OpenClaw (formerly Clawdbot/Moltbot) is a fast-growing AI agent ecosystem that lets users automate tasks using natural-language 'skills' from a marketplace called ClawHub. Around 530 vulnerabilities have been discovered in under two years, many involving sensitive data storage and excessive privilege issues. Malicious skills pose a supply-chain-like threat — over 1,100 malicious accounts have been created since January 2026, distributing 600+ harmful skills before any security scanning was in place. OpenClaw has since partnered with VirusTotal and NVIDIA's SkillSpector for preliminary scanning, but attacks continue. Recommended mitigations include isolating the agent from critical infrastructure, scanning all incoming skills, monitoring network access, and enforcing a comprehensive AI usage policy.
