When Agents Go Rogue: The OpenClaw Supply Chain Crisis

By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026
This blog was also written by Akhil Reddy and Pavan Kumar Podila

Executive Summary

The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of autonomous, agentic AI frameworks. Leading this charge is OpenClaw, a wildly popular open-source project that bridges large language models (LLMs) with direct access to the host operating system. It enables the AI to directly interact with system resources, execute commands, and modify environments, thereby exposing multiple entry points for exploitation across both software and operational layers.

In late January and February 2026, Trellix Advanced Research Center identified a wave of critical vulnerabilities and active exploitations targeting OpenClaw deployments.

The investigation began as a massive supply chain offensive, targeting the ClawHub skill registry dubbed as ClawHavoc. Yet, what started as a user-triggered, social engineering attack has been identified in over 300 unique skills/platforms and has expanded into a full-spectrum crisis. Threat actors are currently targeting OpenClaw through several exploit vectors:

• Supply chain poisoning: Utilizing ClickFix social engineering to deploy the NovaStealer malware via the ClawHub registry. The user is tricked into manually copying a provided Base64-encoded terminal command or installing a fake companion tool (often named AuthTool) to "fix" the issue.
• Indirect prompt injections (IDPI): Weaponizing emails and documents to hijack the agent's logic flow.

This comprehensive technical report provides an in-depth analysis of these attack vectors, the supply chain poisoning, profiles the threat actors involved, details the NovaStealer payload, maps the attacks to the MITRE ATT&CK framework, and provides actionable, enterprise-grade mitigation strategies.

Introduction: The agentic attack surface and shadow AI

Originally launched in December 2025 as Clawdbot, the framework was created by a well-known developer, Peter Steinberger, known for his work on a popular document technology platform. It quickly went viral, positioning itself as a way to transform standard computers into intelligent, self-learning home servers capable of generating their own “vibe code.” The surge in interest was so significant that it reportedly led to temporary shortages of compact desktop systems in several U.S. retail outlets.

Following trademark-related concerns over similarities with an existing AI product, the project was briefly rebranded as Moltbot before ultimately settling on the name OpenClaw.

While this autonomy drastically increases productivity, it completely bypasses traditional security perimeters. OpenClaw connects to messaging apps, reads local file systems, and runs unsandboxed terminal commands. Furthermore, it is highly resource-intensive, with single phases of experimentation consuming hundreds of millions of LLM tokens.

This deep integration into users’ digital lives is both its greatest strength and its most significant security failure. A late January 2026 security audit revealed a staggering 512 underlying vulnerabilities in the framework, eight of which were classified as critical. This phenomenon represents a dangerous evolution of Shadow IT into Shadow AI, where unregulated, high-privileged entities operate on corporate endpoints outside the purview of IT security.

Our initial testing and observations around the ClawHavoc campaign and the relevant OpenClaw security issues are based on OpenClaw releases prior to v2026.1.29 and registry snapshots from March–May 2026.

The specific technical issues we looked at are not present in the latest OpenClaw releases. However, older versions may still be running in some environments if they haven’t been updated.

Our findings are therefore based on the versions and registry state we observed during the research period.

The supply chain crisis (ClawHavoc)

OpenClaw’s extensibility relies on a centralized skill registry called ClawHub. Due to the lack of moderation, categorizing, and filtering, the registry quickly became a breeding ground for malware.

Phase 1: Typosquatting & algorithmic manipulation

Threat actors flooded the registry with over 350 malicious skills. They targeted crypto automation (polymarket-traiding-bot), developer tools (auto-updater), and social media integrations. Attackers leveraged botnets to artificially inflate download metrics, pushing packages like clawhub-cli (a typosquat) to the Top Rated section.

