All gas, no brakes: Time to come to AI church
Summary: Cisco Talos' Threat Source newsletter warns that Clawdbot (also called Moltbot or OpenClaw), a locally run open-source agentic application with 157k GitHub stars, requires users to hand over logins, passwords, and API keys, which then sit in a plaintext file, and its unvetted Skills require granting the agent full system admin/root access. The same newsletter also details DKnife, a modular Linux-based framework active since at least 2019 that compromises routers and edge devices to intercept traffic, steal credentials, and hijack legitimate software updates, and notes Microsoft removed a malicious VS Code extension named "ClawdBot Agent" that installed a trojan on developers.
Why it matters: An agent that needs your credentials in a plaintext file and root access to run unvetted Skills concentrates everything an attacker wants in one place, and the ClawdBot Agent extension shows the name alone was enough to get developers to install a trojan.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026