A tech executive posts a demo on LinkedIn. His "AI agent" reads his email, parses his calendar, and spins up tasks in Asana. Fifty thousand impressions. "The future of productivity."

I have built this kind of automation for clients. Every single thing in that demo has been possible with n8n, Make, or Zapier wired to an LLM API since 2023. A cron job, an API call, an LLM wrapper. Calling it a breakthrough agent is like calling a dishwasher a breakthrough culinary assistant.

The repackaging is not the problem. The problem is who is buying it. These tools are aimed at executives who sit on the most sensitive data in the company, cannot assess an attack surface, and feel enormous pressure to look innovative. And the thing they are being sold runs commands on their machine.

My take: the demo is harmless. The buyer is not. We have built a one-click way for the least security-literate people in an organization to hand a piece of software the keys to everything, and we are calling it productivity.

The agent that went viral

In November 2025, Austrian developer Peter Steinberger published an open-source AI agent. It started life as Clawdbot, a riff on Anthropic's Claude, then changed names twice under trademark pressure: Moltbot, then OpenClaw. By late January it had crossed 100,000 GitHub stars in under a week, with tens of thousands of forks and coverage in Scientific American, Forbes, CNBC, and WIRED. It now sits north of 220,000 stars. On February 15, Steinberger joined OpenAI to work on personal agents, and OpenClaw moved to a foundation. The installs and their security problems stayed exactly where they were.

The pitch is simple. OpenClaw runs locally, connects to your messaging apps, and behaves like a digital employee. Text it "summarize that PDF and email the highlights to my boss" and it downloads what it needs, installs it, transcribes, drafts, and sends.

One of its own maintainers said the quiet part out loud on Discord: if you cannot run a command line, this project is too dangerous for you to use safely. That warning did not travel nearly as far as the demos did.

The architecture problem

Broad access is not a bug in an AI agent. It is the entire point. Email, calendar, Slack, the file system, the shell. The agent earns its keep by reaching into everything, which means a single agent makes hundreds of API calls a day. That is perfect cover. In your logs, an exfiltration looks exactly like the agent doing its job.

OpenClaw can run shell commands, read and write files, and execute scripts. Token Security summed it up as "Claude with hands." By default its gateway binds to 0.0.0.0:18789, which exposes the full API to every network interface on the box.

The exposure is not theoretical

The open instances piled up fast. Censys counted 21,639 exposed by the end of January. Bitsight tracked more than 30,000 by February 8. By February 12, the STRIKE team at SecurityScorecard found over 135,000 internet-facing instances across 76 countries, and classified 63% of them as exploitable. That is a hundred thousand front doors left open, not by attackers, but by the people who installed the thing.

The supply chain is already poisoned

OpenClaw extends itself through "skills" hosted on a registry called ClawHub. The bar to publish one is a Markdown file and a week-old GitHub account. No code signing. No review. No sandbox by default.

Within weeks the registry was full of malware. Koi Security audited all 2,857 skills and found 341 malicious ones in a campaign they named ClawHavoc, most of them infostealers dropping Atomic macOS Stealer, keyloggers, and backdoors, dressed up as crypto tools and YouTube helpers. Later scans put the count above 800, roughly a fifth of the registry. Snyk looked at 3,984 skills and found a security flaw in 36% of them, from hardcoded keys to prompt injection, plus 76 confirmed malicious payloads. Cisco found nine vulnerabilities in the single highest-ranked community skill, including silent data exfiltration, and called the whole thing a nightmare from a security standpoint.

The vulnerabilities

The headline bug is CVE-2026-25253, a CVSS 8.8 one-click remote code execution. You visit a malicious page, the page lifts your OpenClaw auth token, and the attacker runs commands on your machine.

The quieter ones scare me more. Giskard showed that a single malicious email can make the assistant leak credentials, internal files, and conversation history. Not an email you click. An email your agent reads on your behalf. A WhatsApp message carrying a prompt-injection payload can walk off with your .env and creds.json. The user never does anything wrong. The agent does it for them.

Nobody asked IT

Token Security found that 22% of enterprise employees in their customer base had already installed OpenClaw without approval. Noma watched 53% of enterprises in their base grant it privileged access over a single weekend. Gartner's verdict was blunt: an unacceptable cybersecurity liability, and enterprises should block downloads and traffic immediately.

