Malicious OpenClaw Skills: Acronis Found 575 Fake AI Agent Add-Ons Pushing Malware to Windows and Mac, and What to Check This Week

A security team at Acronis found more than 575 add-ons for the OpenClaw AI agent, called skills, that looked like useful tools but led users into installing malware on Windows and Mac computers. If anyone at your company runs an AI agent that can execute commands, one bad skill can turn that agent, or the person using it, into the attacker's installer.

Acronis first documented the skills in an April 30, 2026 report titled Poisoning the well. It repeated the figure in its TRU Cyber Pulse 2026 report, which Help Net Security covered on November 10, 2026. The same research also covers BOSSAI, a case where one operator ran a group of AI agents against real organizations. Below is what Acronis confirmed, what it did not, and what to check this week.

What are malicious OpenClaw skills?

OpenClaw is an AI agent that does work on a computer for its user: it can run commands, read files and connect to services. Skills are add-on packages, shared on a public catalog called ClawHub, that teach the agent new tasks. Each skill includes a SKILL.md file of instructions.

The attack works because people and agents follow those instructions. In the report's words, the agents were "working as intended." Nothing in OpenClaw itself was broken. The attackers took advantage of the trust people give a skill that looks helpful.

What Acronis confirmed

• 575 malicious skills from 13 accounts, counted "as of this writing" in the April 30 report. Two accounts published most of them: hightower6eu with 334 and sakaen736jih with 199. The next largest were zaycv (21) and jordanprater (7).
• A fake utility as bait. One skill claimed to summarize YouTube transcripts and told users they first had to install something called OpenClawDriver.
• On Windows, that meant downloading a password-protected archive. Acronis says multiple security vendors detected the file inside as a trojan, and that it was packed with VMProtect, a tool that makes analysis harder.
• On macOS, it meant running an encoded command. The command downloaded a script, cleared the Mac's quarantine flag on a second file and ran it. Acronis identified that final file as AMOS Stealer, malware sold to criminals that steals passwords and other data from Macs.
• A second lure, ClawHub-DependencyInstaller.zip, was a password-protected archive hosted on MediaFire, with "almost no antivirus detections at the time of analysis." Its SKILL.md looked clean. A separate text file, README BEFORE INSTALLING.txt, sent users to the download. Inside, Acronis found a 64-bit loader that decrypted a hidden payload and ran it in memory.

Attackers like password-protected archives because security scanners often cannot look inside them.

What is claimed but not confirmed

• Cryptocurrency miners. Acronis lists cryptominers in its summary, but the evidence is hedged. In one Windows chain, a PowerShell stage created hidden folders, added Windows Defender exclusions, set up scheduled tasks that run at login and saved a downloaded file disguised as svchost.exe. Acronis describes that file's behavior only as "consistent with a cryptominer." That is an assessment, not a confirmed identification.
• Victims. Acronis does not say how many people installed these skills or which organizations were affected.
• Current status. The report does not say whether ClawHub removed the skills. ClawHub's documentation says it runs automated checks on published skills, shows the latest scan state on each skill's page, and lets moderators hide content and ban accounts. We could not confirm what happened to these 575.
• The number. 575 is the count Acronis had when it wrote the April report. The Cyber Pulse report says "more than 575." Read it as a snapshot from that point in time.

BOSSAI: what happens when attackers run the agents

In a separate report on November 4, 2026, Acronis described a lone operator based in Taiwan who ran 12 AI agents, nine of them active, against hundreds of organizations. Hermes, the main attack agent, was reached through a WeChat gateway. OpenClaw, which mostly built and maintained infrastructure, was reached through LINE. The operator wrote commands in Traditional Chinese, mostly typing them directly into each agent's own interface. The agents did not talk to each other, so the operator passed results between them by hand.

Two settings stand out. Hermes ran in a fully autonomous mode that approved its own actions without asking, and a scanning agent had its scope checks turned off and every risk level set to auto-approve. Acronis also says commercial AI models generally refused exploitation requests, so the attack agents ran almost entirely on open-source models with their safety training removed.

The damage was real. Acronis reports confirmed breaches at universities and emergency services providers, with "confirmed data exfiltration of medical data and PII," and confirmed access or data theft at roughly 10 targets across three countries.

Why AI agent skills matter for a company network

An AI agent runs with the access of the person using it: their files, browser sessions, saved keys and cloud accounts. A malicious skill does not need to break in. It only needs someone to say yes.

These tools are already on work machines. In an October 6, 2026 report, Acronis said about 9.4% of Windows computers with its EDR enabled ran an AI agent tool between June and September 2026, up from close to zero a year earlier. Fully autonomous agents such as OpenClaw and Hermes were rarer, about 1 in 5,600 endpoints, and Acronis calls these minimum levels. It also found that a connection from an agent to an outside service can be switched on in about 30 seconds, with no admin rights or approval needed.

The same rule applies to agents on your own servers: give them only the access the task needs. Our self-hosting infrastructure work starts from that rule.

What to do this week

OpenClaw skills questions people are asking

What is an OpenClaw skill?

An add-on package for the OpenClaw AI agent, shared on the ClawHub catalog, that gives the agent instructions for a new task.

How many malicious OpenClaw skills were found?

Acronis counted 575 from 13 publisher accounts in its April 30, 2026 report. Its Cyber Pulse 2026 report says more than 575.

Do malicious AI agent skills affect Macs?

Yes. Acronis confirmed one Mac infection chain that ended in AMOS Stealer, a password-stealing program.

Did the skills install cryptocurrency miners?

Possibly. Acronis said one Windows file behaved in a way "consistent with a cryptominer," but it did not confirm that the file was one.

Is ClawHub safe to use?

ClawHub scans skills and has moderators, but malicious skills still got through. Read every skill's instructions before installing it, and check its scan state and publisher.

Are AI agents being used to carry out attacks?

Yes. In the BOSSAI case, Acronis documented one operator using AI agents to breach universities and emergency services, with confirmed data theft.

The bigger lesson

An AI agent is software that runs with your permissions and follows someone else's instructions. Treat skills like any other code you run: know where they came from, read what they ask for, and give the agent no more access than the job needs. The agent will do what it is told, so the controls have to sit around it.

Want help locking down the tools your team runs? See our security hardening service or request a tech quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Acronis TRU: Poisoning the well; Acronis TRU: BOSSAI; Acronis TRU: AI agents at work; Acronis: TRU Cyber Pulse 2026; OpenClaw: ClawHub documentation.