Security risks for OpenClaw users and how to mitigate these risks | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil Solutions Internet of Things & Embedded Security Learn More Industrial Cybersecurity Learn More Fraud Prevention Learn More KasperskyOS-based solutions Learn More Other solutions Kaspersky for Security Operations Center Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Industries National Cybersecurity Learn More Industrial Cybersecurity Learn More Finance Services Cybersecurity Learn More Healthcare Cybersecurity Learn More Transportation Cybersecurity Learn More Retail Cybersecurity Learn More Other Industries Telecom Cybersecurity View all Products Kaspersky Next NEW! Learn More Kaspersky XDR Learn More Kaspersky Endpoint Security for Business Learn More Kaspersky EDR Expert Learn More Kaspersky EDR Optimum Learn More Kaspersky Anti Targeted Attack Platform Learn More Kaspersky Hybrid Cloud Security Learn More Kaspersky SD-WAN Learn More Kaspersky Industrial CyberSecurity Learn More Kaspersky Container Security Learn More Other Products Kaspersky Security for Internet Gateway Kaspersky Embedded Systems Security Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Kaspersky Security for Mail Server View All Services Kaspersky Cybersecurity Services Learn More Kaspersky Security Awareness Learn More Kaspersky Premium Support Learn More Kaspersky Threat Intelligence Learn More Kaspersky Managed Detection and Response Learn More Kaspersky Compromise Assessment Learn More Kaspersky SOC Consulting Learn More Other Services Kaspersky Professional Services Kaspersky Incident Response Kaspersky Cybersecurity Training View All Resource Center Case Studies White Papers Datasheets Technologies MITRE ATT&CK About Us Transparency Corporate News Press Center Careers Sponsorship Policy Blog Contacts GDPR Subscribe --> Dark mode off Login --> Securelist menu English Russian Spanish Brazil Existing Customers Personal My Kaspersky Renew your product Update your product Customer support Business KSOS portal Kaspersky Business Hub Technical Support Knowledge Base Renew License Home Products Trials&Update Resource Center Business Kaspersky Next Small Business (1-50 employees) Medium Business (51-999 employees) Enterprise (1000+ employees) Securelist Threats Financial threats Mobile threats Web threats Secure environment (IoT) Vulnerabilities and exploits Spam and Phishing Industrial threats Categories APT reports Incidents Research Malware reports Spam and phishing reports Publications Kaspersky Security Bulletin Archive All Tags APT Logbook Webinars Statistics Encyclopedia Threats descriptions KSB 2021 About Us Company Transparency Corporate News Press Center Careers Sponsorships Policy Blog Contacts Partners Find a Partner Partner Program Content menu Close Subscribe Threat Response by Kaspersky Dark mode off Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT Publications OpenClaw: risks for the users and how to mitigate them Publications 01 Jul 2026 minute read Kaspersky Table of Contents OpenClaw skills OpenClaw vulnerabilities Malicious skills Authors Kaspersky OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The project quickly became popular with users because of its flexibility and ability to solve fairly complex tasks that previously required a lot of time for automation and execution. A dedicated marketplace appeared quickly after the project started gaining traction, where developers and users began publishing tools that integrate with OpenClaw. Currently, employees all over the world use OpenClaw to automate their tasks, often unaware of risks this practice introduces to them and their employers. In this article we will examine several security aspects of OpenClaw, look at how attackers can target this system, which vulnerabilities are already known, and how to protect your organization against these issues. OpenClaw skills The project’s success was ensured by the fact that the agent accepts natural language instructions, does not require knowledge of programming languages, and allows the use of skills, which expand its capabilities. The overall architecture of OpenClaw can be seen below: The OpenClaw overall architecture As shown in the diagram, the system is designed to be used with agent skills. These skills can reside locally on the system where the agent is installed or they can be obtained from external sources. At the time of writing this article, a dedicated hub named “ClawHub” is used for sharing skills with other users. One of the key features of OpenClaw skills is that they are easy to create and do not require coding. A skill is in essence a set of commands written in natural language, although it can contain code. Currently, there is a general description of the skill format: it is usually a text file named SKILL.md , although more complex variants may exist. The primary requirement for these files is that they use a plaintext format. To illustrate what this looks like, here is a fragment of a skill: Openclaw skill example The applications for OpenClaw skills are quite broad and can include everyday tasks like checking email, performing routine operations and calculations on a computer, as well as more complex pipelines that handle testing, research, or software development. For most actions, the agent requires access to the operating system’s file system, as well as to the tokens and keys of the systems it will interact with. All necessary data are usually provided by users either through environment variables or in plaintext files located alongside the agent. Since many skills enable automation of work processes, employees worldwide actively use them. This fact, combined with the widespread adoption of the system and the overall popularity of artificial‑intelligence technologies, has attracted attackers to the project. OpenClaw vulnerabilities In less than two years, around 530 vulnerabilities have been discovered both in OpenClaw itself and in the underlying technologies. That said, the publication of OpenClaw vulnerabilities in the CVE database began only in February 2026. Below is a breakdown of these vulnerabilities by severity. Registered vulnerabilities ( download ) As shown in the chart, the number of high-severity vulnerabilities is quite large. Most of these vulnerabilities fundamentally involve issues with storing sensitive data and operating with excessively high privileges. Each of them can be exploited to hijack the agent or inject commands that it will execute. Malicious skills Besides exploiting vulnerabilities and deceiving users, there are more specific attack vectors