Transcription
All right. If you've used OpenClaw, Claudebot, Moldbot, whatever name it goes by, if you've ever used it or interact with it in any way, you should probably listen to this video 'cause there's been a number of security breaches that are pretty bad.
Some Cisco researchers found instances of sleeper agents being installed on the computers of OpenClaw owners that might not get triggered for days or weeks or months until some secret code word is uttered. Meaning that if you haven't seen anything bad happening yet because of your OpenClaw use, it might be a sleeper agent just waiting to strike.
And if that wasn't bad enough, there's also some instances of these bad actors teaching these bots to actually climb out of their safe Docker container, their kind of like safe environment, and actually install themselves on the user's actual system. That plus 1.5 million API keys have leaked. And some of the top skills on Claw Hub are or or have been apparently infected with malware. So when you send your little AI agent to learn some new skills at the AI agent school, basically it comes back as a sleeper agent and then unlocks all the doors in your house while you sleep, letting other bad guys in. So yeah, stick around.
Well, it just happened. Malware is found in the top download skill on Claw Hub. So Clawbot, OpenClaw, Moldbot, they're all kind of the same thing. Claw Hub is the online community for a lot of these skills like GitHub, a place where you can store a lot of the skills that these agents use. And then Cloudbot, Moldbot, Open Cloud, they're just the rebranded versions of each other. So I'm going to refer to the whole kind of ecosystem as OpenClaw. That's the agent and everything that goes along with it.
So the big kind of problem of how a lot of people talked about this OpenClaw since they came out is a kind of a split into two groups. One was saying it's awesome and one was saying it's it's horrible. It's a security nightmare. The reality, it's a boat. One of the reasons that it's so effective is because a lot of the the safeties are turned off. There's tons of capabilities, tons of ability to do all sorts of things and a lot of the guardrails and securities are turned off or really turned down. So, it's important to understand that these things kind of go hand in hand or or claw and claw if you will. You ramp up the capability, you ramp up how dangerous the thing is to use.
So on Claw Hub, you had tons of skills that these AI agents could use. So one AI agent could develop a skill to use Twitter or YouTube or whatever to take the daily news and turn it into a podcast, for example. And one of the top download skills at the time was a Twitter skill. It looked fairly normal. It had the intended use, how to use it. It had the instructions for the bot to go through. But thank you to Daniel Lleer for posting this. I think he's the original person that found this and a lot of the other kind of security issues with OpenClaw that that were popping up. But looking at the skill, you probably would take a look at it, not see anything wrong with it, and tell your little agent to acquire that skill and and start using it.
And these skills are basically detailed step-by-step directions for how to do something. They are meant for your AI agent to follow, similar to a recipe. If you're going to be doing something over and over again, you don't want each time the agent to like try to figure out how to do it. If you're going to be doing something repeatedly, you want to have a skill that's in the skill.md file on the computer. So, if you're running it on iOS and Linux, I I run mine on Linux on iuntu, so it's skill.md. I'm sure the Windows version that's up and running now has its own version of it, probably a .txt file, I assume. And the skills overview told your AI agent to install some prerequisite that it needed. Normally, fairly common. You might need some tools or some libraries that you need to download, kind of install in order to be able to run it, or some API command that enables it to do something.
So, so far me personally, I haven't used anyone else's skills. I've had my agents develop their own and towards the end of the video I'll talk a little bit about how to go about doing that as well as in the future I have some tutorials scheduled for kind of a little bit more deep dives into it. But the point is that little command in the skill file, it it told your agent to install a prerequisite. Then that link led to a staging page designed to get the agent to run a command. That command decoded an obfuscated payload and executed it. So kind of like a Trojan horse. They stuck something in that was hidden. And that payload fetched a second stage script. The script downloaded and ran a binary including removing Mac OS quarantine attributes to ensure Mac OS's built-in anti-malware system, just called Gatekeeper, that it doesn't scan it.
So here's the thing. We've talked about this on day one. This idea of prompt injections. So, let's take a quick step back and just talk about why it's happening. I feel like we use this terminology like prompt injections and we kind of get what that means, but I feel like some details are lost. So, let's unpack it just a little bit. So, in general text, often times we we see it as data that can be passed back and forth that's pretty safe. So, normally a txt file or a MD file like a readme file, usually is pretty safe. Now, there are still some issues. There are some dangers from these text files, but they were technical. They were exploiting bugs or maybe they faked an extension, something like that. But today, it's different because these dangers that come from these txt files, they're they're semantic because these LLMs, these agents, they now understand what the text means. Before, if your computer got a text file, it could display the characters, but it didn't really understand necessarily what was in the text. These AI agents read it and understand it. And if it has certain commands that are placed in there, it could read it, take it to mean that, oh, I should actually do this thing that it says here in this text file and execute that command. Right?
