News

Security researchers have uncovered an incident in which an information-stealing malware successfully removed configuration data belonging to an OpenClaw AI agent (previously known as Clawdbot and Moltbot) from a victim's environment.

Hudson Rock characterized the discovery as a pivotal moment in the evolution of credential-stealing malware, noting attackers are moving beyond browsers and accounts to capturing the “identity” and operational context of personal AI assistants.

Alon Gal, CTO of Hudson Rock, told The Hacker News that the infection indicators point to a variant of the Vidar infostealer. Vidar is a commercially available stealers family that has been observed in the wild since late 2018.

According to Hudson Rock, the breach did not require a bespoke OpenClaw plugin inside the malware. Instead, the stealer relied on a broad file-collection routine that searches for specific extensions and folder names that typically hold sensitive information. Among the files taken were:

• openclaw.json - this file held the OpenClaw gateway authentication token, along with the victim's partially redacted email address and the workspace path on the host.

• device.json - containing cryptographic keys used by OpenClaw for secure pairing and signature operations within its ecosystem.

• soul.md - a document describing the agent's fundamental operating principles, behavioral rules and ethical constraints.

Hudson Rock warned that stealing the gateway token is particularly dangerous: if a local OpenClaw instance is reachable over the network, an attacker could connect remotely, or craft requests that impersonate the legitimate client to the AI gateway.

The company added that although this malware wandered in search of generic “secrets,” it effectively captured the entire operational profile of a user's assistant. They expect infostealer authors will soon develop targeted parsers and decryption routines for agent files, in the same way threat actors have built modules for browsers like Chrome or messaging apps such as Telegram.

The disclosure arrives as OpenClaw's maintainers move to address security concerns. The project announced a collaboration with VirusTotal to scan uploads to ClawHub for malicious skills, to formalize a threat model, and to add auditing capabilities to detect misconfigurations.

Last week, the OpenSourceMalware group described an active campaign targeting ClawHub in which operators evade VirusTotal analysis by staging malicious payloads on look-alike OpenClaw sites and making the skill entries act only as decoys, rather than embedding the malware directly in SKILL.md files.

Security researcher Paul McCarty observed that the tactic of shifting payload hosting externally reflects adversaries adapting to detection tools, and warned that expanding AI skill registries increase the attractiveness of supply-chain attacks.

Separately, OX Security flagged another weakness related to Moltbook, a forum designed for AI agents (similar to Reddit) that predominantly serves OpenClaw-based accounts. Their research found that once an AI agent account is created on Moltbook it cannot be deleted, leaving users without a means to remove account data.

Research from SecurityScorecard's STRIKE Threat Intelligence team also revealed hundreds of thousands of openly reachable OpenClaw instances, a situation that likely exposes many deployments to remote code execution (RCE) risks.

Security firms explained that RCE flaws let an attacker send a crafted request that causes arbitrary code to run on the host system. If an exposed OpenClaw instance has permissions to email, APIs, cloud services or other internal assets, a single exploited service can serve as a powerful pivot into additional resources.

OpenClaw has seen rapid adoption since its launch in November 2025 and now boasts over 200,000 stars on GitHub. On February 15, 2026, OpenAI CEO Sam Altman announced that OpenClaw's founder, Peter Steinberger, will join OpenAI and that OpenClaw will be maintained as an open-source project within a foundation with continued support from OpenAI.