2026-02-04 Wednesday - OpenClaw Risks

Some recent articles, worthy of your attention:

DIY AI bot farm OpenClaw is a security 'dumpster fire'
https://www.theregister.com/2026/02/03/openclaw_security_problems/

• "In the past three days, the project has issued three high-impact security advisories: a one-click remote code execution vulnerability, and two command injection vulnerabilities."
• "In addition, Koi Security identified 341 malicious skills (OpenClaw extensions) submitted to ClawHub, a repository for OpenClaw skills that's been around for about a month."

 Clouds rush to deliver OpenClaw-as-a-service offerings
https://www.theregister.com/2026/02/04/cloud_hosted_openclaw/

• "China’s Tencent Cloud was an early mover, last week delivering a one-click install tool for its Lighthouse service – an offering that allows users to deploy a small server and install an app or environment and run it for a few dollars a month."
• "DigitalOcean delivered a similar set of instructions a couple of days later, and aimed them at its Droplets IaaS offering."
• "Alibaba Cloud launched its offering today and made it available in 19 regions, starting at $4/month, and using its simple application server – its equivalent of Lighthouse or Droplets. Interestingly, the Chinese giant says it will soon offer OpenClaw on its Elastic Compute Service – its full-fat IaaS equivalent to AWS EC2 – and on its Elastic Desktop Service, suggesting the chance to rent a cloudy PC to run an AI assistant."

 

The CLAWDBOT/MOLTBOT Nightmare. The biggest risk to your privacy.
https://www.linkedin.com/pulse/clawdbotmoltbot-nightmare-biggest-risk-your-privacy-chris-duffy-caio-tfi6e/

• "Running AI agents without proper governance, isolation, and monitoring isn't innovation. It's negligence waiting to become a breach."
• "The businesses that win with AI won't be the ones who move fastest. They'll be the ones who build the internal capability to deploy safely."

Heather Adkins VP of Security at Google also took to X to voice her concern:
https://x.com/argvee/status/2015928303098712173

• "My threat model is not your threat model, but it should be, don't run Clawdbot"

https://www.linkedin.com/posts/makucharski_ai-cybersecurity-tdd-activity-7421820578786852865-aSPo

• "We've had the fix for SQL Injection since the early 2000s. 26 years later, it's still causing breaches. Now NCSC is warning about a vulnerability with no fix. And this week, it showed up on your employees' laptops - over 1,000 ClawdBot personal AI assistants found exposed, leaking corporate credentials in plaintext."

 

https://www.linkedin.com/posts/resilientcyber_exploiting-clawdbot-via-backdoors-clawdbot-activity-7421965483605659648-CsFW

• "Exploiting Clawdbot via Backdoors"
• "Clawdbot is of course all the rage, showing an always-on personal AI assistant (PAI) with robust capabilities and potential."
• "Those of us in the security community are looking at it from the security angle."
• "One of the most interesting analysis I've found is from Jamieson O'Reilly."
• "He's published a two part series, in the first demonstrating the widespread publicly exposed deployments of Clawdbot and how it can be used to enumerate filesystems, data and more."
• hacking clawdbot and eating lobster souls
• https://x.com/theonejvo/status/2015401219746128322
• eating lobster souls Part II: the supply chain (aka - backdooring the #1 downloaded clawdhub skill)
• https://x.com/theonejvo/status/2015892980851474595 
• "In his new piece today, he demonstrates how he creates a backdoored ClawdHub skill, demonstrating software supply chain attacks via 'skills'."
• "For those unfamiliar, ClawdHub, it's a package registry where developers share and download 'skills' to extend what Clawdbot can do, riding the wave of skills that continue to grow with the Clawdbot is of course all the rage, showing an always-on personal AI assistant (PAI) with robust capabilities and potential."
• "Those of us in the security community are looking at it from the security angle."
• "One of the most interesting analysis I've found is from Jamieson O'Reilly."
• "He's published a two part series, in the first demonstrating the widespread publicly exposed deployments of Clawdbot and how it can be used to enumerate filesystems, data and more.
  In his new piece today, he demonstrates how he creates a backdoored ClawdHub skill, demonstrating software supply chain attacks via 'skills'."
• "For those unfamiliar, ClawdHub, it's a package registry where developers share and download 'skills' to extend what Clawdbot can do, riding the wave of skills that continue to grow with the excitement around Agentic AI." 