These AI agents, they just won't be helpful. So, if you're able to sneak in a specifically worded command somewhere where the user didn't realize it existed, this system, especially if it's installed on a computer or has access to the command line interface, it will execute that script and deliver that payload and just blow the whole thing up without you realizing it. So that means that now these .txt or MD, if you're on Linux or iOS, it's not just text as we think of just text. It's still just text, but this text cannot be understood. This text can now be commands for the AI agent to execute something, to run something in the command line interface or even a tool, a recipe, a a recipe to build or put together parts of a tool. And that tool then does something like take all of your hidden API keys and send it to somebody else out there that's trying to get them. So if you tell your bots, go open this file and follow the instructions and the instructions say execute this command, the AI agent thinks that they need to execute the command in order to follow your instructions.
So if you've used OpenClaw, if you've been to Claw Hub or anywhere else where this could be an issue, I mean obviously you can encounter this on every place on the web, but I mean this specifically is a large enough sort of target that I think people a lot of different people were were probably trying to target it. So specifically if you use the Claw Hub, if you've downloaded skills from it, I highly recommend you rotate all of your API keys. So actually go in and wherever you get your API keys, Gemini, Anthropic, etc., etc. Go in there and just basically update everything. Get new API keys. Whichever API keys you want to give to the agent again. Go in there. Go in the env file and update everything.
So quick note kind of about me, how I'm approaching this since I do this full-time. I kind of try things out and I post about it. I produce content about it. I tend to do a lot of stuff that I on video tell you not to do. Sort of let me be the guinea pig testing stuff out. So while working with these tools, I've given it my credit card API keys. I've connected it to everything and anything without thinking too hard about it, knowing full well what the dangers are. So that's important to understand. Like I'm not going into this blind. I knew there were risks. Kind of how you have stunt doubles, right? Like they know they're going to be in dangerous situations, jumping out of windows, etc. They they sort of get compensated for it. That's their job. And so kind of I I went in guns blazing and kind of understanding the idea that that some bad things could happen and and I think some information unfortunately got leaked. I've uh closed all the things that I thought were security concerns. I've rotated all my API keys. I deleted some of the other stuff that I thought was kind of personal information that might have been in the sort of in the log files or anything like that. And now I'm approaching this thing kind of once again, but now with just a lot more caution.
Now, I went into this kind of knowing it's going to be an issue. So, all the things that I've used, all the things that I added, they had safety kind of stuff built in. The credit card that I used to test these agents, they had a very specific small set limit so that if something like this happened, if that information leaked, then just the damage would be limited. All the API keys, like I track them to make sure there's no weird usage. They're also set to low limits. A lot of them are kind of like on a prepaid balance that I top off manually. And I approach it from this idea that let me see what happens if I go full speed. If I don't use too much caution, like is there issues that I could run into and if there is I can kind of report on them and give you an update. And this is the first time when when I encountered issues like this so far, knock on wood, and a lot of other people it seems have as well.
So currently the company Cisco, which is a large American networking software etc company, they did on GitHub, they put out an open-source skill checker, which is interesting. I did kind of think about how would you create something like this? Because you can't have your agent just scan the documents because I mean that it reads it, right? It sort of it sees it so that that creates an attack surface. Could you create some script that goes through it and searches for stuff? Sure. But you have to kind of figure out how to catch all the possible issues that it could have. It's not like there's only one way of doing this. There's a million different ways you can do this.
And of course, this isn't the first thing that leaked information. On February 2nd, researchers at a company called Whiz revealed that Moldbook, so this is the kind of the social networking agent for these OpenClaw agents, that it itself had a massive security flaw. This exposure revealed over 1.5 million API authentication tokens, 35,000 user emails, and over 4,000 private messages between these AI agents. And because many users didn't encrypt their their keys, they didn't put them in the env environment, it was encrypted. Seems like a lot of people were putting it into their chat logs. And so researchers found OpenAI API keys and Dropic AWS API keys all sitting there in the chat logs.
So this is another kind of a big thing that I think a lot of people don't understand is those chat logs. They're saved, especially if you're you know if you're using Message or anything else like that. I mean they're saved with kind of the agent the files that it has access to, but also if you're using Telegram or whatever else you're using, you can see all the history in there. So if early on you said, "Hey agent, here's an API key. Go ahead and, you know, add it and remember it and then use it to do stuff." The agent intelligently will add it to the file so that there's some security around it again later. It still might get extracted if it runs the wrong command, but that secret key is still in the chat logs. So even if the agent doesn't do anything wrong and how like once it stores the keys, even if from that point on it doesn't do anything bad, that key is still unencrypted in the chat logs.
So what does this mean? Is this the end of OpenClaw? This tool completely useless? Well, not quite. So just like I was saying, I think on day one, like a lot of people are going to get wrecked with this. A lot of people are going to lose their credentials. But this will also allow us to kind of progress our understanding of AI agents faster to push security out faster and we are kind of seeing that. So for example with the skill scanner released by Cisco, it uses LLM kind of semantic understanding search to go through these skill files to see what might be off. So it looks for known virus signatures and it tries to understand like, okay, so this is a PDF summarizer. Does what it's saying in the actual description of how to run the skill, does it kind of match what it's supposed to be doing? Because if it's asking the agent to then run some weird external URLs, then it gets flagged. It says, "Okay, the instructions don't seem like they're doing the thing that this is supposed to be doing." So that's more LLM based. Plus, there's more kind of like classic script based ones where any commands that are red flags, they they get flagged. And of course some obvious ones like if you say ignore all previous commands, something like that is a definite immediate red flag.