The official command line tool used by developers to authenticate and manage their environments is the “clawhub” CLI. Attackers uploaded distinct skills to the registry using slight misspellings, such as clawhubb, clawhub-cli, or openclawcli. Inside the SKILL.md file, the metadata declaration mapped directly to the typosquatted name. For example:

This matching metadata ensured that if a user accidentally ran a command like “clawhub install clawhub-cli” instead of interacting with their local system commands, the registry seamlessly resolved and deployed the malicious package.

Phase 2: The ClickFix dropper

The attackers embedded a ClickFix pattern directly into the skill's markdown instructions (SKILL.md). The LLM reads the markdown and explicitly instructs the user to comply with a fake security requirement.

The AI agent stops and prompts the user that it cannot proceed until the required AuthTool has been installed. This effectively weaponizes the AI as a social engineering proxy.

Phase 3: Payload delivery and execution

• Windows: The user downloads a password-protected ZIP (AuthTool.zip, password 1234), evading edge network inspection.
• macOS/Linux: The user executes a Base64-encoded shell script:

This skill operates as a deceptive Base64-encoded command designed to fetch a Mach-O universal binary, known as NovaStealer, from the IP address 91.92.242.30. Once downloaded, it sets up and runs this external binary on macOS systems.

Malware reverse engineering: NovaStealer v2 overview

The primary payload delivered via the ClawHavoc campaign is NovaStealer v2 (a variant of the Atomic macOS Stealer / AMOS).

Binary analysis (Mach-O)

• Architecture: Universal binary (x86_64 for Intel, arm64 for Apple Silicon). Size: ~521 KB.
• Obfuscation: Custom XOR routine to hide internal strings (target paths, C2 URLs) until runtime.

Target acquisition profile

NovaStealer aggressively hunts for files relevant to Web3/AI developers:

1. Crypto wallets (60+ targeted): MetaMask, Phantom, Exodus, Electrum.
2. Developer secrets: ~/.ssh/id_rsa, ~/.aws/credentials, .env files.
3. System data: macOS keychain data, and login data/cookies from all major browsers.
4. Agent context: Reads ~/.clawdbot/HEARTBEAT.md to map agent activity and steal LLM context windows.

Under the hood: The God Mode problem

OpenClaw's underlying architecture fundamentally lacks least-privilege design, operating in what researchers call God Mode.

1. Unrestricted subprocess execution: Uses unconstrained child_process.exec() calls. There is no chroot jail or command whitelisting.
2. OS-Level clipboard API polling: OpenClaw continuously polls native clipboard APIs (e.g., pbpaste). If hijacked via a malicious skill, it acts as a native keylogger, capturing passwords and 2FA codes.
3. Insecure credential storage: Writes sensitive OAuth tokens to plaintext configuration files (~/.openclaw/workspace/.env), bypassing the OS security enclaves.

We reproduced several proof-of-concept scenarios within our controlled lab environments to validate their behavior and assess their real world impact. In the sections that follow, we provide a detailed walkthrough of these proof of concepts (PoCs), highlighting the execution flow, observed outcomes, and the associated security implications.

Execution proof of concept: Mapping the baseline threat

To understand the severity of an autonomous AI framework compromise, we must first establish its baseline execution capabilities. In our laboratory environment, we tested OpenClaw's raw access using direct user prompts. Despite common-sense security assumptions that an AI should not act as a system administrator, the agent eagerly executed high-risk, OS-level commands without hesitation, completely bypassing standard application sandboxing.

• Data exfiltration via clipboard hijacking:
  The framework implements a cross-platform approach to interact with the system clipboard by invoking native utilities across different operating systems. By leveraging commands such as pbcopy, xclip, and PowerShell’s Set-Clipboard, it abstracts clipboard access into a unified function. While this design improves portability and ease of use, it also introduces security concerns by enabling programmatic access to sensitive clipboard data that may be unintentionally exposed or misused.Figure 1: Cross-platform clipboard access enabling potential data exfiltration

We prompted the agent to read the latest content from the local clipboard and save it to a file.

The agent successfully executed the request. As verified by our telemetry, the framework spawned a PowerShell instance to invoke the native Get-Clipboard utility. If a user had a password stored in their clipboard (e.g., copied from a password manager), the AI successfully dumped it to disk.

