An OpenClaw supply-chain attack exists in which attackers manipulated AI agents into recommending or facilitating malicious actions, including getting users to install malware. There’s Trellix research on the OpenClaw supply-chain attack along with Palo Alto Networks Unit 42 research on OpenClaw’s agent-skill supply chain that you can read at your leisure… Or maybe not so leisure given the gravity of the situation.
Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)
“AI agents are quickly becoming a new trust layer in the attack chain, and attackers know that trust is often easier to exploit than technology. When a manipulated agent recommends software, a workflow, or a next step, users can inherit the attacker’s influence without realizing it. Organizations should treat AI agents like any other high value system, with adversarial testing, strict guardrails, and continuous validation of what the agent can see, recommend, and act on.”
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“This particular story is wild because it mixes social engineering with supply chain attacks, which is fascinating in and of itself. But I think the bigger issue is the sheer number of people now using AI tools for development who have little to no background in IT, software development, or security.
“AI and open tools like OpenClaw have made it incredibly easy for people to build things quickly and get much closer to that original promise of technology doing complicated work on their behalf. On one hand, that’s fantastic. It lowers the barrier to entry and lets people create things they never could have built before.
“But there’s a security problem hiding underneath all of that. People are downloading packages, installing tools, granting permissions, and running code without necessarily understanding what those actions mean. And frankly, some of these basic security principles are being missed even by seasoned IT professionals. As AI makes development easier and more accessible, we have to make security awareness just as accessible, because the population of people building and running software has suddenly become much larger than the population we’ve traditionally thought of as developers.”
Jacob Krell, Sr. Director: Secure AI Sollutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)
“ClickFix is a social engineering technique where a webpage convinces users to copy and paste a command into their own terminal. It bypasses endpoint defenses because the operating system treats it as a legitimate action from a trusted human. ClawHavoc grafted that technique onto an AI agent, upgrading the lure from a random website to a trusted assistant. Same attack, better packaging.
“OpenClaw lets AI agents read files, run terminal commands, and install third-party skills from its ClawHub marketplace. Researchers traced 1,184 malicious packages across that marketplace, tied to just 12 author accounts. The skills told the agent that users needed to install a fake prerequisite called AuthTool before a feature would work, and the agent relayed that as a normal setup step. Users who followed along got Atomic macOS Stealer, an infostealer targeting 60+ crypto wallets, browser data, SSH keys, and .env files.
“The agent is doing exactly what it was designed to do, reading documentation and relaying instructions to the user. Nobody built a layer between “read instructions” and “present them as trusted guidance.” That gap is the vulnerability, and it’s the same supply chain trust manipulation I’ve been tracking since the npm download pumping research earlier this year. Attackers game whatever trust signal AI tools rely on, whether that’s package popularity metrics or a skill marketplace listing with a plausible name.
“Organizations deploying AI agents need to treat every installed skill as third-party code execution, with approval gates before any agent-initiated system command. Run agents on isolated hosts with scoped credentials and restricted outbound network access. Monitor for node.exe spawning PowerShell or curl. The agent can suggest an action, but the OS and identity layers need to independently prevent that suggestion from becoming unreviewed execution.”
Kevin Surace, CEO, Token (https://www.linkedin.com/in/ksurace)
“AI agents create a new social engineering problem because the attacker is no longer impersonating someone the victim trusts. The attacker is manipulating the system the victim already trusts.
“The strongest control is dedicated, hardware bound fingerprint authorization at the agent gateway. When an agent wants to install software, connect a new tool, access credentials, send sensitive information, transfer money, change security settings, or execute an administrative command, the gateway must require a fingerprint from an authorized person on dedicated trusted hardware.
“The fingerprint must authorize the exact action. The trusted device should display what will be executed, where it came from, what permissions it requests, and which systems or data it will affect. The hardware should then cryptographically sign that specific transaction. Any change to the command, software, destination, permissions, or scope must require a new fingerprint authorization.
“This physical requirement is essential because a digital approval can be delegated, simulated, or automated. Without hardware bound biometrics, one compromised agent could ask another agent to approve the action, creating the appearance of human oversight when no human was ever in the loop. A software confirmation button, approval message, or agent generated authorization is not proof of human presence.
“The fingerprint sensor and approval display must therefore sit outside the control of every agent. No agent should be able to generate, relay, or satisfy the approval itself. The biometric template should remain within the dedicated hardware, and the gateway should accept only a signed authorization produced after a live fingerprint match.
“This does not make a malicious recommendation safe. It establishes a hard separation between an agent’s ability to propose an action and its authority to perform one. An AI agent may recommend, but consequential authority must come from the physical presence of a verified human.”
AI agents need guard rails. If you don’t have them, you are risking getting pwned. It’s that simple.
Related
This entry was posted on August 21, 2026 at 8:15 am and is filed under Commentary with tags Open Claw. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
When AI agents become the attack vector
An OpenClaw supply-chain attack exists in which attackers manipulated AI agents into recommending or facilitating malicious actions, including getting users to install malware. There’s Trellix research on the OpenClaw supply-chain attack along with Palo Alto Networks Unit 42 research on OpenClaw’s agent-skill supply chain that you can read at your leisure… Or maybe not so leisure given the gravity of the situation.
Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)
“AI agents are quickly becoming a new trust layer in the attack chain, and attackers know that trust is often easier to exploit than technology. When a manipulated agent recommends software, a workflow, or a next step, users can inherit the attacker’s influence without realizing it. Organizations should treat AI agents like any other high value system, with adversarial testing, strict guardrails, and continuous validation of what the agent can see, recommend, and act on.”
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“This particular story is wild because it mixes social engineering with supply chain attacks, which is fascinating in and of itself. But I think the bigger issue is the sheer number of people now using AI tools for development who have little to no background in IT, software development, or security.
“AI and open tools like OpenClaw have made it incredibly easy for people to build things quickly and get much closer to that original promise of technology doing complicated work on their behalf. On one hand, that’s fantastic. It lowers the barrier to entry and lets people create things they never could have built before.
“But there’s a security problem hiding underneath all of that. People are downloading packages, installing tools, granting permissions, and running code without necessarily understanding what those actions mean. And frankly, some of these basic security principles are being missed even by seasoned IT professionals. As AI makes development easier and more accessible, we have to make security awareness just as accessible, because the population of people building and running software has suddenly become much larger than the population we’ve traditionally thought of as developers.”
Jacob Krell, Sr. Director: Secure AI Sollutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)
“ClickFix is a social engineering technique where a webpage convinces users to copy and paste a command into their own terminal. It bypasses endpoint defenses because the operating system treats it as a legitimate action from a trusted human. ClawHavoc grafted that technique onto an AI agent, upgrading the lure from a random website to a trusted assistant. Same attack, better packaging.
“OpenClaw lets AI agents read files, run terminal commands, and install third-party skills from its ClawHub marketplace. Researchers traced 1,184 malicious packages across that marketplace, tied to just 12 author accounts. The skills told the agent that users needed to install a fake prerequisite called AuthTool before a feature would work, and the agent relayed that as a normal setup step. Users who followed along got Atomic macOS Stealer, an infostealer targeting 60+ crypto wallets, browser data, SSH keys, and .env files.
“The agent is doing exactly what it was designed to do, reading documentation and relaying instructions to the user. Nobody built a layer between “read instructions” and “present them as trusted guidance.” That gap is the vulnerability, and it’s the same supply chain trust manipulation I’ve been tracking since the npm download pumping research earlier this year. Attackers game whatever trust signal AI tools rely on, whether that’s package popularity metrics or a skill marketplace listing with a plausible name.
“Organizations deploying AI agents need to treat every installed skill as third-party code execution, with approval gates before any agent-initiated system command. Run agents on isolated hosts with scoped credentials and restricted outbound network access. Monitor for node.exe spawning PowerShell or curl. The agent can suggest an action, but the OS and identity layers need to independently prevent that suggestion from becoming unreviewed execution.”
Kevin Surace, CEO, Token (https://www.linkedin.com/in/ksurace)
“AI agents create a new social engineering problem because the attacker is no longer impersonating someone the victim trusts. The attacker is manipulating the system the victim already trusts.
“The strongest control is dedicated, hardware bound fingerprint authorization at the agent gateway. When an agent wants to install software, connect a new tool, access credentials, send sensitive information, transfer money, change security settings, or execute an administrative command, the gateway must require a fingerprint from an authorized person on dedicated trusted hardware.
“The fingerprint must authorize the exact action. The trusted device should display what will be executed, where it came from, what permissions it requests, and which systems or data it will affect. The hardware should then cryptographically sign that specific transaction. Any change to the command, software, destination, permissions, or scope must require a new fingerprint authorization.
“This physical requirement is essential because a digital approval can be delegated, simulated, or automated. Without hardware bound biometrics, one compromised agent could ask another agent to approve the action, creating the appearance of human oversight when no human was ever in the loop. A software confirmation button, approval message, or agent generated authorization is not proof of human presence.
“The fingerprint sensor and approval display must therefore sit outside the control of every agent. No agent should be able to generate, relay, or satisfy the approval itself. The biometric template should remain within the dedicated hardware, and the gateway should accept only a signed authorization produced after a live fingerprint match.
“This does not make a malicious recommendation safe. It establishes a hard separation between an agent’s ability to propose an action and its authority to perform one. An AI agent may recommend, but consequential authority must come from the physical presence of a verified human.”
AI agents need guard rails. If you don’t have them, you are risking getting pwned. It’s that simple.
Share this:
Like this:
Related
This entry was posted on August 21, 2026 at 8:15 am and is filed under Commentary with tags Open Claw. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.