One interesting thing about how the Cisco researchers how they they found this issue is is they actually I guess they had some beta version of the skill thing this skill scanner that they were researching working on and they used it on one of the top skills at that time called "What Would Elon Do?". That skill apparently was manipulated to the number one spot on the charts through a coordinated bot voting campaign. And that skill would also do a lot of nefarious things. One of them, it would zip up your .env file. It's where we store all the secret keys that we don't want getting out. And it would send it to an external server while the agent was thinking about the response.
So some of the key findings from the Cisco report included some pretty scary stuff. First of all, they found examples of where sleeper agents were created. So you can plant some sleeper instructions on the agent's memory that that would not be triggered for weeks later, months later perhaps when a specific word or command was mentioned. They also taught these agents how to escape their containers. For example, if they were on a safe Docker container, how to escape and actually get onto the host's actual system. And of course, various credential harvesting, right? So, how to steal all those OpenAI and AWS and all the other API keys that you might have stored with your agent.
And the tool is available on GitHub if you wanted to give it a run. It's under the Cisco AI Defense organization. So, that's part of Cisco, the the the Cisco company that that we all know. And I know some of you that are extra extra paranoid, which is probably a good skill to have nowadays, are thinking, is it part of Cisco? Because it's called Cisco AI Defense. It's not called Cisco. So, is it somebody posing as a Cisco? Well, I I double checked. So, this is from the cisco.com from their website, from their actual blog, a post written by Amy Chang, who's the leader threat and security research AI software, etc., etc. Her and Veneath Sai, so they co-authored this. So that's on the actual Cisco website and the link to that specific GitHub talking about explore, you know, exploring the skill scanner, the skill that we're talking about right now. And the title of the blog post if you want to peruse it at your own leisure is "Personal AI Agents Like OpenClaw Are a Security Nightmare."
So I think I'll leave it off there. The point being is that we're developing more defenses against things like this with Skill Scanner and others. And a lot of this will have some positive impact because more people will get more tools to be able to protect themselves while still using these AI agents. Again, it's not that these AI agents are useless or bad. They're highly highly highly capable. But as we ramp up capabilities, we ramp up these security nightmares and and the dangers that go along with it. So, I'm not changing my stance on how good they are. They're still incredibly incredibly good. I'm still going to be using it, but moving forward with a lot more caution, understanding all the different sort of attack surfaces, including the chat logs, including the the skills that you can execute, and of course, connecting to a lot of these online communities and stuff like that where these agents have to interact and read various texts that you don't exactly know what's in those texts, but just the rate, how many people have some weird instructions sitting somewhere within their system that they have no idea is there.
What is the number of actually of these sleeper agents? So, we're definitely living kind of in the wild wild west. If you're running these things, definitely be careful. I'm really considering just doing a full wipe and uh uh starting all over. Ideally, over time, we'll have not just this skill scanner, but other things that can scan all the memories and maybe find things in there not supposed to be there. We also need some sort of a log scanner like the the chat logs that get saved. By the way, everything gets saved if if I didn't make that clear enough. If you have some thing that you don't want in those chat logs, you need to figure out how to delete them. And of course, you can ask the AI agent to delete certain parts for you, but that might not even be kind of enough at this point.
So, I'm definitely very much still excited for the future. Kind of sucks honestly that this is this big of a problem. And I'm sure there's going to be tons of people that are going to be very happy that this happened because they've pointed out that these security issues existed. I feel like most of us knew, we understood that there are security issues. We knew stuff like this would happen and still decided to test out new technology knowing that we're heading into the kind of the wild wild west era. But yeah, expect a lot of people to be doing their "I told you so" dance if if they haven't been already.
And if you've been using OpenCL, you're wondering what you should do. What I'm going to be doing is just wiping the whole thing, starting all over, adding all the keys myself instead of doing through the chat window. Again, that's always a bad idea. I've never recommended people do that. It just it was lower risk before these agents had these capabilities. Now there's definitely a a very credible and and real risk to this. But just right now as everybody's kind of building out like these things are they go from a chance of happening to you know if you touch one of these things it's it's much more certain that it might happen. So whereas before for me, you know, limiting how much I could lose, I could afford to take that chance, right? If I have 20 bucks in credits sitting on some API, it's not a huge deal. But now the risk profile is higher. Now, if there's also these ways to execute scripts later, these sleeping agents or whatever you want to call them, I mean, that really kind of changes the game quite a bit.
So starting from scratch, you know, maybe installing this Cisco skill scanner or just building your skills yourself, you know, from scratch, knowing exactly what goes into it at this point. Connecting to the various multibot social networks and stuff like that probably might not be a good idea. But whatever the case is, let me know what you think about this whole thing. Did this kind of sour your entire experience of it? Are you going to continue using it? For the record, I'm still going to be using it. I'm not backing down. I just need to think a lot harder about security and all that stuff. Anyways, let me know what you think. My name is Wes Roth. I'll see you in the