Loading story…
Autonomous AI “agents” that can execute shell commands, fetch URLs, and write files on developer endpoints are rapidly expanding the attack surface by blurring the line between data and code and by effectively acting as a high-privilege “insider” on a user’s machine. Reporting highlighted OpenClaw (formerly ClawdBot/Moltbot) as a fast-adopted open-source agent designed to run locally and proactively take actions on a user’s behalf, often requiring broad access to files, online services, and communications tools—conditions that increase the impact of prompt-injection, malicious instructions, and unsafe automation.
In response to these risks, the open-source project Sage introduced an “Agent Detection & Response (ADR)” interception layer that hooks into supported agent platforms (including Claude Code, Cursor/VS Code, and OpenClaw) to inspect and gate tool calls such as Bash commands, URL retrieval, and file writes before execution. Sage combines cloud reputation checks (malware/phishing/scam detection), local heuristics using YAML-based threat definitions, and supply-chain checks for npm/PyPI packages (e.g., registry existence, reputation, and age analysis), plus plugin scanning at session start; it also emphasizes a privacy model that keeps commands and file contents local while optionally sharing URL/package hashes with Gen Digital reputation services. Related research cited alongside the release reported 18,000+ internet-exposed OpenClaw instances and that ~15% of observed skills contained malicious instructions, underscoring the need for endpoint-style controls tailored to agent-driven actions.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Gen Digital and Gen Threat Labs released the open-source Sage project, which inserts a security layer between AI agents and the operating system to inspect and gate commands, URL fetches, file writes, and package or plugin activity.
AWS reported that a Russian-speaking threat actor used multiple commercial generative AI services to help compromise more than 600 FortiGate devices across over 55 countries.
Security research cited by Krebs and Help Net Security reported that internet-exposed OpenClaw web admin interfaces could leak full configuration files and credentials, and that a notable share of ClawHub/OpenClaw skills contained malicious instructions.
A supply-chain attack on the Cline AI coding assistant used a prompt injection delivered through a GitHub issue title to trigger installation of a rogue OpenClaw instance with full system access on thousands of machines.
The open-source autonomous AI assistant OpenClaw, previously known as ClawdBot/Moltbot, was released in November 2025 for local use with broad access to systems and online services.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and vendors warned that **self-hosted, agentic AI assistants**—notably **Clawdbot** (rebranded as **Moltbot** and also referred to as **OpenClaw**)—expand enterprise attack surface by combining broad data access with the ability to take direct actions (browser control, messaging, email, and command execution). Resecurity reported finding **hundreds of exposed deployments** reachable from the public Internet, frequently with **weak authentication, unsafe defaults, or misconfigurations** that could allow attackers to access **API keys/OAuth tokens**, retrieve **private chat histories**, and in some cases achieve **remote command execution** on the host. Dark Reading similarly highlighted that OpenClaw’s ecosystem can be undermined by **malicious “skills”** and fragile configuration/removal practices, reinforcing that these tools can be difficult to operate safely even when users attempt to limit permissions. CyberArk framed the issue as an **identity security** problem: autonomous agents often run with **user-level permissions** and integrate with platforms like *Slack*, *WhatsApp*, and *GitHub*, creating pathways for **credential/token theft, data leakage, and unauthorized actions** if the agent is exposed to untrusted content or deployed without strong controls. In contrast, Dark Reading’s coverage of **Shai-hulud** focuses on a separate threat—**self-propagating supply-chain worms targeting NPM projects**—and is not directly about autonomous AI agents, though it underscores the broader risk of downstream compromise when widely used components or ecosystems are poisoned.
Jun 29, 2026
New research and reporting highlighted that **autonomous/agentic AI** can create novel security failure modes—especially when agents interact with other agents or accept instructions from untrusted content. A multi-institution academic study (“Agents of Chaos”) described emergent risks in **multi-agent deployments**, including **server destruction**, **denial-of-service conditions**, and runaway resource consumption as small errors compound into catastrophic failures. Separate coverage warned that consumer-style agents such as **OpenClaw** can be manipulated by **malicious websites**, reinforcing that agentic systems expand the attack surface beyond traditional prompt injection into cross-agent and web-mediated command channels. In response to “rogue agent” and prompt-injection concerns, an open-source control layer called **IronCurtain** was presented as a safeguard that interposes a **trusted policy-enforcement process** between an LLM agent and external tools, using a “constitution” (human-readable intent) compiled into enforceable rules and requiring tool calls to be **allowed, denied, or escalated** for human approval. Other items in the set were largely **opinion, podcasts, or broad AI/security commentary** (e.g., AI for incident response efficiency, governance/metrics, ethics, dark web monitoring, and industry outlooks) and did not materially add technical detail to the specific story of agentic AI exploitation and multi-agent failure modes.
Jun 29, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026