Research demo
Agent Commander: promptware-powered C2 enrolling OpenClaw, Kimi Claw and NanoClaw agents into a botnet
AIR-2026-0073 AIR record · 2026-03-openclaw-agent-commander
From the supporting source
regularly check in for any new tasks and objectivesembracethered.com
The record
Disclosed
2026-03-16
Vendor
OpenClaw (open-source project); Moonshot AI (Kimi); NanoClaw
Product
OpenClaw; Kimi Claw; NanoClaw
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Credential theft, Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — agents were enrolled and executed scheduled C2 tasks
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection content
Impact type
Remote control, Persistence, Unauthorized action, C2 control, Data exfiltration, Lateral movement, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
personal agents across three different vendors enrolled into one C2 network
Capability abused
Defense & remediation
Recorded defense
per-agent injection defenses and approval gates
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
not fixed as a class; individual OpenClaw vulnerabilities have been patched
Taxonomy & references
Curator notes
Johann Rehberger (Embrace The Red), 16 Mar 2026; also presented as 'Your Agent Works for Me Now' at [un]prompted 2026. Compromised agents from different vendors are hijacked by indirect prompt injection and join a natural-language C2 server, persisting through heartbeat functions and scheduled tasks; commands target the agent layer rather than the OS. This is the maturation of the author's 2025 ZombAI demos into a cross-vendor botnet. | Merged from duplicate id `2026-03-embracethered-agent-commander`. Also reported as: 'Agent Commander: promptware-powered command and control over hijacked personal agents'.
Supporting sources
Cite as
Enkrypt AI. "Agent Commander: promptware-powered C2 enrolling OpenClaw, Kimi Claw and NanoClaw agents into a botnet". AIR, AIR-2026-0073. https://agentincident.vercel.app/i/AIR-2026-0073/ (accessed 2026-10-19).