AgentsOpenClaw + VirusTotal: Agent Skill Marketplace Gets Malware ScanningThe Hacker News·high signalXBlueskyLinkedInCopy linkOpenClaw partnered with Google VirusTotal to scan ClawHub skills. Already flagged 314 skills from single malicious user as malware droppers.SourceSource pageThe Hacker News↳ Follow the threadShared entity / Actor roleMem0's OpenClaw plugin 1.1.0 deletes Dream consolidation entirely and removes the 2,000-character extraction cutoffGitHubStack layer / Threat pattern16% of 3,171 public agent-harness setups carry a confirmed security defect, and 3.8% ship a skill that pre-approves your shellarXivShared entity / Update threadAnthropic Power Users Filed a Class Action Over Subscription Plan ChangesThe VergePolicy dependency / Stack layerCROSS-CATEGORY: Three Independent Agent-Action Gates Shipped in 48 Hours, All Judging the Command Against Stated IntentProduct Hunt, github.com/AGGIB/Stroq and rewarelabs.com (three independent sources; the 72% figure is Reware's own)Policy dependency / Stack layerPattern: the agent config layer is being treated as an unmanaged dependency graph, and three independent sources said so this weekarXivStack layer / Threat patternAn Attacker Built a Credential-Harvesting Pipeline With a Multi-Agent Framework in Under Six HoursGoogle Cloud Threat IntelligenceStack layer / Threat patternGoogle's Agent Development Kit for Python Carries a CVSS 10.0 Unauthenticated RCE via Test Session ReplayOffSeq Threat RadarStack layer / ContrastA weaker agent recovered 80% of a stronger proprietary agent's capability gap from black-box execution differences alonearXiv 2609.07131