• Payload staging and execution (dropper behavior):
  Next, we tested if the agent could be used to fetch and execute external binaries. We instructed it to use curl to download a Netcat executable (nc.exe) from a local server, save it to the temp folder, and execute it to listen on port 9999.

OpenClaw flawlessly acted as a malware dropper. The process tree telemetry shows exactly how the AI leveraged native living-off-the-land (LotL) binaries, utilizing PowerShell to download the file and subsequently execute the reverse shell listener.

• Establishing asynchronous persistence:
  Finally, we tested the agent's ability to survive reboots by asking it to create a cleanup script and automatically add it to the Windows Task Scheduler.

The agent obliged, generating the script and silently executing schtasks.exe via the command line to establish a persistent, scheduled system job.

The IDPI attack chain: Weaponizing the context window

While our laboratory PoC utilized direct user prompts to map these execution boundaries, an adversary does not require chat interface access to achieve these exact results. By exploiting the merged control and data planes, threat actors use indirect prompt injection (IDPI) to silently hijack the LLM's logic layer.

In an IDPI scenario, the execution telemetry (the powershell.exe, curl, and schtasks.exe process trees demonstrated above) remains identical. However, the delivery mechanism shifts from a direct user command to an autonomous parsing event. Here is the technical breakdown of the hijack:

• Context window poisoning & attention hijacking:
  A legitimate user triggers the OpenClaw agent to process external data (e.g., "Summarize the latest alerts in this Slack channel" or "Scrape this vendor's website"). As the LLM ingests the document object model (DOM) or chat logs, it encounters a carefully crafted, hidden adversarial payload:

Because transformer attention layers dynamically assign high-probability weights to assertive, directive tokens (like "SYSTEM OVERRIDE"), the injected plaintext effectively overwrites the developer's original system prompt within the context window.

The translation layer: From JSON to native OS execution

Instead of outputting a benign summary of the scraped data, the hijacked LLM fulfills the attacker's directive by generating a strictly formatted JSON tool call response.

This is the critical failure point of the framework's architecture. To understand why this JSON instantly translates to a system compromise, we must examine the underlying OpenClaw source code that handles the bash-tools.exec module.

When the OpenClaw gateway daemon receives the LLM's JSON response, it passes the arguments directly into a Node.js runtime environment utilizing the child_process module:

Because the application inherently trusts the LLM's output as an administrative directive, it blindly passes the args.command string to the host operating system's shell. The AI has unwittingly acted as a fully autonomous malware dropper, perfectly mirroring the malicious process trees we observed in our direct PoC testing.

Blind trust meets shell access: A critical risk in OpenClaw

OpenClaw introduces powerful automation capabilities, but its design also exposes critical security gaps. The framework natively routes batch commands through the Windows command interpreter (cmd.exe), a behavior that attackers abuse to execute living-off-the-land (LotL) techniques and evade traditional defenses.

At the same time, it demonstrates a dangerous pattern of blind parameter trust, where unverified JSON output generated by the LLM is directly cast into privileged system parameters. This means the model’s output can dictate command execution, environment variables, and even process visibility without proper validation effectively granting AI-generated input direct control over system-level operations.

Together, these behaviors significantly increase the risk of exploitation by enabling stealthy command execution and reducing the safeguards typically enforced between user input and system actions.

Defensive posture: Why traditional heuristics fail

This execution pipeline completely bypasses network intrusion detection systems (NIDS) and traditional antivirus file scanning at the perimeter. The payload traversing the network to poison the LLM's context window is not a compiled executable or a known malicious hash; it is polymorphic, plaintext English.

We cannot rely on input sanitization, blocklists, or Regex filtering to stop IDPI, because the variations of human language are mathematically infinite.

As clearly evidenced by the process explorer trees in our lab tests, the only mathematically sound defense is to assume the LLM's nondeterministic logic will eventually be compromised. We must enforce strict mandatory access control (MAC) and behavioral boundaries on the OpenClaw binary itself. 

MITRE ATT&CK mappings on observed TTPs

Comprehensive detection and mitigation strategies

Handing your data over to OpenClaw at this stage is, at best, unsafe. However, for organizations or enthusiasts running the agent, strict adherence to the following mitigations is mandatory:

Architectural & network hardening

• Dedicated hardware: Never install OpenClaw on a primary home or work machine. Use a dedicated spare computer or an isolated virtual private server (VPS).
• Reverse proxy hardening: Ensure your reverse proxy passes the correct X-Forwarded-For headers. Explicitly bind the OpenClaw service to a socket or implement Basic Auth/OAuth in front of the gateway to prevent public Shodan exposure.
• Allowlist network isolation: Practice an allowlist only approach for open ports, isolating the OpenClaw device at the network level.
• Burner accounts: Only connect burner accounts (Slack, Telegram, Email) to the agent. Never connect enterprise directories.

Routine auditing

• Regularly audit OpenClaw's security status by running the framework's native diagnostic command: security audit --deep.

OpenClaw misuse detection strategy

OpenClaw's God Mode capabilities, when abused via IDPI or supply chain attacks, translate directly into a full scale attack chain on the host. An adversary can use the agent for:

• Reconnaissance: The agent can read local file systems to identify sensitive directories, configuration files (.env), and credentials stores (~/.ssh/id_rsa, macOS Keychain).
• Stealing/data exfiltration: Exploiting the framework's native access to clipboard APIs for keylogging and extracting sensitive data (passwords, 2FA codes, crypto wallets) before exfiltrating it over a C2 channel.
• Persistence: Establishing asynchronous persistence by generating and executing scheduled tasks (schtasks.exe) via OS commands.

To detect these low-fidelity indicators that often precede a major attack, Trellix relies on a layered detection strategy powered by expert rules and supplementary IOC Content. Since the core attack vector is a polymorphic, plaintext payload hijacking the LLM's logic, traditional hash- or signature-based defenses fail. Instead, our detection focuses on the behavioral outputs of the compromised OpenClaw binary.

• Expert rules: These rules can target the malicious child-process chain initiated by the node.exe process (OpenClaw's runtime). For instance, an expert rule can be deployed to flag the OpenClaw process spawning non-standard, high-risk child processes, such as powershell.exe followed by curl or nc.exe, or the invocation of schtasks.exe to establish persistence. These rules can effectively sever the parent-child execution chain at the OS level, which is the only “mathematically sound defense.”
  
  
• HX IOC content: This content targets the delivery and staging phase by focusing on the file write operation. It utilizes the high-fidelity signatures to generate critical alerts when known malicious supply-chain artifacts, such as clawdAuthenticatorTool.zip or openclawcli.exe, are written to the local file system. This enables detection and rapid incident response before the malware can detonate or execute.
  
  
• Supplementary content: This content extends detection coverage by identifying specific file access patterns and some specific LotL binaries used in the payload staging and execution phases.

Indicators of Compromise (IOCs)

Conclusion

The OpenClaw crisis is a watershed moment for the cybersecurity industry. It violently demonstrates that the automation of productivity inherently automates exposure. We are moving from a world where malware simply executes predefined code to one where malware can reason, adapt to the local environment, and actively social engineer the user through prompt manipulation.

Trellix's integrated security solutions safeguard an organization's digital environment across endpoints, networks, data, email, and the cloud, and enhance security operations through a range of technologies and features. Trellix's security solutions leverage AI, real-time intelligence, behavioral analysis, and cloud-based detection to remain adaptable and resilient against evolving cyber threats. With continuous learning and dynamic threat response capabilities, Trellix's proactive security enables organizations to anticipate and address emerging challenges in the dynamic cybersecurity landscape.

Discover the latest cybersecurity research from the Trellix Advanced Research Center.