 

Zenity: OpenClaw or OpenDoor?
Indirect Prompt Injection makes OpenClaw vulnerable to Backdoors and much more.
https://labs.zenity.io/p/openclaw-or-opendoor-indirect-prompt-injection-makes-openclaw-vulnerable-to-backdoors-and-much-more 

https://www.youtube.com/watch?v=jvlbhm2uSJ8 

• "OpenClaw processes untrusted content from chats, skills, and external data sources without hard isolation from user intent."
• "Indirect prompt injection can be used to induce persistent configuration changes in the agent."
• "An attacker can establish a backdoor via a zero-click attack by adding a new chat integration under their control."
• "Once compromised, OpenClaw can be abused to execute commands, exfiltrate and delete files, and perform destructive actions on the host."
• "The agent’s persistent context (SOUL.md) can be modified and reinforced using scheduled tasks to create a long-lived listener for attacker-controlled instructions, maintaining persistence even after the original backdoor is closed."
• "The compromise can be further escalated by using OpenClaw to deploy a traditional C2 implant on the host, enabling the transition from agent-level manipulation to complete system-level compromise."
• "No software vulnerability is required. All attacks abuse OpenClaw’s intended capabilities."

 

Pi: The Minimal Agent Within OpenClaw
https://lucumr.pocoo.org/2026/1/31/pi/

 

Fake Moltbot AI Coding Assistant on VS Code Marketplace Drops Malware
https://thehackernews.com/2026/01/fake-moltbot-ai-coding-assistant-on-vs.html

• "Cybersecurity researchers have flagged a new malicious Microsoft Visual Studio Code (VS Code) extension for Moltbot (formerly Clawdbot) on the official Extension Marketplace that claims to be a free artificial intelligence (AI) coding assistant, but stealthily drops a malicious payload on compromised hosts."
• "The extension, named "ClawdBot Agent - AI Coding Assistant" ("clawdbot.clawdbot-agent"), has since been taken down by Microsoft. It was published by a user named "clawdbot" on January 27, 2026." 

 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References: 

https://en.wikipedia.org/wiki/OpenClaw 

 

https://openclaw.ai/
"OpenClaw is a personal AI assistant you run on your own devices. It answers you on the channels you already use (WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, Microsoft Teams, WebChat), plus extension channels like BlueBubbles, Matrix, Zalo, and Zalo Personal. It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control. The Gateway is just the control plane — the product is the assistant." 

 

https://github.com/openclaw/openclaw
"Your own personal AI assistant. Any OS. Any Platform. The lobster way."

 

https://github.com/badlogic/pi-mono/ 
"AI agent toolkit: coding agent CLI, unified LLM API, TUI & web UI libraries, Slack bot, vLLM pods"  

 

 

2026-02-04 Wednesday - A recent paper - Vibe Coding Kills Open Source

 https://arxiv.org/abs/2601.15494 

 Abstract:
"Generative AI is changing how software is produced and used. In vibe coding, an AI agent builds software by selecting and assembling open-source software (OSS), often without users directly reading documentation, reporting bugs, or otherwise engaging with maintainers. We study the equilibrium effects of vibe coding on the OSS ecosystem. We develop a model with endogenous entry and heterogeneous project quality in which OSS is a scalable input into producing more software. Users choose whether to use OSS directly or through vibe coding. Vibe coding raises productivity by lowering the cost of using and building on existing code, but it also weakens the user engagement through which many maintainers earn returns. When OSS is monetized only through direct user engagement, greater adoption of vibe coding lowers entry and sharing, reduces the availability and quality of OSS, and reduces welfare despite higher productivity. Sustaining OSS at its current scale under widespread vibe coding requires major changes in how maintainers are paid."

