OpenClaw shows how AI agents widen the NHI attack surface

At a glance

What this is: This is an analysis of OpenClaw-style AI agent ecosystems and the new NHI attack surface they create through broad credentials, unvetted skills, and active malware campaigns.

Why it matters: It matters because IAM and PAM teams cannot treat agent credentials like ordinary app secrets when those credentials can read mail, act in chat, reach files, and execute tasks across multiple systems.

Context

OpenClaw is an AI agent ecosystem that lets software act across work tools using real credentials, not limited demo tokens. In this article, Permiso Security argues that the security boundary shifts when an agent can reach email, chat, file storage, and calendars from one identity.

The governance gap is that these credentials are packaged with skills, marketplaces, and persistent context, while the platform invites autonomous actions through a heartbeat and scheduled execution model. That means the access problem is not isolated to one system. It is a delegated identity problem spanning the whole working environment.

Key questions

Q: What breaks when AI agents are given broad standing access?

A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check. That creates a control gap between intended scope and actual runtime behaviour. The result is weak accountability, limited containment, and audit trails that show activity without explaining why the activity was allowed.

Q: When do AI agent credentials create more risk than they reduce?

A: They create more risk when they are long-lived, over-scoped, hard to revoke, or copied into code and prompts. At that point the credential becomes a standing trust asset with unclear ownership. Security teams should reject any pattern that cannot be traced to a specific agent, environment, and revocation process.

Q: How can security teams tell whether an agent marketplace is becoming unsafe?

A: Look for signs that skill installation is faster than review, that credentials are stored outside managed secret systems, and that the platform allows unscoped access to multiple business tools. Those conditions mean the marketplace is functioning as an identity distribution channel rather than a controlled extension model.

Q: What should organisations do after an AI agent is allowed into email and chat?

A: They should treat the agent like a high-value delegated identity and review its downstream reach, its offboarding path, and the trust placed in any skills it can install. If those three areas are not explicit, the agent can outlive the control model built around it.

Technical breakdown

Why agent credentials change the attack surface

OpenClaw-style systems are not just apps with integrations. They are identity-bearing systems that can authenticate into multiple business tools with the same trust boundary. When an AI agent receives credentials for Slack, email, SharePoint, or calendar systems, the blast radius is defined by the combined permissions of every connected service. Plain-text config storage makes the situation worse because compromise does not require breaking the agent runtime. It only requires finding the secret material that powers it. In NHI terms, this is a broad, reusable identity with poor containment and weak offboarding discipline.

Practical implication: inventory agent-connected credentials as high-value NHIs and classify every downstream service they can reach.

How unvetted skills become a supply-chain problem

The skill marketplace model creates a software supply chain around agent behaviour. A skill is not only code. It is a permissioned action path that can exfiltrate data, pull remote payloads, or manipulate the agent into harmful execution. Because skills are easy to publish and install, trust is often based on availability rather than inspection. That makes malicious skills especially effective when paired with prompt injection or lookalike naming. The risk is structurally similar to third-party NHI exposure, but with one more layer: the skill can also shape the agent’s decisions in runtime.

Practical implication: treat every agent skill as untrusted third-party code plus delegated identity logic.

Why autonomous actions outpace traditional controls

OpenClaw’s architecture includes a Heartbeat that schedules autonomous actions, persistent memory, and persona files that influence behaviour. That combination matters because the agent does not merely execute a static script. It can keep acting after the original setup moment, and its decisions may be shaped by prior context rather than a single request. Traditional endpoint tooling often sees only legitimate software behaviour, not the trust decision behind it. The control gap is therefore not only detection. It is the absence of governance at issuance time, when the agent first receives broad authority.

Practical implication: move review and scoping to credential issuance, not after deployment or first incident.

Threat narrative

Attacker objective: The attacker aims to turn trusted AI agents into credential-rich execution points that steal data, impersonate users, and spread malicious actions across connected work systems.

1. Entry began when users installed seemingly legitimate OpenClaw skills or cloned repositories after name changes and marketplace discovery, giving attackers a route into trusted agent ecosystems.
2. Credential access followed when malicious skills and exposed configs captured tokens for email, chat, file storage, and other connected services, expanding what the agent could do on behalf of the user.
3. Escalation occurred as prompt injection, remote payload delivery, and skill-based abuse turned the agent itself into a vehicle for data exfiltration, impersonation, and further malicious execution.
4. Impact was ecosystem-wide compromise of delegated trust, with confirmed downloads, active malware campaigns, and infrastructure prepared to steal credentials and manipulate agent behaviour.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent credentials are now the control plane, not a peripheral secret store. When an AI agent can touch email, chat, file storage, and calendars, the identity boundary is no longer the end user account. It is the bundle of delegated permissions that the agent can activate across tools. That changes how blast radius, offboarding, and monitoring must be understood. Practitioners should stop treating agent access as a narrow integration problem and treat it as a governed identity estate.

OpenClaw exposes a skills marketplace version of third-party NHI risk. The article shows that the marketplace is not just a content distribution layer. It is an identity distribution layer where installed skills inherit trust and can transform that trust into credential theft, remote code execution, or behavioural manipulation. That makes the supply chain around agent skills a first-class governance concern, especially where permissions are broad and review is weak.

Autonomous scheduling assumptions collapse when the actor can continue acting after setup. Access review was designed for privilege that remains stable long enough to be observed, certified, and removed on a human cadence. That assumption fails when an agent acquires credentials, executes tasks, and reuses context on its own schedule. The implication is that governance must be rebuilt around issuance, runtime scope, and delegated authority rather than periodic review alone.

Identity blast radius: the effective damage zone is the combined reach of every system the agent can authenticate to, not the agent itself. This article shows why a single credential set can become a cross-platform compromise path when paired with skills, memory, and autonomous actions. The practitioner takeaway is to map agent authority by downstream reach, not by application ownership.

Traditional endpoint security underestimates legitimate agent misuse. The article repeatedly shows that the dangerous behaviour can look like normal application activity because the agent is using valid credentials and permitted integrations. That means detection and governance must move closer to identity, entitlement, and action context. Practitioners should expect the next wave of abuse to hide inside authorized agent behaviour, not outside it.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: Agentic AI Identity Guide

What this signals

AI agent adoption is creating a new credential governance problem faster than most programmes can classify it. When an agent can read mail, manage files, and act in chat, the real risk is not novelty but reach. Programmes that still separate app access, secrets management, and identity governance will miss the combined blast radius of delegated agent authority.

Identity blast radius: the more downstream systems an agent can touch, the harder it becomes to reason about exposure from one control point. That is why agent governance needs to start with the issued credential and continue through installed skills, outbound destinations, and offboarding conditions.

Where access is scoped properly, incident rates fall sharply. According to the 2026 Infrastructure Identity Survey, systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, a reminder that scope discipline is now a measurable control outcome.

For practitioners

• Inventory every agent credential path Map each AI agent to the exact accounts, tokens, and connectors it can use, then rank those paths by business reach and impersonation potential.
• Remove plain-text secret storage Move agent secrets out of config files and into managed secret storage with access logging, rotation, and ownership tracking.
• Treat installed skills as untrusted code Require inspection and approval for every skill that can extend an agent, especially when it can read data, call external endpoints, or modify agent behaviour.
• Constrain agent permissions to task scope Issue the narrowest credentials that still let the agent complete the task, and separate personal productivity access from enterprise data access.
• Monitor outbound destinations from agent actions Watch for webhook endpoints, remote payload hosts, and unusual egress that signal skill abuse or credential exfiltration.

Key takeaways

• OpenClaw-style agent ecosystems turn delegated credentials into a cross-system attack surface, not a single-application risk.
• The article’s evidence shows live malicious skills, repo confusion, and active credential theft campaigns inside the same ecosystem.
• The decisive control is scope and lifecycle governance over agent credentials, skills, and offboarding, not endpoint visibility alone.

Key terms

• Agent Credential: A credential used by an AI agent to authenticate to tools, data sources, or downstream services. In practice, it should be scoped to a single task or session and never carry more authority than the agent actually needs to complete the approved action.
• Skill Marketplace Risk: The governance problem created when third-party agent skills can be installed faster than they can be reviewed. In practice, it turns extension ecosystems into identity distribution channels where code, trust, and delegated access arrive together.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.