LLM-powered malware is already in the wild

This is the part that moves it from "messy ecosystem" to "live threat." In July 2025, CERT-UA documented LAMEHUG, a Python malware deployed by APT28, the GRU's Unit 26165, against Ukrainian government targets. It was the first publicly documented malware that asks a large language model to generate its attack commands at runtime. Instead of hardcoded shell commands that signature detection can catch, it sends a prompt ("act as a Windows admin, gather details about the machine, network, and Active Directory") and runs whatever the model returns.

By November 2025, Google's threat intelligence group had catalogued five AI-enabled families: PromptSteal (their name for LAMEHUG), PromptFlux (a dropper that rewrites its own code hourly through the Gemini API), QuietVault (a credential stealer that uses AI to find secrets), FruitShell (a reverse shell built to dodge AI-powered defenses), and PromptLock (a ransomware proof of concept). Google's read was that attackers have moved past using AI for coding help and toward genuinely adaptive malware.

The unit that built LAMEHUG is the same one that has been targeting Western logistics since 2022. They are not a hypothetical. And they just inherited a new attack surface: hundreds of thousands of agents with root access, plugged into a registry where a third of the add-ons carry a flaw.

The attack that writes itself

Patient intrusion is not new. Cozy Bear, Lazarus, APT28 already sit inside systems for months and bleed data out in small pieces. Now picture a poisoned skill that passes a casual glance. It rides the agent's legitimate connections, reads email and DMs and meeting transcripts for weeks, builds a profile, and exfiltrates a few kilobytes once a quarter, buried in thousands of normal calls.

Most companies keep logs for 30 to 90 days. The evidence is gone between exfiltrations. The traffic is indistinguishable from the agent behaving normally. Every component of this already exists in the wild: LLM-generated commands from LAMEHUG, supply-chain poisoning from ClawHavoc, silent exfiltration from the Giskard work. The only open question is when someone bolts them together.

The human problem, again

Look at the public record of nation-state attacks over the last few years and the same pattern repeats. Kyivstar: a likely compromised employee account. Viasat: a VPN misconfiguration nobody caught. GRU exploits from 2018 that still land because someone never patched. Attackers rarely need a zero-day when a person hands them the door.

That is the lesson I keep coming back to. The gap between "we have a policy" and "the policy is enforced" is the gap between the telecom that got wiped and the railway that kept running. In the environments I am responsible for, this is not optional: quarterly training that is mandatory, device management on anything that touches company data, 2FA with no exceptions, access reviews when roles change. None of it is exotic. All of it is enforced. The same will be true for AI agents, and most organizations are not there yet.

What to do instead

The productivity gains from AI automation are real. You do not have to build a backdoor to get them.

Run tools you control. n8n plus an LLM API gives you the same automation with a fraction of the attack surface, and you can audit every call instead of trusting community skills from strangers. Scope your OAuth tokens to the minimum: one calendar, not the whole Google account; one Slack channel, not every DM. If a tool cannot do granular scoping, treat that as a red flag. Put agent infrastructure in its own network segment with monitored egress, and keep logs far longer than 90 days, because short retention is a gift to a patient attacker. And at the enterprise level, take Gartner's advice and block OpenClaw outright. For a tool with documented RCE and a compromised skill registry, that is just hygiene.

The bottom line

The agent hype is running the usual script: exciting capability, viral adoption, security treated as an afterthought, breach, regulation. We are somewhere between steps three and four.

OpenClaw will probably be old news in a few months. The pattern it represents will not be. Autonomous agents with broad system access and almost no security review are the direction the whole industry is moving, and the core tension does not resolve: an agent that can do more needs access to more. The capability and the attack surface are the same thing.

And the simplest way in has not changed in thirty years. It is a person.

References

  1. SecurityScorecard STRIKE team; Censys; Bitsight: OpenClaw internet exposure data, January to February 2026.
  2. Koi Security, "ClawHavoc" skill registry audit; Snyk skill security audit; Cisco vulnerability findings.
  3. Token Security ("Claude with hands"); Noma; Gartner enterprise guidance on OpenClaw.
  4. CVE-2026-25253 (CVSS 8.8) one-click RCE; Giskard prompt-injection exfiltration research.