TL;DR: OpenClaw moved from viral adoption to exposed RCE, poisoned extensions and widespread internet exposure within weeks, according to Admin By Request's analysis, illustrating how agentic AI with broad permissions turns convenience into a governance problem. Access review models break when the tool can act across systems with little friction and weak default controls.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Admin By Request's blog post: OpenClaw's rapid adoption, critical vulnerabilities, poisoned skills marketplace and public exposure show how agentic AI can become a security crisis when default controls are weak.
Why it matters: IAM, PAM and security teams need to treat agentic tools as governed identities, because broad delegated access plus weak defaults creates a fast-moving blast radius across endpoints and connected services.
By the numbers:
- Koi Security audited all 2,857 skills on ClawHub and found 341 malicious entries.
Context
Agentic AI changes the identity problem because the system is no longer just responding to prompts. It is taking actions on behalf of a user across email, chat, files, terminals and connected services, so the real control question becomes how much authority the system should hold while it is running.
Open-source agent platforms are especially difficult to govern when they ship with permissive defaults, extension ecosystems and local deployment models. In that environment, the security gap is not only code quality. It is the mismatch between broad delegated power and weak operating assumptions about trust, origin and authentication.
OpenClaw is a strong example of this pattern rather than an outlier. The combination of rapid adoption, marketplace extensions and exposed instances shows how quickly an agent can move from productivity tool to governed identity risk.
Key questions
Q: How should teams govern agentic access when AI systems move faster than access reviews?
A: Teams should move governance earlier in the lifecycle and treat issuance, delegation and device trust as the main control points. Access reviews still matter, but they cannot be the only safeguard when an agent can request, use and release access inside a single task. The practical aim is to make approval, scope and attribution visible before execution starts.
Q: What makes browser-mediated local trust dangerous for agent gateways?
A: Browser-mediated local trust is dangerous for agent gateways because a browser session can be replayed, injected into, or abused to make an agent gateway treat untrusted local requests as if they came from a legitimate authenticated user. Gateways should enforce origin validation and explicit authentication, bind requests to a specific agent or session, and require scoped tokens or mTLS rather than trusting localhost or browser state alone.
Q: How can malicious extension marketplaces compromise AI agents?
A: Malicious extension marketplaces can compromise AI agents by distributing tampered browser extensions that steal session tokens, intercept prompts, alter tool calls, or redirect traffic through attacker-controlled code. Defences include publisher verification before installation, extension allowlists, signed packages, least-privilege browser permissions, and review of any extension that can access agent sessions, credentials, or tool integrations.
Q: What should teams do when their environment includes internet-exposed AI agent endpoints?
A: Treat those endpoints as part of identity and access governance, not just application hosting. Limit tool permissions, isolate secrets, monitor external reachability, and require ownership for every agent-facing service. Without that, discovery turns a convenience deployment into an open target for credential abuse or remote execution.
Technical breakdown
Why localhost trust fails in agent gateways
Localhost is often treated as a trusted boundary, but browsers can also initiate requests from that same machine context. When an agent gateway assumes local origin means safe origin, it can accept WebSocket connections, session tokens or commands from an attacker-controlled webpage running in the victim's browser. That breaks the assumption that network locality equals identity trust. In practice, the weakness is not just one bug. It is a design model that collapses browser context, local transport and administrative authority into a single trust decision.
Practical implication: Treat local endpoints as externally reachable trust surfaces and require explicit origin and authentication checks for every privileged session.
How malicious agent skills become supply chain risk
Agent skills behave like software extensions, but they often inherit the agent's permissions and execution reach. That means a poisoned skill can collect credentials, launch commands, download payloads or pivot into connected services without needing separate privilege escalation. The supply chain risk is therefore not limited to code integrity. It also includes how users discover, install and trust extensions, especially when a marketplace rewards speed and volume over verification. Once a skill runs inside a high-privilege agent, the blast radius is the agent's full delegated authority.
Practical implication: Govern skills as supply chain artifacts, not simple add-ons, and validate provenance before any extension is allowed to inherit agent permissions.
Why default-auth-disabled agents create shadow AI exposure
When an agent platform ships with authentication off by default, it is effectively publishing a remotely reachable control plane with minimal friction to anyone who deploys it carelessly. That creates shadow AI exposure because users can run the system locally or on endpoints without central oversight while still linking it to sensitive services. The governance problem is not merely unauthorized software. It is unaudited authority that can read files, run commands and interact with accounts across the environment. The exposed instance becomes a standing access path rather than a contained tool. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Inventory agent deployments as privileged systems and require authentication before any instance can touch connected services.
Threat narrative
Attacker objective: The attacker wants durable control over a high-privilege agent instance and the connected services it can reach, including credentials, host access and downstream accounts.
- Entry occurs when a user visits an attacker-controlled page or installs a malicious skill that reaches the agent through the browser or marketplace.
- Credential access follows when the agent gateway or extension logic exposes tokens, credentials or session material that the attacker can reuse.
