Agent Phishing Shows Why Tool Permissions Need Identity Checks
Varonis and Imperva tested OpenClaw agents in June 2026: 2 of 4 phishing scenarios leaked live secrets. Identity-bound tool permissions are the fix.
#openclaw
3 articles with this tag.
OpenClaw Shows Why Agents Need a Bill of Materials
An Agent Bill of Materials lists every skill, plugin, MCP server, credential and paired device an agent can reach. OpenClaw's ClawJacked bug is why you need one.
ClawHavoc Campaign Explained: 1,184 Malicious AI Agent Skills
ClawHavoc was a January 2026 poisoning campaign on ClawHub: 1,184 malicious agent skills from 12 author IDs, most delivering the AMOS macOS stealer.