OpenClaw AI Agent Platform Hit by Critical Vulnerability and Supply Chain Campaign (2026)

Incident Summary

OpenClaw, one of the most widely adopted open-source AI agent frameworks, was struck by a critical remote code execution vulnerability (CVE-2026-25253, CVSS 8.8) in January 2026 that enabled token exfiltration through manipulated gateway parameters combined with missing WebSocket origin validation.^[1] Censys scans identified over 21,000 publicly exposed OpenClaw instances across 52 countries, with 98.6% deployed on cloud infrastructure including DigitalOcean, Alibaba Cloud, and Tencent.^[1] Concurrently, Koi Security researcher Oren Yomtov uncovered the ClawHavoc campaign — a coordinated supply chain attack that planted over 800 malicious skills in the ClawHub marketplace, representing approximately 20% of the registry.^[1] The malicious skills deployed Atomic macOS Stealer (AMOS) targeting keychains, cryptocurrency wallets, and SSH keys on macOS systems, and VMProtect-packed infostealers with keylogger and remote access capabilities on Windows.^[3] OpenClaw released a patched version (2026.1.29) on January 30, 2026.^[1]

Key Facts

• Vulnerability: CVE-2026-25253 scored CVSS 8.8, enabling remote code execution via token exfiltration through manipulated gatewayUrl parameters and missing WebSocket origin validation^[1]
• Discovery: Mav Levin of depthfirst research identified the vulnerability; Koi Security’s Oren Yomtov discovered the ClawHavoc supply chain campaign^[1]
• Exposure: Multiple concurrent scans using different methodologies produced varying counts — Censys identified approximately 21,000 publicly exposed instances, Bitsight found over 30,000, and a broader independent scan catalogued 42,665 exposed instances of which 5,194 were confirmed vulnerable to CVE-2026-25253^[1]
• Supply chain scale: The ClawHub registry contained approximately 2,800 skills at the time of discovery; the ClawHavoc campaign initially planted 341 malicious skills (12%), with subsequent scans identifying over 800 malicious entries (~29% of the registry)^[1]
• Malware deployed: macOS systems received Atomic macOS Stealer (AMOS) targeting keychains, cryptocurrency wallets, SSH keys, and Telegram sessions; Windows systems received VMProtect-packed infostealers with keylogger and RAT capabilities^[1][3]
• Attack technique: ClawHavoc used ClickFix-style social engineering — fake “fix” prompts that nudge administrators into installing malicious skills as a remediation step — combined with typosquatting tactics using variations such as “clawhub,” “clawhub1,” and “clawhubb”^[1]
• Geographic spread: Affected instances spanned 52 countries, with the United States and China representing the largest concentrations^[1]
• Patch: OpenClaw released version 2026.1.29 on January 30, 2026, addressing the WebSocket vulnerability^[1]

Threat Patterns Involved

Primary: AI Supply Chain Attack — The ClawHavoc campaign represents a textbook AI supply chain attack, where malicious actors compromised the ClawHub skill marketplace — the primary distribution channel for OpenClaw extensions — to deliver credential-stealing malware to downstream users. The campaign exploited the trust relationship between the marketplace and its users, planting over 800 malicious skills that appeared legitimate through typosquatting and social engineering techniques.

Secondary: Tool Misuse & Privilege Escalation — CVE-2026-25253 enabled attackers to exploit OpenClaw’s WebSocket communication layer to exfiltrate authentication tokens, effectively escalating from unauthenticated network access to full system compromise on exposed instances.

Significance

1. AI agent frameworks as high-value supply chain targets — OpenClaw’s position as one of the most popular AI agent frameworks made its marketplace an efficient vector for distributing malware at scale, with a single campaign compromising approximately 20% of the ClawHub registry
2. Shadow AI amplifies organizational risk — Bitdefender telemetry documented cases of employees deploying OpenClaw agents with broad system privileges — including filesystem access, CI/CD pipeline tokens, and cloud provider API keys — without security team awareness, creating unmonitored attack surfaces within enterprise environments^[1]
3. Marketplace trust exploitation — The ClawHavoc campaign demonstrates that AI agent marketplaces and skill registries face the same supply chain risks as traditional package managers (npm, PyPI), but with the added risk that AI agents typically operate with elevated system permissions
4. Global exposure footprint — The distribution of over 21,000 exposed instances across 52 countries indicates that insecure default configurations in AI agent frameworks create systemic risk at the infrastructure level