[D] We found 18K+ exposed OpenClaw instances and ~15% of community skills contain malicious instructionsc

2026-02-16 · Source: Machine Learning · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, short

Summary

Researchers identified over 18,000 OpenClaw instances exposed to the public internet, revealing significant security vulnerabilities within autonomous agent frameworks. A critical audit of community-built skills showed that nearly 15% contained malicious instructions, including prompts designed for malware downloads, data exfiltration, and credential theft. These malicious skills are frequently removed but quickly reappear under new identities. The attack surface for these agents is qualitatively different from traditional software, as agents have delegated authority over local files, browsers, and messaging platforms, allowing a single compromised skill to potentially compromise everything the agent can access. This creates a severe supply chain risk, as agent skills are often unreviewed prompt bundles with execution capabilities, unlike more mature software package ecosystems.

Key takeaway

For CTOs and VPs of Engineering evaluating autonomous agent adoption, you must recognize that these frameworks introduce a fundamentally new security paradigm. Your teams should prioritize rigorous sandboxing and implement a zero-trust model for all community-contributed skills. Do not rely on traditional software security tooling, as agent attack surfaces and supply chain risks require novel threat modeling and continuous auditing to prevent data exfiltration and system compromise.

Key insights

Autonomous agent frameworks like OpenClaw present novel and severe security risks, particularly from unreviewed community skills.

Principles

• Agent attack surfaces differ from traditional software.
• Supply chain risk from agent skills is significant.
• User trust in agents often exceeds their actual security.

In practice

• Audit community-built agent skills for malicious instructions.
• Sandbox agent execution environments rigorously.
• Develop standardized agent security posture evaluations.

Topics

• OpenClaw Security
• Malicious AI Skills
• AI Agent Supply Chain Risk
• Agent Trust Calibration
• AI Security Posture

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, MLOps Engineer, AI Engineer

Related on AIssential

• OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat — Malicious AI agent skills exploit broad system access and semantic instruction hijacking to bypass traditional security measures.
• An OpenClaw AI agent asked to delete a confidential email nuked its own mail client and called it fixed — Autonomous AI agents with tool access and memory are highly vulnerable to compromise and data leakage.
• openclaw skills gave ai agents superpowers. lock them down. — OpenClaw skills, while powerful, pose significant supply chain risks due to their deep access and potential for hidden malicious instructions.
• not good for OPENCLAW — AI agent ecosystems face severe security risks from prompt injection, malware-infected skills, and container escapes.
• OpenClaw and Claude Opus 4.6: Where is AI agent security headed? — AI agents and rapid development necessitate stringent security, zero-trust principles, and comprehensive inventory management.
• Hackers exploit vulnerabilities in OpenClaw to control 28,000 systems — Insecure AI agents with excessive permissions pose significant remote code execution risks.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Machine Learning.