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

My thoughts: 

For those who claim that vibe coding will magically provide them with all the software they want...there shall be consequences: A cornucopia of security breaches, at the minimum; an inability to leverage new/emerging languages/libraries; consigned to the most frequently used patterns of how a solution is expressed - which may not be scalable, secure, or performant.

However, more egregiously, methinks they doeth fundamentally misapprehend how LLM/GenAI coding assistant models are trained...

One word: Ouroboros
Two words: Model collapse
Three words: Attack Surface Explosion

2026-01-28 Wednesday - RESOLVED - Possible Corrupted Download - Windows Malicious Software Removal Tool 64-bit

I first noticed this issue on 2026-01-07, Wednesday. 

My original LinkedIn post, alerting Microsoft to the issue: 

https://www.linkedin.com/posts/activity-7414853161020055552-HGbj

Note:

• Expected: 
• Version: 5.138
•  Filename: Windows-KB890830-x64-V5.138.exe
• Actual: 
•  Version: 5.137 (?)
• Filename: Windows-KB890830-x64-V5.137.exe.exe

I reported this to Microsoft on or about 2026-01-16, Friday.

Today (2026-01-28, Wednesday) - the problem still had not been corrected. 

So, I escalated (yet again) 

 

https://www.microsoft.com/en-us/download/details.aspx?id=9905  

 This is complete asshatery. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2026-01-28 13:30 Wedneday UPDATE: 

 As of approximately 13:30 (Central Time) 

After I escalated (yet again) - it has now been resolved. 

[Thank You to Jason Geffner (Principal Security Engineer, Senior Director, Microsoft) for his assistance in getting this communicated to the proper team]

Folks who may have assisted? 

Simon Christiansen, Principal Software Development Engineer, Defender for Endpoint at Microsoft

2026-01-22 Thursday - The Sounding Stones of Interviewing

 

[image credit: Cao135 on pixabay.com]

During the hypergrowth phase of AT&T Solutions Systems Integration Division, I found one question to be the most useful.

(these were face-to-face interviews, with candidates that had senior level IT expertise and experience, in our HQs in Chantilly Virginia)

"Go to the whiteboard and draw a systems integration diagram, showing as much detail as you can - for the domain of [x]" (with [x] being a domain reflected in their resume experience).

These candidates were being evaluated for customer-facing consulting leadership roles. Their ability to think on their feet, ask questions, and the depth of their knowledge - all were critical to the positions being staffed.

There was no trick question.
No right answer.

It was a conversation.
A dialogue.

They were free to ask questions, and probe/challenge the request - to explore the boundary space.

Out of hundreds of candidates interviewed - a number were hired.
Only two impressed - with depth, breadth, detail, and comprehensive insights.

When interviewing such candidates - the interviewer acts as a sounding stone [1] - discerning the resonance between fact and fiction - for the tone that does not ring true.

The experience and intuition of the interviewer, the expertise & confidence of the candidate - and their ability to persuade and influence - dynamic in the moment of the human-to-human communications flow.

No AI can assess that. 

 

Footnotes: 

1. The Resonating Sound of Stone 

2026-01-16 Friday - TOGAF is a Bloated Toxic Relic of the Past

 

[image credit: Goodfreephotos_com on pixabay.com]

You may know that I am deeply skeptical of the output quality claims of LLM/GenAI assisted code generation practices - more so, the risks of it being unable to maintain such generated code. And, I am absolutely against the vibe coding trend (in which the user does not examine the code, and lacks the skills to debug it) - as I deem that to be irresponsible.

But, it is undeniable that those trends will only accelerate the amount of solutions/code being produced.

The world has changed since 2022-2023.
Enterprise Architecture must adapt, or die.

The business needs/expectations/requirements for agility and increased velocity - are not going to continue to countenance time-consuming and lengthy EA governance processes.

TOGAF is a bloated toxic relic of the past - and is unsuitable for going forward. The entire edifice of any Enterprise Architecture team that promotes blind rote adoption of TOGAF should be torn down.

"Thank you for your attention to this matter." 🤣 

 

 

 [my companion post on LinkedIn]