In the wild
Realized harm
Commodity infostealer observed harvesting OpenClaw agent config, device keys and memory files from a real victim
AIR-2026-0043 AIR record · 2026-02-hudsonrock-openclaw-infostealer
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
connect to the victim's local OpenClaw instance remotely if the port is exposed, or to impersonate the client in authenticated requests to the AI gatewayinfostealers.com
The record
Disclosed
2026-02-16
Vendor
OpenClaw
Product
OpenClaw personal AI agent
Risk domain
Access control and permissions › Credential theft
Also touches
Sensitive data exposure
System type
Generative model
Who acted
AI was the target — a commodity infostealer swept up the agent's identity and memory files
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Commodity infostealer infection
Impact type
Credential theft, Agent impersonation, Personal data exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
At least one confirmed infected machine; openclaw.json gateway token, device.json keypair, soul.md, AGENTS.md and MEMORY.md exfiltrated
Capability abused
Defense & remediation
Recorded defense
endpoint AV
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Important as the first documented real-world case of an infostealer sweeping up an agent's identity and memory rather than just browser credentials - though Hudson Rock is explicit that the malware (a likely Vidar variant) had no OpenClaw-specific module and caught the files via a generic file-grabbing routine. Single confirmed victim. Hudson Rock sells infostealer intelligence. Also reported as: 'Infostealer malware observed exfiltrating an OpenClaw agent's configuration environment and gateway tokens'.
Supporting sources
Cite as
Enkrypt AI. "Commodity infostealer observed harvesting OpenClaw agent config, device keys and memory files from a real victim". AIR, AIR-2026-0043. https://agentincident.vercel.app/i/AIR-2026-0043/ (accessed 2026-10-19).