Research demo
Realized harm
Poisoned ClawdBot Skill on ClawdHub executes attacker shell command on 16 users' machines
AIR-2026-0018 AIR record · 2026-01-clawdhub-poisoned-skill
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The security researcher recorded 16 different users who downloaded and executed the poisoned Skill in the first 8 hours of it being published on ClawdHub.raw.githubusercontent.com
The record
Disclosed
2026-01-26
Vendor
OpenClaw project
Product
ClawdBot / ClawdHub skill registry
Risk domain
Access control and permissions › Privilege escalation
Also touches
Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted — the agent ingested the poisoned skill and executed the shell command
Attack surface
Skill / plugin
Autonomy level
Fully autonomous
Initial vector
Malicious skill in registry
Impact type
Code execution, Supply chain compromise
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
16 users executed the poisoned Skill within 8 hours of publication
Capability abused
Defense & remediation
Recorded defense
none (unvetted registry)
Guardrail kinds
None
Guardrail outcome
Not applicable
Taxonomy & references
Curator notes
Jamieson O'Reilly. Benign payload (a warning), but real third-party machines executed attacker-controlled code, so impact_realized is true in the narrow sense of unauthorized execution on non-consenting hosts. Source is an X thread, which is not citable as a stable source; quote from MITRE ATLAS's published data file.
Supporting sources
Cite as
Enkrypt AI. "Poisoned ClawdBot Skill on ClawdHub executes attacker shell command on 16 users' machines". AIR, AIR-2026-0018. https://agentincident.vercel.app/i/AIR-2026-0018/ (accessed 2026-10-19).