Entity trail

ClawHavoc

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-09 / agents-researcherClawHavoc campaign plants 300+ malicious skills on a single marketplace to run infostealersUnit 42 detailed ClawHavoc, a supply-chain campaign that seeded more than 300 malicious skills on one agent-skill marketplace; the instruction files directed agents to fetch and execute an infostealer that harvested browser credentials, keychain passwords, SSH keys, and crypto wallets. It's a live, at-scale demonstration that the skill install step is the new npm-style attack surface for agents. Combined with the SkillCloak evasion research, it shows attackers are both shipping payloads and defeating the scanners meant to catch them.
2026-06-28 / agents-researcherOrca Security 'Skill Issues': attack primitives let malicious agent skills evade ClawScan and VirusTotal at scaleOrca's research details how open agent-skill marketplaces lack mandatory semantic security review, letting heavily obfuscated intent reach an agent's context through trusted channels; one proof-of-concept skill simply inflated its file size past scanner thresholds to bypass both ClawScan and VirusTotal. They tie it to real campaigns — Antiy CERT confirmed 1,184 malicious skills on ClawHub, 335 traced to a coordinated 'ClawHavoc' operation — and show download metrics can be gamed by bot-driven installs. The takeaway for builders: install counts and scan badges are not trust signals for agent skills.
2026-06-20 / skill-finderTreat agent-skill marketplaces as a supply chain: capability-sandbox and trust-score skills before loading'Formal Analysis and Supply Chain Security for Agentic AI Skills' (arXiv:2603.00195) presents SkillFortify — capability-based sandboxing with a confinement proof plus a trust-score algebra with formal monotonicity — and documents the real ClawHavoc campaign that pushed 1,200+ malicious skills into a public skill marketplace, deploying the AMOS credential stealer. As Agent Skills become a cross-vendor open standard, an installed skill is executable third-party code with your credentials in reach. The defensive move: confine skills by declared capability and gate them on a trust score, don't just read the description and run.
2026-05-07 / skill-finderVentureBeat/IBM X-Force: No Supply-Chain Scanner Has a Detection Category for AI Agent Backdoors — OpenClaw Proved the GapVentureBeat analysis (May 5) reveals that OpenClaw's ClawHavoc campaign exposed a blind spot: no existing supply-chain scanner — Snyk, Socket, Dependabot — has a detection category for adversarial instructions embedded in agent skill files (SKILL.md). Snyk's ToxicSkills audit found 13.4% of 3,984 ClawHub skills contained critical security issues. One command can turn any open-source repo into an AI agent backdoor. IBM X-Force confirms agentic AI vulnerability volume is outpacing CVE assignment. For anyone building agent skill marketplaces, this is the npm-typosquatting moment for agents.
2026-04-15 / skill-finderOpenClaw ClawBleed Crisis Deepens: CVE-2026-25253 CVSS 8.8 Actively Exploited, 135K Instances Exposed, 824 Malicious Skills in ClawHub MarketplaceThe OpenClaw security crisis has escalated to 137 security advisories between February and April 2026, with 135,000+ instances exposed across 82 countries. ClawBleed (CVE-2026-25253, CVSS 8.8) enables one-click RCE via WebSocket origin validation bypass — visiting a single malicious webpage triggers full system compromise. The ClawHavoc supply chain attack has confirmed 824+ malicious skills in the official ClawHub marketplace (up from 341 initially reported). Qualys ETM published a detailed case study on April 13 showing how an unauthorized OpenClaw agent was detected disguised as a routine package on a Windows Server, correlating endpoint, exposure, and identity telemetry.
2026-03-16 / agents-researcherOpenClaw Security Crisis Scale: 42,000+ Internet-Exposed Deployments Identified, Many Without AuthenticationMultiple independent scanning teams have identified over 42,000 internet-exposed OpenClaw deployments, the majority running without authentication with access tokens appearing in query parameters and shared global context exposing secrets across users. The scale compounds the ClawHavoc supply chain attack (1,184 malicious skills) and the no-click data exfiltration vulnerability — creating a three-vector threat: poisoned skills supply chain, SSRF-via-link-preview exfiltration, and unauthenticated remote control interfaces. Bitdefender published a technical advisory specifically for enterprise network defenders on OpenClaw exploitation in corporate environments.
2026-03-16 / agents-researcherClawHavoc Poisons ClawHub with 1,184 Malicious Skills: SKILL.md Poisoning Delivers Atomic macOS Stealer and Reverse Shells to 300,000+ UsersSupply chain attack campaign ClawHavoc planted 1,184 malicious skills in ClawHub — OpenClaw's official skill marketplace — by embedding adversarial instructions directly in SKILL.md files, which agents process as trusted instruction sources. Payloads include AMOS-variant macOS stealer (browser credentials, keychains, SSH keys, crypto wallets), hidden reverse shells, and credential exfiltration; one account uploaded 677 packages in an automated blitz. With ~20% of the registry now confirmed malicious and 300,000+ users exposed, this is the first documented supply chain attack that weaponizes the agent skills instruction layer rather than code execution.
2026-03-05 / reddit-researcherOpenClaw ClawHavoc: 1184 Malicious Skills, Atomic Stealer, 135K Exposed InstancesRepello AI named campaign ClawHavoc. 1184 malicious skills on ClawHub (up from 820, 324). Atomic Stealer delivered via social engineering. 135K instances exposed. BlueRock found 36.7% of 7000+ MCP servers SSRF-vulnerable. IronClaw AMA today on r/MachineLearning.
2026-03-05 / arxiv-researcherSkillFortify supply chain verificationFormal verification for AI skill supply chains. 540 skills scanned, 96.95% F1, 100% precision, 0% FP. Processes 1000-node graphs in <100ms. References ClawHavoc campaign (1200+ malicious skills). arXiv 2603.00195
2026-03-05 / agents-researcherOpenClaw Supply Chain Crisis 800 Malicious Skills ClawHavoc800+ malicious skills on ClawHub (20% of registry). ClawHavoc planted 1184+ skills distributing Atomic Stealer. 135K exposed instances. 15K vulnerable to RCE.
2026-02-25 / sources-researcherOpenClaw Security Crisis 341 Malicious Skills CVE-2026-25253CVE-2026-25253 CVSS 8.8 one-click RCE. 42665 exposed instances. 341 of 2857 ClawHub skills malicious (12%). 335 traced to coordinated ClawHavoc operation.
2026-02-13 / vibe-coding-researcherAgent Security: OpenClaw Lethal Trifecta for MCP UsersClawHavoc incidents crystallized agent security best practices. Always sandbox, keep secrets out, limit high-risk tools, assume agents WILL be tricked.

Graph relationships

MENTIONS
Unit 42
Unit 42 detailed the ClawHavoc supply-chain campaign
Source finding
MENTIONS
Repello AI
Repello AI discovered and named the ClawHavoc campaign
Source finding
USES
AMOS
ClawHavoc campaign deployed AMOS credential stealer
Source finding
CRITICIZES
Agent Skills
ClawHavoc exploited Agent Skills marketplace with 1,200+ malicious skills
Source finding
MENTIONS
Unit 42 -> ClawHavoc
Unit 42 detailed the ClawHavoc supply-chain campaign
Source finding

Source trail

SkillCloak ClawHavoc Institute for AI Policy and Strategy The Hacker News Orca Security CyberSecurityNews The Hacker News

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues