Infostealer malware steals OpenClaw AI assistant data
Infostealer malware compromised OpenClaw AI assistants by stealing configuration files containing authentication tokens, cryptographic keys, and contextual memory logs. Over 300 malicious plugins were discovered on ClawHub, and the incident reflects malware developers' shift toward targeting AI agent data as AI systems become more embedded in personal workflows.
What happened
Cybersecurity researchers reported that infostealer malware stole a victim's OpenClaw AI assistant configuration and identity files, including tokens, cryptographic keys, and contextual memory logs.
Over 300 malicious 'skills' (plugins) were discovered on the official ClawHub registry, many designed to install 'Atomic Stealer' (AMOS) malware directly onto users' systems.
The malware was not initially custom-built for OpenClaw but captured the AI's data because it operated broadly across file systems, though researchers warn attackers are likely to develop specialised modules to target AI-powered configurations directly.
Reported impact
For OpenClaw users, the incident demonstrates that local AI is not inherently 'private' if underlying data is unencrypted. For organisations letting OpenClaw interface with corporate systems, compromising an AI agent can expose internal data, credentials, and workflows in one shot.
The incident signals a shift in the malware ecosystem: infostealer developers are expected to add dedicated modules to parse AI-assistant files, accelerating the weaponisation of compromised AI agents. The Autoriteit Persoonsgegevens warned that autonomous AI-agents such as OpenClaw are viewed in the cybersecurity world as a 'Trojan Horse', as they can be attractive targets for misuse.
Index analysis
OpenClaw stores sensitive tokens and keys in local configuration files in plaintext or weakly protected formats, creating potentially high-value targets for malware designed to harvest secrets from automated systems.
OpenClaw's ecosystem includes third-party extensions and community-submitted 'skills' with limited vetting. The platform is vulnerable to hidden commands in websites, emails and chat messages that can lead to account takeovers and theft of access codes.
Governance controls
Rapid development and lax review processes in OpenClaw's ecosystem have contributed to insufficient threat modeling and security auditing, allowing harmful modules and malware to proliferate.
The Autoriteit Persoonsgegevens called on users and organisations not to use OpenClaw and similar AI-agents on systems with privacy-sensitive or confidential data, such as access codes, accounting records, customer files, personnel data, or identity information.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.