against OpenClaw, namely, skills. Research logically draws a parallel between supply‑chain attacks and the distribution of malicious skills. However, unlike usual supply-chain attacks, creating malicious skills is trivial because there is no longer a need to develop custom malware. Despite this, until February 7, 2026, no skills had undergone even a basic security check, which allowed malicious skills to appear immediately. Our scan of the skill hub in April identified 24 accounts that were distributing more than 600 malicious skills. Overall, open‑source intelligence indicates that over 1100 malicious accounts have been created since January. Following the investigations and a lengthy effort to clean the skill repository of malicious entries, it was announced that files would undergo preliminary scanning with VirusTotal (VT) and NVIDIA’s SkillSpector . On the one hand, this is a more responsible approach to publishing skills; on the other, because OpenClaw is primarily an agent that executes a set of instructions, detecting malicious activity moves to a different level. Now it is necessary not only to analyze a file for dangerous commands that should be blocked, but also to examine all possible malicious behaviors that could be triggered by a harmful instruction within a skill. An example of a malicious command in natural language: Example of a malicious command within a skill action An example of a malicious command using a part of a bash command: Malicious command inside a skill The example in the image and similar malicious skills are detected by Kaspersky products as HEUR:Trojan.ANSI.MalClaw.gen. In addition, Kaspersky products monitor malicious OpenClaw skill activity on the system. Below are detection statistics from our systems that have identified malicious OpenClaw client behavior. The data for June cover the first half of the month. Statistics on Kaspersky product detections of OpenClaw malware ( download ) As shown in the chart, even despite the measures taken to counter the publication of malicious skills, attacks continue. Therefore, it is important to employ layered protection that isolates the OpenClaw agent from critical data and infrastructure systems. We also recommend checking all skills that enter the organization’s perimeter. For this purpose, Kaspersky Scan Engine is suitable. This solution is designed to protect web applications, proxy servers, network attached storage, and mail gateways. It can be integrated into almost any application, and it is easy to deploy and manage. Malicious skill detected by Scan Engine Additionally, monitor network accesses used by the agent. For this purpose, the project already provides a sandboxing subsystem and various wrappers for working with APIs and services. Last but not least, develop a comprehensive AI policy and make sure your employees never use third-party tools that they are not explicitly allowed to use. Vulnerability Statistics Vulnerabilities Supply-chain attack Artificial intelligence OpenClaw OpenClaw Skills OpenClaw: risks for the users and how to mitigate them Your email address will not be published. Required fields are marked * Name * Email * Captcha validation failed. Please confirm you are not a robot and try again. Cancel Δ This site uses Akismet to reduce spam. Learn how your comment data is processed. Table of Contents OpenClaw skills OpenClaw vulnerabilities Malicious skills GReAT webinars 13 May 2021, 1:00pm GReAT Ideas. Balalaika Edition Boris Larin Denis Legezo 26 Feb 2021, 12:00pm GReAT Ideas. Green Tea Edition John Hultquist Brian Bartholomew Suguru Ishimaru Vitaly Kamluk Seongsu Park Yusuke Niwa Motohiko Sato 17 Jun 2020, 1:00pm GReAT Ideas. Powered by SAS: malware attribution and next-gen IoT honeypots Marco Preuss Denis Legezo Costin Raiu Kurt Baumgartner Dan Demeter Yaroslav Shmelev 26 Aug 2020, 2:00pm GReAT Ideas. Powered by SAS: threat actors advance on new fronts Ivan Kwiatkowski Maher Yamout Noushin Shabab Pierre Delcher Félix Aime Giampaolo Dedola Santiago Pontiroli 22 Jul 2020, 2:00pm GReAT Ideas. Powered by SAS: threat hunting and new techniques Dmitry Bestuzhev Costin Raiu Pierre Delcher Brian Bartholomew Boris Larin Ariel Jungheit Fabio Assolini From the same authors Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload Stan Ghouls targeting Russia and Uzbekistan with NetSupport RAT Cloud Atlas activity in the first half of 2025: what changed It didn’t take long: CVE-2025-55182 is now under active exploitation Shai Hulud 2.0, now with a wiper flavor In the same category State of ransomware in 2026 Financial cyberthreats in 2025 and the outlook for 2026 To buy or not to buy: How cybercriminals capitalize on Black Friday SEO spam and hidden links: how to protect your website and your reputation Modern vehicle cybersecurity trends Latest Posts Publications OpenClaw: risks for the users and how to mitigate them Kaspersky APT reports ToddyCat: your hidden email assistant. Part 2 Andrey Gunkin GReAT research The Gentlemen are knocking: сustom backdoors and evolving tactics Fatih Şensoy Maher Yamout Beware of the license manager: how a Schneider Electric software vulnerability puts industrial facilities at risk Valery Akulenko Latest Webinars Technologies and services 02 Jun 2026, 5:00pm 60 min AI meets cybersecurity: Powering the next digital move Vladislav Tushkanov Oleg Gorobets Anton Rusakov-Rudenko Technologies and services 21 May 2026, 11:00am 60 min Automate your SOC with Kaspersky XDR 2.0 Dmitry Berezin Brandon Muller Trainings and workshops 05 May 2026, 5:00pm 47 min How do we catch 0-days? Boris Larin Trainings and workshops 30 Apr 2026, 2:00pm 61 min SOC evolution: From firefighting to strategic risk management Roman Nazarov Alexander Mazikin Alexander Marmalidi Reports ToddyCat: your hidden email assistant. Part 2 An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services. Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud. Kimsuky targets organizations with PebbleDash-based tools Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster. OceanLotus suspected of using PyPI to deliver ZiChatBot malware Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Subscribe to our weekly e-mails The hottest research right in your inbox Email (Required) Captcha (Required) I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. Subscribe Δ Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT © 2026 AO Kaspersky Lab. All Rights Reserved. Registered trademarks and service marks are the property of their respective owners. Privacy Policy Terms of use License Agreement Cookies

📌 来源: Kaspersky Securelist | 📅 2026-07-01