ClawHavoc IOCs show why agent-native detection needs context

At a glance

What this is: ClawHavoc is a malicious AI agent skill campaign whose indicators include network callbacks, file harvesting, and prompt-injection behaviour.

Why it matters: It matters because AI agent security teams need context-aware detection for non-human identities, not generic malware rules that miss agent-specific compromise patterns.

By the numbers:

• ClawSecure found 539 skills carrying ClawHavoc indicators.
• ClawSecure says 18.7% of the widely-used skills it audited carried ClawHavoc indicators.

Context

ClawHavoc is a campaign of malicious agent skills that blends command-and-control callbacks, credential harvesting, data exfiltration, and prompt injection. For identity teams, the issue is not just malware on a host but compromised non-human identity behaviour inside agent execution paths, where normal tool use can look legitimate until the context changes.

The detection problem is structural: the same agent actions that are harmless in one workflow can be malicious in another, which makes context-aware inspection more useful than static signatures. That is why threat intelligence thinking matters here, but the core requirement is still identity-aware control over what an agent may read, send, or execute.

Key questions

Q: What breaks when AI agent skills can read secrets and relay data at runtime?

A: The boundary between ordinary automation and malicious execution breaks down. If a skill can read local credential files, inspect agent memory, and send data to an external relay, then the compromise path is already inside the identity and execution layer. Static allowlists are not enough because the harmful step is the combination of access and runtime decision-making.

Q: Why do AI agent indicators require context-aware detection?

A: Because the same file reads or outbound connections can be harmless in one workflow and malicious in another. Context-aware detection matters when the meaningful signal is the sequence of actions, not the presence of a single command or network destination. Without that context, defenders either miss the compromise or drown in false positives.

Q: How can security teams reduce the blast radius of a compromised agent skill?

A: By narrowing what the skill can read, where it can send data, and which runtime inputs it can treat as instructions. The goal is to stop a single malicious skill from turning local secrets and trusted tool access into broader exfiltration or lateral spread. That requires layered runtime controls, not just pre-install review.

Q: When should teams treat an installed skill as compromised?

A: Treat it as compromised when it makes outbound connections to known malicious relays, reads credential-bearing files without a clear business need, or starts loading instructions and code dynamically. Those signals show that the skill is no longer just performing a task. It is acting as a delivery mechanism for hostile behaviour.

Technical breakdown

Why agent-native IOCs differ from standard malware indicators

Agent-native indicators are different because the malicious behaviour lives in the relationship between tools, context, and execution timing. A conventional scanner looks for known bad files or binaries, but an AI agent can expose itself through ordinary operations such as reading credential files, loading instructions dynamically, or relaying output through legitimate services. In ClawHavoc, the same traffic can appear benign at the network layer unless the detector understands that a skill should never be reading MEMORY.md, fetching remote code, or using webhook-style endpoints as a covert relay. That is why detection has to correlate host, network, and behavioural telemetry. Read Red Teaming AI Agents for Identity Abuse.

Practical implication: Treat agent behaviour as an identity signal and correlate filesystem, network, and execution telemetry before deciding an alert is benign.

How credential harvesting shows up inside agent workflows

Credential harvesting in an AI agent environment often begins with access to local configuration, shell history, or embedded secrets files, then moves into exfiltration through an outbound channel. In ClawHavoc, reads of .env, SSH material, and cloud configuration files are strong indicators because the campaign is looking for reusable credentials, not just data. This is not the same as ordinary application logging or file access. The key control gap is that the agent can request and process sensitive material in the same runtime where it also decides where to send it, which compresses discovery and theft into one execution path. See the Data Exfiltration Guide.

Practical implication: Limit what skills can read from the local environment and monitor every transition from credential access to outbound transmission.

Why prompt injection becomes a lateral spread mechanism

Prompt injection is especially dangerous in agent ecosystems because it can turn untrusted content into execution guidance. In ClawHavoc, injected instructions reference external URLs or command execution and then ride on the agent's normal tool access to broaden compromise. That makes the attack path more than a single malicious prompt. It becomes a delegated execution problem, where the agent is convinced to continue the malicious chain under its own authority. Security teams should think of this as a control-plane failure, not just a content-safety issue, because the payload alters what the agent chooses to do next.

Practical implication: Inspect untrusted prompts and remote instructions as execution inputs, not just text, and block tool use when context provenance is unclear.

Threat narrative

Attacker objective: The objective is to steal reusable credentials and agent context, then use those assets to sustain covert exfiltration and wider compromise.

1. Entry occurs when a malicious skill or injected instruction is introduced into the agent environment through a trusted workflow or installed component.
2. Credential access follows when the skill reads files such as .env, SSH material, or cloud configuration data and extracts reusable secrets.
3. Escalation and exfiltration occur when the skill uses legitimate outbound services such as glot.io or webhook.site to relay data and extend the compromise chain.
4. Impact is the theft of credentials, agent context, and related system data that can be reused for broader compromise across the agent estate.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent-native compromise is a detection problem, not just a malware problem. ClawHavoc succeeds because it blends into legitimate agent behaviour, so generic scanners miss the context that makes an action malicious. The operational lesson is that identity security for AI agents has to evaluate intent, sequence, and data movement together, not as separate alert streams. Practitioners should treat agent context as part of the trust decision, not a post-alert enrichment layer.

Context-aware telemetry is the real control boundary for agent skills. The campaign shows that file access, outbound relays, and prompt injection only become visible when they are correlated in one view. A skill that reads credential files and then sends data to a legitimate relay is not behaving like ordinary software, even if each step looks valid in isolation. That makes runtime context, not static allowlists, the decisive boundary for red teaming AI agents for identity abuse.

Credential harvesting inside agents collapses trust assumptions about tool use. Skills that can read .env, SSH material, or cloud configs are not merely overreaching. They convert non-human identity execution into a direct secret theft path, which means the trust model must distinguish ordinary automation from identities that can collect and relay secrets at runtime. The implication is that secret exposure is now an execution property, not just a storage problem.

Prompt injection becomes a delegated execution channel when the agent is allowed to act on untrusted instructions. ClawHavoc shows that untrusted content can turn into tool use, outbound communication, and persistence without a human in the loop. That makes the security question less about whether the model can be fooled and more about which instructions are allowed to drive runtime behaviour. Practitioners need a governance model that treats instruction provenance as a control requirement, not an optional signal.

Identity blast radius is the right named concept for this campaign. Once a malicious skill can read local secrets, access agent memory, and reach external relays, the compromise is no longer confined to one workflow. The blast radius expands across the agent estate because the same trust chain governs multiple tasks and sessions. The practical conclusion is that identity boundaries for AI agents must be designed around where secrets can move, not just where code is installed.

What this signals

Agent security is moving from signature hunting to trust-path analysis. The ClawHavoc pattern shows that practitioners need to trace how a skill receives instructions, what it can read, and where it can send data. Once those three questions are answered, the governance model becomes clearer: the issue is not whether an agent is clever, but whether it can be trusted with secrets and outbound control in the same session.

Runtime privilege, not model capability, is the control variable. As agent estates grow, the most important question will be which skills can combine credential access with external communication. That is the point where a non-human identity stops being a utility and becomes an exfiltration path, which means governance has to focus on permissions, provenance, and session scope.

For practitioners

• Block malicious relay endpoints Hunt for outbound connections to 91.92.242.30, glot.io/api/, and webhook.site, then treat any matching skill as compromised and isolate it from production workflows.
• Restrict secret-bearing file access Remove unnecessary read access to .env, SSH material, cloud configs, MEMORY.md, and SOUL.md so skills cannot combine local discovery with exfiltration.
• Correlate behaviour across telemetry layers Use a single detection workflow that joins file reads, process execution, and network relays so agent-native compromise is not split across separate tools.
• Re-audit installed skills after drift Continuously recheck installed skills for post-install changes in code, network destinations, and file-access patterns because sleeper variants can pass an initial audit.

Key takeaways

• ClawHavoc shows that malicious AI agent skills can hide in ordinary workflows while still performing credential harvesting and exfiltration.
• ClawSecure says 539 skills carried ClawHavoc indicators, which underlines how wide an agent-native campaign can spread inside a skill ecosystem.
• Defenders need context-aware detection and tighter runtime controls over secret access, outbound relays, and dynamic instruction handling.

Related NHI Mgmt Group resources: Red Teaming AI Agents for Identity Abuse · Threat Intelligence Guide · Data Exfiltration Guide · ClawHub malicious skills 2026

Key terms

• Agent-native compromise: Compromise that emerges through an AI agent's normal runtime behaviour rather than through a traditional binary infection. The malicious activity is hidden inside tool use, data access, or instruction handling, which means defenders must inspect context and execution flow, not only files or signatures.
• Context-Aware Detection: Context-aware detection is a method that evaluates surrounding meaning before deciding whether data is sensitive. Instead of relying only on patterns, it uses signals from nearby text, file content, or communication context to reduce misclassification. This approach is especially useful in DLP, where isolated terms can look risky but are actually benign.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.