OpenClaw's Security Nightmare: 341 Malicious Skills, RCE Vulnerabilities, and the GlassWorm Campaign
The open-source AI agent with 135,000+ GitHub stars has become the center of 2026's first major AI security crisis
Tag
#supply-chain
GlassWorm Attack Hijacks Hundreds of Python Repos Through Stolen GitHub Tokens
A self-propagating malware campaign steals developer credentials via malicious VS Code extensions, then force-pushes cryptocurrency-stealing code into legitimate Python projects.
Clinejection: How a GitHub Issue Title Compromised 4,000 Developer Machines
A prompt injection attack against Cline's AI triage bot escalated into a supply chain compromise - installing unauthorized software on thousands of developer systems.
ChainLeak: Critical Chainlit AI Framework Flaws Enable Cloud Environment Takeover
Two vulnerabilities in the popular Chainlit AI framework allow attackers to steal cloud credentials, API keys, and user data from enterprise chatbots.
AI Reads 67,000 Papers, Finds 25 Magnets to Break China's Grip
UNH team built an AI that extracted magnetic data from 67,573 papers, identifying 25 new high-temperature magnets to replace rare earths in EVs.
OpenClaw's Month From Hell: 40K Exposed, Corporate Bans
The viral AI agent went from 135K GitHub stars to enterprise blacklists in three weeks. Here's what went wrong and why it matters for every AI agent.
AI Memory Shortage: Why Consumer Electronics Cost More
AI data-center demand is squeezing DRAM supply, raising memory and device prices as manufacturers prioritize higher-margin HBM.
DockerDash: How Poisoned Container Metadata Turned Docker's AI Assistant Into an Attack Vector
Two independent security firms found that Docker's Ask Gordon AI could be hijacked through image metadata, enabling remote code execution and data theft across millions of developer machines.
341 Malicious AI Agent Plugins Were Hiding in Plain Sight on ClawHub
OpenClaw's skills marketplace was weaponized to steal passwords and crypto wallets. A single attacker published 314 fake tools. This is what happens when AI agents get app stores.
341 Malicious Skills Found on ClawHub: The First Major AI Agent Supply Chain Attack
Security researchers discovered hundreds of malware-laced OpenClaw skills stealing crypto wallets, passwords, and API keys. The AI agent ecosystem just got its npm moment.
DockerDash: How Metadata Hijacks Docker's AI Assistant
A Docker AI vulnerability let attackers embed commands in image labels. Patched months ago, the pattern keeps recurring.