What happened with OpenClaw and the Claude Code leak

Two separate security stories about AI agents ran in early 2026. OpenClaw, a popular open source personal agent, had a run of vulnerabilities, thousands of servers left open on the internet, and a marketplace of add-on skills that attackers filled with malware. People lost API keys and tokens. Anthropic, for its part, accidentally published the source code of its Claude Code command line tool inside an npm package. Anthropic said no customer data or credentials were exposed, but attackers used the leak as bait for malware. Both had the same root cause: trust placed in something nobody had checked. Both are preventable with ordinary controls.

What is OpenClaw?

An open source agent that runs on your own machine or server and acts for you through chat apps, email and the tools you connect. It began as Clawdbot, was renamed Moltbot after Anthropic raised a trademark concern, and became OpenClaw at the end of January 2026. It spread fast because it does real work with real access. That same access is what made its security problems serious.

What went wrong with OpenClaw?

Several things in the space of two weeks, and they compounded.

A one-click takeover. CVE-2026-25253, rated 8.8, let a crafted link make OpenClaw's control panel connect to an attacker's server and send it the stored gateway token. With that token an attacker could change the agent's sandbox and tool settings and run commands. It worked even on instances that only listened locally. Version 2026.1.29 fixed it by asking the user to confirm a new gateway address.

Thousands of instances open to the internet. Censys counted 21,639 exposed instances on 31 January, up from about 1,000 a week earlier. SecurityScorecard later found about 40,000, and put roughly a third of them at risk of remote code execution. Sources disagree about whether a default setting was to blame. What is clear is that many were exposed by how people deployed them, behind a reverse proxy or bound to a network address.

Malware in the skills marketplace. Skills are add-ons that teach the agent new tasks, and they run with the agent's permissions. Koi Security audited ClawHub, the skills marketplace, and found 341 malicious skills out of 2,857. Most belonged to one campaign that told users to paste a "prerequisite" command, which installed an information stealer. Snyk scanned nearly 4,000 skills and found a critical issue in 13.4% of them. It also found hardcoded secrets in about one in ten ClawHub skills.

A leaked database next door. Moltbook, a social network for OpenClaw agents, left a database key in its web page with no access rules behind it. Wiz found that it exposed about 1.5 million agent API tokens and some 35,000 email addresses.

By February, ordinary information stealers were taking OpenClaw's configuration folder, gateway token included, from infected machines. According to The Register, Gartner advised enterprises to block it.

What did the OpenClaw project change?

A lot, quickly, and that deserves saying. The rename shipped with dozens of security fixes. ClawHub now scans every skill with VirusTotal and rescans daily. Users can report a skill, and one with several reports is hidden by default. Publishers need a GitHub account at least a week old. The documentation describes keeping keys out of plain configuration files and includes a command that finds the ones still there. Most of the remaining risk sits with how each person deploys it.

What happened with the Claude Code leak?

On 31 March 2026, version 2.1.88 of Anthropic's @anthropic-ai/claude-code npm package shipped with a large source map file. A source map links compiled code back to its original source. This one pointed to an archive of about 1,900 TypeScript files, roughly half a million lines, and a researcher spotted it the same morning. Anthropic pulled the version and called it "a release packaging issue caused by human error, not a security breach". It said no customer data or credentials were exposed. What leaked was the command line client, not a model.

Anthropic's takedown notice to GitHub at first covered a network of about 8,100 repositories. The next day it was narrowed to one repository and its forks. A rewrite called claw-code, built from what the leak showed, became one of the fastest-growing projects on GitHub.

Who was actually harmed by the leak?

People who went looking for it. Within two days, researchers at Zscaler found GitHub repositories offering "leaked Claude Code" downloads that installed malware, including the Vidar information stealer. One of them had hundreds of stars and forks. The leak itself exposed no user's secrets. The lure built on it was designed to take them.

How do you prevent the OpenClaw kind of incident?

These rules apply to any agent you run, not only OpenClaw.

• Never expose an agent's control surface. Keep it on a private network or behind real authentication. Treat "only local connections are trusted" as false once a proxy is involved.
• Keep keys out of anything the agent can read. A token in a config file is a token for any malware or prompt injection that reaches the machine. We cover the alternatives in how to manage credentials for cloud AI agents.
• Treat skills and plugins as code you are installing. They run with the agent's permissions. Install only reviewed ones, prefer read-only tools, and never follow a setup step that asks you to paste a command into a terminal.
• Expect prompt injection. A message, a web page or a tool description can carry instructions. That is why MCP tool poisoning works.
• Rotate everything an agent touched once you suspect a compromise. The agent's memory files count too.

How do you prevent the Claude Code kind of incident?

If you publish packages, decide what ships instead of letting the default decide. By default npm publishes every file not excluded, so set an explicit files allowlist in package.json. Turn off source maps in production builds, or exclude *.map files. Run npm pack --dry-run in CI and fail the build if anything unexpected appears.

If you use agent tools, install them only from the vendor's official package or site. A "leaked" or "unlocked" version on a code host is the oldest malware lure there is, with a new name on it.

What do the two incidents have in common?

In both, the headline flaw did less damage than the trust around it. A token kept where it could be read, a skill nobody reviewed, a download from the wrong place. The fix is the same: the agent should never hold the keys, and nothing it runs should be trusted because of where it came from.

That is how Cognibl is built. Tools belong to the organization, and a project turns each one on. The gateway holds every credential and makes each call, so the agent receives results and never tokens. Anything not explicitly allowed is refused, and the refusal is recorded. An admin has to stock a community server before anyone can connect it, and it is limited to the tools that declare themselves read-only. See how agents reach your tools.