangerous: skills can combine instructions with code that uses the permissions the agent already has. If you give an agent access to your inbox, your files and your terminal, you're also handing that access to every skill you install.

How the traps work

Other security firms described in detail how these attacks work back in early 2026. Snyk outlines a typical scenario. You ask your agent to check your Gmail. It suggests installing the "Google Services Action" skill. After installation, it tells you the skill also needs a helper program called "openclaw-core" and shows you a download command. You paste it into your terminal, and your machine is compromised. There is no such program as "openclaw-core". It's made up.

The trick is that the malicious code isn't in the skill itself. It sits behind a link in the "Prerequisites" section. For Windows, the "google-qx4" skill Snyk analyzed pointed to a password-protected ZIP archive on GitHub. The password keeps automated virus scanners from looking inside. For macOS and Linux, the link led to a paste on rentry.co containing an obfuscated command. That command pulled down a script from a domain controlled by the attackers. Because the attackers can swap out the content there at any time without touching the skill, simple blocklists barely help.

Snyk calls this a shift from prompt injection, tricking an AI with smuggled-in instructions, to "agent-driven social engineering": the AI becomes an unwitting but convincing accomplice that makes the attackers' instructions look legitimate. And because a human runs the command, the attack also sidesteps any sandbox, the isolated environment the agent is supposed to work in.

Earlier findings: ClawHavoc and Atomic Stealer

The Acronis number is the latest in a series:

According to The Hacker News, the ClawHavoc skills posed as crypto tools (Solana wallet trackers, "lost Bitcoin" finders), bots for the betting platform Polymarket, YouTube helpers, auto-updaters, finance tools and supposed Gmail and Google Drive integrations. Others imitated the marketplace itself with slightly misspelled names like "clawhubb" or "cllawhub". Atomic Stealer (AMOS) is an off-the-shelf macOS data thief that criminals can rent for $500 to $1,000 a month. The Hacker News says targeting Macs wasn't a coincidence: many users buy a Mac mini to run OpenClaw around the clock. Some skills also hid backdoors in otherwise working code, or sent the credentials from the file "~/.clawdbot/.env" to the attackers.

OpenClaw developer Peter Steinberger responded with a reporting feature: signed-in users can flag skills, and once a skill gets more than three reports, it's automatically hidden. To publish skills, you need a GitHub account that's at least a week old. According to Snyk, though, attackers adapt faster than the platform reacts: banned skills often reappear as clones within hours.

One attacker, ten AI models

The Acronis report also shows how criminals use AI agents themselves as attack tools. In an investigation dubbed BOSSAI, the researchers documented a single attacker who connected more than ten AI models to tools for reconnaissance, scanning and exploiting vulnerabilities. Using the messengers WeChat and LINE, he handed out tasks, monitored the agents and ran several attacks at once. Reusable instructions carried tactics and target information from one campaign to the next. Targets included emergency and government systems in Taiwan and universities in Thailand, plus harvesting phone data in Mexico. Several tools were configured to run without asking for confirmation, so the agents could pick and launch them on their own within their permissions.

Hugging Face, the largest platform for open AI models, is affected too: Acronis found malicious code there disguised as models, datasets or AI apps.

Palo Alto Networks had earlier cited OpenClaw as an example of what programmer Simon Willison calls the "lethal trifecta": access to private data, exposure to untrusted content and the ability to communicate externally. The agent's persistent memory makes this worse, according to researchers Sailesh Mishra and Sean P. Morgan:

"With persistent memory, attacks are no longer point-in-time exploits. They become stateful, delayed-execution attacks."

In other words, harmless-looking fragments can pile up in memory and only later combine into a malicious instruction.

What else the report shows

Beyond AI, Acronis describes several other trends. Stolen browser sessions give attackers access to cloud services without triggering another multi-factor (MFA) prompt. On 63.1 percent of more than 1.8 million devices running Acronis' own remote management software, at least one additional remote access tool was installed. Sometimes that's a leftover from switching service providers, but for attackers it's a potential foothold. In the Red Heron campaign, a working exploit for the code hosting platform Gitea appeared one day after a security update. The attackers used it to steal code repositories and credentials.

Ransomware, malware that encrypts data and demands payment, is increasingly going after monitoring and recovery. Qilin deletes Windows shadow copies, the system's automatic backup snapshots. The Gentlemen group ships tools for disabling security software. LockBit 5.0 shuts down virtual machines on VMware ESXi servers so it can encrypt them, and INC deletes snapshots. The TamperedChef campaign used ads and search results to distribute working PDF tools with valid code-signing certificates, obtained through a rotating set of US shell companies.

Our take

The report confirms what security researchers have been seeing for months: open marketplaces for AI agents have the same problems that browser extensions and code libraries once had. The difference is that here, a program with sweeping permissions actively helps install the malware. Traditional security tools check code for known vulnerabilities, not plain-English instructions telling you to download something. For you as a user, that means: treat skills like any third-party software, don't paste commands into your terminal unchecked just because an agent asks, and give agents only the permissions they actually need. If you've installed a suspicious skill, Snyk and SOC Prime recommend disconnecting the machine from the network, looking for unknown programs and scheduled tasks, and rotating all credentials, API keys and wallet keys.

One caveat: these numbers come from security companies, some of which sell their own protection products. The studies use different methods and time frames and can't be compared directly. None of the sources say how many users were actually affected.