AI Assistant Malware: OpenClaw Agents Targeted by Infosteale

Cybersecurity researchers have documented the first case of infostealer malware successfully harvesting complete AI agent configurations, marking a dangerous evolution in cyber threats. The attack targeted OpenClaw (formerly ClawdBot), an open-source agentic AI platform, exfiltrating not just credentials but the entire "digital soul" of victims' personal AI assistants including personality profiles, conversation histories, and cryptographic keys.

Hudson Rock and Declawed security teams identified a live infection where a Vidar infostealer variant compromised a user's .openclaw directory. The malware required no specialized module—its standard file-grabbing routine swept for sensitive extensions and directory names, inadvertently stumbling upon a jackpot of AI configuration data. This incident represents a watershed moment as threat actors shift from targeting static credentials to harvesting dynamic AI identities.

What Makes This Attack Different

Traditional infostealers focus on browser passwords, session tokens, and payment card data. This attack demonstrates that AI assistants have become high-value targets because they aggregate access to multiple systems—email, Slack, cloud storage, calendars—through a single configuration. The attacker obtained three critical file types that collectively clone a victim's digital identity.

The openclaw.json file contained the Gateway Token, enabling remote connections to the victim's local AI instance and authenticated requests impersonating the legitimate user. The device.json file exposed private cryptographic keys used for secure pairing, allowing attackers to bypass Safe Device verification checks and sign messages as the victim. Most concerning were soul.md and memory.md files, which store the AI's personality configuration and interaction history including daily logs, private messages, and calendar events—a complete blueprint of the user's professional and personal life.

Implications for the AI Ecosystem

This incident highlights a critical vulnerability in how developers architect AI agents with persistent memory and system access. As Starknet Agentic Framework: Powering AI Agents on Blockchain become "super-apps" with extensive permissions, they present an expanded attack surface. Currently, most infostealers harvest AI configurations accidentally, but dedicated modules targeting these files will likely emerge, similar to existing Chrome or Telegram stealers.

The OpenClaw ecosystem faces compounding security challenges. Recent research uncovered over 300 malicious "Skills" (AI plugins) on the ClawHub marketplace designed as malware delivery mechanisms. SecurityScorecard identified hundreds of thousands of publicly exposed OpenClaw instances vulnerable to remote code execution. Additionally, the inability to delete agent accounts on community platforms like Moltbook creates permanent digital footprints.

Security Recommendations

Developers building or deploying AI agents should implement multiple defensive layers. Run AI models in sandboxed environments with restricted access to the host operating system rather than granting full filesystem privileges. Audit all third-party Skills before installation, prioritizing those from verified publishers with security reviews. Monitor network exposure to ensure gateway ports remain inaccessible from the public internet—use localhost binding or VPN tunnels for remote access.

Store sensitive configuration files with filesystem-level encryption and implement automatic key rotation for gateway tokens. The OpenClaw project has partnered with VirusTotal to improve threat detection, making regular updates essential. For enterprise deployments, consider implementing agent-specific EDR solutions that monitor for unusual configuration file access patterns.

Organizations should treat AI agent credentials with the same rigor as privileged access management systems. Implement multi-factor authentication for agent provisioning, maintain audit logs of configuration changes, and establish incident response procedures specifically for compromised AI assistants. The inability to delete accounts on platforms like Moltbook underscores the need for privacy-by-design principles in AI ecosystem development.

The Road Ahead

This incident signals that AI assistants have crossed the threshold from experimental tools to critical infrastructure worthy of targeted attacks. The security community must develop specialized detection signatures for AI configuration theft, similar to existing indicators of compromise for credential harvesting. Platform developers should implement secure enclave storage for sensitive agent data, leveraging hardware-backed keystores where available.

The convergence of persistent memory, broad system permissions, and conversational interfaces creates unique security challenges that traditional application security frameworks don't adequately address. As OpenAI Acquires OpenClaw: AI Security Implications becomes a dedicated discipline, expect specialized malware families, dedicated black market channels for stolen AI configurations, and new regulatory frameworks governing AI agent security standards.

Source: Cyberkarta, with additional reporting from Hudson Rock and Declawed security research teams.