Infostealer Malware Targets OpenClaw AI Secrets First Time
2 min. read 
Published on
Infostealer malware stole OpenClaw AI agent configuration files for the first time on February 13, 2026. Hudson Rock found a live case where the malware grabbed API keys, tokens, and other secrets from the popular local AI framework. Attackers can now hijack AI agent identities.
OpenClaw runs on user machines with persistent memory. It handles tasks, emails, and cloud services. Its rise made it a prime target for stealers hunting high-value credentials.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
The stolen files reveal emails, private keys, and agent behavior logs. This marks a shift from browser data to AI agent compromise.
Hudson Rock published the first detection. Their report states: “Hudson Rock has now detected a live infection where an infostealer successfully exfiltrated a victim’s OpenClaw configuration environment.”Â
They predicted this attack last month. OpenClaw stores sensitive data in plain text files. Stealers scan for keywords like “token” and grab them automatically.
Alon Gal, Hudson Rock CTO, identified it as a Vidar variant. It uses broad file grabs, not OpenClaw-specific code.
Stolen OpenClaw Files
The malware took these key files from the .openclaw directory:
| File Name | Contains | Risk |
|---|---|---|
| openclaw.json | Email, workspace path, gateway token | Remote connections, impersonation |
| device.json | Public/private keys (Pem) | Device signing, safe checks bypass |
| soul.md | Agent behavior definition | Full personality hijack |
| AGENTS.md, MEMORY.md | Activity logs, messages, calendar | Personal data exposure |
These enable full digital identity takeover per Hudson Rock analysis.
Attack Evolution
Stealers evolved fast with AI tools. OpenClaw users face risks as it integrates into work flows. Expect targeted stealers soon.
Tenable found a related flaw in nanobot, an OpenClaw-inspired AI agent. CVE-2026-2577 allowed WhatsApp hijacks. Fixed in v0.13.post7
Nanobot hit 20k GitHub stars in weeks.
- OpenClaw formerly ClawdBot/MoltBot.
- Stores data locally with weak protection.
- Global adoption spikes exposure.
Protection Steps
- Move secrets to secure vaults.
- Encrypt OpenClaw config files.
- Scan for stealers regularly.
- Limit AI agent cloud access.
- Monitor for odd API activity.
FAQ
Config files with tokens, keys, emails, logs.Â
Vidar variant on Feb 13, 2026.
No, stores secrets in plain files scanned by stealers.
Nanobot CVE-2026-2577 fixed
Encrypt configs, use vaults, run AV scans.
Yes, as adoption grows per Hudson Rock prediction.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages