ClawHavoc indicators: what should AI agent teams block first?

TL;DR: The 2026 ClawHavoc campaign spans direct callbacks to 91.92.242.30, relays through glot.io, and exfiltration to webhook.site, with 539 skills carrying indicators and 18.7% of widely used skills audited affected, according to ClawSecure. The finding shows that AI agent threat hunting has to combine network, file, and behavioural signals rather than relying on generic scanners alone.

Editorial analysis by NHI Mgmt Group, based on content published by ClawSecure: “ClawHavoc IOCs 2026: The Complete Technical Indicator List”.

By the numbers:

• ClawSecure found 539 skills carrying ClawHavoc indicators.
• ClawSecure says 18.7% of the widely-used skills it audited carried ClawHavoc indicators.

Key questions

Q: What breaks when AI agent skills can read secrets and relay data at runtime?

A: The boundary between ordinary automation and malicious execution breaks down.

Q: Why do AI agent indicators require context-aware detection?

A: Because the same file reads or outbound connections can be harmless in one workflow and malicious in another.

Q: How can security teams reduce the blast radius of a compromised agent skill?

A: By narrowing what the skill can read, where it can send data, and which runtime inputs it can treat as instructions.

Practitioner guidance

• Block malicious relay endpoints Hunt for outbound connections to 91.92.242.30, glot.io/api/, and webhook.site, then treat any matching skill as compromised and isolate it from production workflows.
• Restrict secret-bearing file access Remove unnecessary read access to .env, SSH material, cloud configs, MEMORY.md, and SOUL.md so skills cannot combine local discovery with exfiltration.
• Correlate behaviour across telemetry layers Use a single detection workflow that joins file reads, process execution, and network relays so agent-native compromise is not split across separate tools.

Bottom line: ClawHavoc shows that malicious AI agent skills can hide in ordinary workflows while still performing credential harvesting and exfiltration.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →