OpenClaw Frenzy Exposes 30,000 Autonomous Agents and a Wave of Malicious Skills

In late January 2026 an open-source personal agent called OpenClaw, previously known as Clawdbot and then Moltbot, became the fastest-growing project on GitHub, collecting roughly 85,000 stars in about a week. The appeal was obvious: an always-on assistant with persistent memory that reads email, manages calendars, browses the web, runs shell commands and answers via WhatsApp or Telegram. The security consequences arrived just as quickly. On 9 February, researchers at Bitsight reported observing more than 30,000 distinct OpenClaw instances reachable from the public internet between 27 January and 8 February, spread across cloud regions worldwide and present not only in technology firms but in healthcare, finance, insurance and government networks.

The exposure compounded a run of incidents. On 30 January a WebSocket origin-validation flaw, tracked as CVE-2026-25253 with a CVSS score of 8.8, was disclosed; it allowed an attacker to steal an authentication token via a crafted link and then execute arbitrary commands on the host. Between 27 and 29 January, an audit of the project's community "skills" registry found 341 malicious packages among 2,857 examined, many pushing macOS infostealer malware through fake prerequisite instructions. On 31 January, Moltbook, a social network for the agents, was found to have exposed around 1.5 million API tokens and 35,000 email addresses because database access controls were disabled and a key was embedded in client-side code. The project's rapid renaming, forced by a trademark request, added typosquatted domains and impersonated repositories to the mix. Even the creator warned that most non-technical users should not install it.

Security vendors converged on the same diagnosis. Palo Alto Networks described the tool as lacking any trust boundary between untrusted inputs and privileged actions, with no human approval for destructive operations, and noted that persistent memory adds a delayed-execution vector to the familiar prompt-injection risks. Bitsight highlighted default configurations that accepted single-character passwords.

The episode is the first mass-market demonstration of what security teams have warned about since agents gained tool access: the combination of private data, exposure to untrusted content and the ability to act is dangerous by construction, and consumer enthusiasm will outrun hardening every time. The presence of instances inside regulated organisations shows that shadow AI has moved from pasting text into chatbots to running autonomous agents with corporate credentials.

What it means for leaders

• Hunt for agent frameworks on your network now. Scan for OpenClaw and similar tools on endpoints and cloud accounts; treat any instance with corporate credentials as a security incident.
• Extend shadow-IT policy to autonomous agents. Acceptable-use rules should explicitly address self-hosted agents, skill marketplaces and messaging integrations, not only SaaS chatbots.
• Require trust boundaries in any agent you approve. Separate untrusted content from privileged tools, enforce human approval for irreversible actions and sandbox third-party extensions; the OWASP Top 10 for Agentic Applications is a usable checklist.
• Treat agent memory as a data store. Persistent memory needs the same classification, retention and poisoning controls as any database, consistent with ISO/IEC 42001 data-management requirements.
• Include agent supply chains in vendor risk. Community skill registries are unaudited software repositories; apply the same SBOM and provenance standards used for other dependencies.