Security researchers have identified the first real-world case of infostealer malware stealing sensitive configuration data from the OpenClaw agentic AI framework, exposing API keys, authentication tokens, and other secrets stored on infected systems.
OpenClaw (formerly ClawdBot and MoltBot) is a locally running AI agent platform that maintains persistent configuration and memory files on a user’s device. It can access local files, authenticate into communication tools, and interact with online services, making it a powerful personal assistant—but also a high-value target.
Due to its growing popularity, experts had warned that attackers would begin targeting OpenClaw’s configuration environment, which contains credentials used to connect to cloud services and AI platforms.
Hudson Rock reported the first confirmed incident where an infostealer successfully exfiltrated a victim’s OpenClaw configuration directory. The company described this as a major shift in infostealer behavior—from stealing browser passwords to extracting the “identities” of personal AI agents.
According to Hudson Rock, the malware is likely a variant of the Vidar infostealer and was active in an infection observed on February 13, 2026. Rather than targeting OpenClaw specifically, the malware performed broad file harvesting, searching for files containing keywords such as “token” and “private key.” OpenClaw’s .openclaw directory matched these patterns and was collected automatically.
Stolen files included:
- openclaw.json – containing email metadata, workspace paths, and a gateway authentication token that could allow remote access or impersonation.
- device.json – containing public and private cryptographic keys, potentially enabling attackers to sign messages and bypass device trust checks.
- soul.md and memory files – storing agent behavior rules, activity logs, private messages, and calendar data.
Hudson Rock’s analysis suggests the data could enable full digital identity compromise of the victim.
Researchers expect infostealers to increasingly target AI agent frameworks as they become embedded in professional workflows, with more specialized extraction techniques likely to emerge.
Comments