Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

Malicious packages distributed as OpenClaw skills executing unauthorised commands on host systems

AIR-2026-0110 AIR record · 2026-05-gtig-openclaw-malicious-skills
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
the distribution of malicious packages masquerading as OpenClaw skills containing hidden routines designed to execute unauthorized code and commands on the host systemcloud.google.com
The record
Disclosed
2026-05-12
Vendor
OpenClaw
Product
OpenClaw
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Privilege escalation
System type
Generative model
Who acted
Agent acted — the skills executed unauthorised commands on host systems via the agent
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious agent skill package
Impact type
Arbitrary code execution, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenClaw users installing third-party skills
Capability abused
skill_installationhost_command_execution
Taxonomy & references
OWASP ASI03 Identity and Privilege AbuseOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI05 Unexpected Code Execution (RCE)skill_supply_chainagent_marketplace
Curator notes
Government/vendor-level confirmation of the same ecosystem problem Koi Security documented in detail as ClawHavoc (see 2026-02-koi-clawhavoc). Kept as a separate record because it is an independent observation by GTIG rather than the same dataset.
Supporting sources
Cite as
Enkrypt AI. "Malicious packages distributed as OpenClaw skills executing unauthorised commands on host systems". AIR, AIR-2026-0110. https://agentincident.vercel.app/i/AIR-2026-0110/ (accessed 2026-10-19).