Cybercriminals Weaponize OpenClaw AI Agent in ClawHavoc Campaign to Distribute Infostealers
Cybercriminals have turned the OpenClaw AI agent into a convincing delivery mechanism for infostealers through a campaign called ClawHavoc.
Attackers uploaded hundreds of seemingly useful skills to the ClawHub catalog. These skills prompt users to install a mandatory tool or paste an encoded command into the terminal, all while appearing as legitimate configuration steps recommended by the AI assistant.
On macOS, victims are directed to commands that download the Atomic macOS Stealer (AMOS). On Windows, the same technique delivers password-protected archives and fake verification utilities, recreating the classic ClickFix social-engineering pattern but with an AI assistant acting as the trusted courier.
Researchers from Trellix discovered 341 malicious skills in total, 335 of which used fabricated installation requirements for AMOS. Repository history analysis revealed 1,184 suspicious packages associated with 12 distinct authors.
The stolen data includes passwords, browser credentials, cryptocurrency wallets, API keys, SSH keys, cloud accounts, .env files, source code, and tokens for connected services. Once OpenClaw has unrestricted terminal access, a simple text instruction can be converted into a PowerShell or Bash command.
Users are recommended to update OpenClaw, review all installed skills, remove anything suspicious, and rotate any potentially leaked credentials. Security experts advise running the agent in an isolated environment with minimal privileges and no access to production secrets.
Related articles
How to Build an AI Agent for Pentesting Without Turning It Into a Black Box
Most security specialists use language models as advanced references where the human reviews every suggestion before execution. With autonomous AI agents the workflow changes dramatically as the agent plans steps, calls tools, analyzes outputs and maintains memory across multiple iterations. This automation introduces serious risks because specialists may see only the final result without understanding which hypotheses were tested or why specific commands were chosen. CyberED and Standoff Hackbase are running a practical AI pentesting challenge to help participants build controllable agents. The event includes a live webinar on 10 September followed by a week-long hands-on period on the Standoff Hackbase training range. Experts emphasize defining strict technical boundaries, logging every decision, and keeping high-risk actions under human oversight.
AI Agents Remember Everything: Privacy Risks of Persistent Memory
AI agents are advanced models capable of calling external and internal tools while cycling through complex tasks. They retain extensive memory of user actions, model responses, tool usage, and all related interactions. This design allows agents to learn user preferences such as specific formatting rules or language choices after a single explanation. Personalization improves efficiency but creates detailed profiles of communication styles, habits, and personal information. The stored data raises questions about what a personal AI assistant might remember and with whom that information could be shared. The article from Selectel highlights how convenience in AI agents directly conflicts with user privacy expectations.
AI Detection Agents Shift Cybersecurity from Alerts to Autonomous Investigations
AI-powered detection agents are redefining how organizations identify and respond to cyber threats by moving beyond simple signature matching and alert generation. Instead of forwarding isolated events to human teams, these agents now perform initial investigations themselves, correlating telemetry from multiple sources and reconstructing attack chains before escalating any incident. The technology has progressed from theoretical discussions to active budget conversations, forcing security teams to evaluate how much triage work can be handled autonomously. Traditional monitoring systems deliver chronological events and leave analysts to connect the dots manually, while the new agents handle correlation, timeline verification, and scope assessment upfront. Attack automation has increased the urgency, as malicious actions can now produce effects faster than human analysis can complete. The agents collect artifacts, review asset history, check for repeated behavior, and determine the real impact, redistributing analyst workload without removing the need for human judgment on business impact and response decisions.
Local LLM Contract Analyzer Hit by Prompt Injection Despite Anti-Leak Instructions
A developer running a local nine-billion-parameter LLM for contract risk analysis discovered two suspicious log entries overnight. One contained repetitive garbage text, while the second embedded a classic prompt injection inside what appeared to be a legitimate contract: an instruction to ignore prior rules and output the full system prompt. The model partially complied by generating a fabricated risk entry titled SYSTEM PROMPT LEAK that described its own instructions, all while respecting the required JSON schema. Multiple defense layers were implemented, including input validation, regex-based injection phrase detection, an explicit rule inside the system prompt, and an output filter that replaces suspected leaks. Testing later revealed that the model still followed a hidden instruction to silently omit a specific contract clause, demonstrating that prompt-level rules only shift probabilities rather than enforce hard boundaries. The incident highlights that any document fed to an LLM must be treated as potentially hostile input.