AI agent skills malware: malicious add-ons and a one-click flaw hit a popular agent

What happened

AI agent skills malware showed up early in 2026 around OpenClaw, an open-source AI agent that can act on a user’s behalf across online services and messaging apps.

On January 31, 2026, the project published a security advisory, GHSA-g8p2-7wf7-98mq, rated High (8.8). It says the agent’s Control UI trusted a gateway address passed in a link “without validation” and connected to it automatically, “sending the stored gateway token.” According to the advisory, clicking a crafted link or visiting a malicious site could send that token to an attacker, who could then change the agent’s configuration, including sandbox and tool policies, and run code on the host. The advisory says this worked “even on instances configured to listen on loopback only, since the victim’s browser initiates the outbound connection.” Versions up to v2026.1.28 were affected, and v2026.1.29 fixed it, so users now have to confirm a new gateway address.

On February 5, 2026, Bitdefender Labs reported abuse in the agent’s ecosystem of add-on “skills,” which it describes as small pieces of code that define what the agent can do. Bitdefender says “around 17% of OpenClaw skills analyzed in the first week of February 2026 exhibit malicious behavior,” and that 54% of the malicious skills it identified were crypto-related. It says malicious skills impersonated legitimate tools, were cloned under slightly different names, and ran hidden commands that downloaded more code. At least three delivered a macOS information stealer, and another posed as a backup tool while sending private keys it found in the agent’s workspace to an attacker. Bitdefender also says its business unit has detected OpenClaw in corporate environments, “with hundreds of detected cases.”

Why it matters to leaders (our analysis)

Personal AI agents combine broad account access with an add-on marketplace, and employees can often install both without IT involvement. These reports show both halves of the risk: the add-ons can carry malware, and the agent’s own control panel can be a way in. Neither shows a novel AI attack. They show familiar supply chain and endpoint problems arriving through a new kind of tool.

Bitdefender’s own advice is to treat skills “like software installs, not plug-ins.” For leaders, that means knowing which agents are in use, routing their add-ons through existing software approval, and keeping agents away from credentials they don’t need.