Incident·WS-0074·Jan 2026·disclosed Feb 1, 2026 (5 days later)·in the wild·AI security flaws

341 malicious add-on skills push infostealer to AI agent users

OpenClaw / ClawHub skill registry; unknown threat actors

38/100
WS-2 Moderate
Harm score 50, signal score 24. Autonomy: tool (a person misused it). How the scores work.
Harm 2/5
damage actually done
Reach 3/5
who was affected
Autonomy 0/4
how much the AI did on its own
Novelty 3/5
how new the behavior was
Permanence 3/5
how hard it is to undo

Koi Security audited 2,857 skills on ClawHub, the registry of add-on skills for the OpenClaw agent. It found 341 malicious skills across several campaigns, collectively named ClawHavoc. Most used fake 'prerequisite' install steps to deliver the Atomic Stealer (AMOS) infostealer and steal credentials from users' machines.

Damage

341 of 2,857 skills malicious (335 delivering AMOS); number of infected users unquantified

Sources

The Hacker News, second source. The primary Koi Security report URL was not retrieved. Cisco separately reported (~28 Jan) that a third-party skill silently exfiltrated data via prompt injection.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.