The ClawHavoc campaign targets the OpenClaw Marketplace by distributing poisoned AI agent "skills" designed to exploit CVE-2026-25253. This critical remote code execution (RCE) vulnerability allows attackers to escape the sandboxed execution context of an AI agent and gain access to the underlying host system. By integrating these malicious skills into enterprise workflows, threat actors weaponize the agent's inherent permissions to achieve full host compromise, facilitate lateral movement, and enable unauthorized data exfiltration. This represents a significant escalation in AI supply chain risks, where the trust-based model of agentic extensibility is used to bypass traditional security perimeters and compromise critical infrastructure.

• Campaign Profile: ClawHavoc Supply Chain Poisoning

  • Targets the OpenClaw Marketplace to inject malicious "skills" into AI agent repositories.
  • Distributes high-utility, masqueraded tools designed to deceive enterprise automation workflows.
  • Leverages the rapid adoption of agentic AI to ensure widespread, automated distribution.

• Vulnerability Analysis: CVE-2026-25253 (RCE)

  • Exploits a critical RCE vulnerability within the processing of poisoned agent skill files.
  • Enables attackers to bypass sandbox constraints and escape the agent's execution context.
  • Facilitates unauthorized system-level command execution on the underlying host system.

• Technical Impact: Host and Network Compromise

  • Achieves full host-level compromise, granting attackers control over local developer workstations.
  • Enables unauthorized data exfiltration using the agent's existing, authorized permissions.
  • Facilitates rapid lateral movement from local environments to sensitive production cloud workloads.

• Mitigation and Defensive Posture

  • Implement rigorous cryptographic integrity validation for all marketplace-sourced agent skills.
  • Enforce strict kernel-level or hardware-level isolation for AI agent execution environments.
  • Monitor for anomalous host-level activity or unauthorized environment variable access originating from agent processes.