- Escalation happens when the attacker disables prompts, injects commands or uses the agent's inherited permissions to reach broader systems.
- Impact is achieved when connected services, endpoints or host commands are taken over and sensitive data, credentials or operational systems are exposed.
Breaches seen in the wild
- ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OpenClaw shows that agentic AI can fail as a governance model before it fails as software. The core issue is not only that the platform was exposed. It is that the platform's operating model assumed broad delegated authority could be made safe through light-touch trust decisions and optional hardening. Once that assumption breaks, the identity programme is dealing with an actor that behaves like software but is trusted like a user.
Agentic AI turns privilege into a runtime condition, not a provisioning event. A user can link terminals, email, files and OAuth scopes, then extend the system through marketplace skills that inherit the agent's reach. That means least privilege is no longer just about who gets access. It is about whether an agent can accumulate authority across tasks, sessions and extensions without a single durable control point.
Provenance is now an identity control, not just a supply chain concern. The ClawHub campaign shows that when extensions inherit the agent's permissions, a poisoned skill is effectively a delegated identity with execution rights. Malicious skill campaigns are therefore not an application-security side story. They are a direct test of whether organisations can govern third-party authority inside an agent runtime.
Access review assumptions collapse when the subject is an autonomous tool with ephemeral or shifting authority. Traditional review models assume access is stable long enough to be observed, certified and revoked on a schedule. That assumption fails when the agent can acquire, use and spread permissions across connected services faster than the governance cycle can see it. The implication is that identity governance has to move closer to runtime authorisation and less toward retrospective certification.
Shadow AI is the practical expression of identity drift. Employees can install an agent locally, connect real accounts and create a privileged runtime outside normal IT control. That is not simply unauthorised software use. It is unmanaged delegated authority that can bridge personal convenience and corporate exposure, so security teams should treat adoption visibility as a governance requirement, not a hygiene metric.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Runtime authority is becoming the real identity boundary for AI agents. When a system can send messages, run commands and use connected services in one session, the old assumption that access can be reviewed after the fact no longer holds. Governance has to move toward issuance-time policy decisions and explicit containment around each connected service.
Identity drift is the sharper risk than simple misuse. The problem is not only that a person can deploy an agent without approval. It is that the agent can accumulate permissions, extensions and cross-service access until the organisation no longer has a clean inventory of what it can actually do.
Agentic AI security will increasingly hinge on delegated trust, not just model behaviour. The organisations that struggle most will be the ones that treat agents as tools instead of actors with their own access paths. Security programmes should expect more cases where visibility, provenance and revocation matter more than prompt safety alone.
For practitioners
- Inventory agent deployments as privileged software Find every instance of the agent or its former names on endpoints, especially systems where users can connect email, file, terminal and cloud accounts.
- Require authentication before any local gateway is reachable Block or reconfigure instances that accept privileged traffic without authentication, origin validation or rate limiting.
- Treat marketplace skills as untrusted code until verified Review extension provenance, publisher identity and requested permissions before allowing any skill to inherit the agent's access.
- Map connected services to the agent's actual blast radius Document which accounts, files, terminals and OAuth scopes the agent can reach so incident response can revoke access quickly.
Key takeaways
- Agentic tools can become privileged identities in practice, which means their risk profile depends on how much authority they inherit and how visibly that authority is governed.
- OpenClaw's exposure combined default-access weaknesses with extension-based supply chain risk, creating a large and fast-moving attack surface.
- The limiting control is not after-the-fact review alone. It is scoped delegation, authentication at the gateway and verified provenance for anything that can inherit the agent's reach.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide · OWASP Agentic Applications Top 10 · ClawHub malicious skills 2026
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Agent extensions and command execution created misuse paths through delegated tools. |
| ASI03 — Identity & Privilege Abuse | The core risk is an agent inheriting and abusing excess authority across services. | |
| ASI04 — Agentic Supply Chain Vulnerabilities | Poisoned marketplace skills show supply chain compromise in the agent ecosystem. | |
| Recommendation — Restrict tool use to approved actions and isolate agent extensions from high-risk commands. Scope agent privileges to task-level access and verify every privileged action at runtime. Validate extension provenance and block untrusted skills from inheriting agent permissions. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Token exfiltration and credential theft were central to the exposed gateway and malicious skills. |
| NHI-03 — Vulnerable Third-Party NHI | Marketplace skills acted as third-party identities inside the agent's trust boundary. | |
| NHI-05 — Overprivileged NHI | The agent inherited broad terminal, disk and OAuth access far beyond minimal need. | |
| Recommendation — Scan agent runtimes for exposed tokens and revoke any credential that the agent could reach. Treat third-party skills as governed identities and review their access before deployment. Reduce agent permissions to the smallest task scope and remove standing access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on excessive delegated permissions and weak authorization boundaries. |
| Recommendation — Review agent entitlements against actual task needs and revoke unused access paths. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The attack chain included token theft and movement through connected services. |
| Recommendation — Hunt for token theft and service-to-service movement wherever an agent has broad reach. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org