Infostealers start harvesting OpenClaw configs and gateway tokens

In February 2026 a commodity information stealer lifted the configuration environment of an OpenClaw agent off an infected machine: the JSON file holding the agent's gateway token, the JSON file holding its device signing key, and the Markdown files that define its persona and memory. Hudson Rock, the threat-intelligence firm that published the finding, called it a milestone in stealer behaviour, describing a shift from browser credentials to the identities of personal AI agents; BleepingComputer reported the firm's claim that this was the first in-the-wild instance of its kind, and The Hacker News reported it that month too. The stealer was not built for OpenClaw. Hudson Rock's account says a broad file-grabbing routine swept for sensitive extensions and directory names such as .openclaw and took the folder incidentally, which is why the firm describes the malware as having struck gold rather than having hunted the agent. The archive files the episode as a high-severity credential incident at confidence B, disputed false, with real harm recorded, and the Orca AI Incident Archive holds this record alongside its neighbouring OpenClaw entries, each graded on its own evidence.

Three files, and what each one unlocks

OpenClaw, formerly Clawdbot and Moltbot, is a self-hosted personal AI agent that keeps persistent state in files on the user's own machine. Hudson Rock's write-up, summarised by The Hacker News and by BleepingComputer, lists three things taken from the victim's OpenClaw directory. openclaw.json held a partially redacted Gmail address, the workspace path and a high-entropy gateway token stored under gateway.auth.token. Hudson Rock's technical note says that token would let an attacker connect to the victim's local OpenClaw instance remotely if the port is exposed, or impersonate the client in authenticated requests to the AI gateway.

device.json held the publicKeyPem and privateKeyPem of the user's device, the key pair OpenClaw uses for pairing and for signing operations. With the private half, Hudson Rock says, an attacker can sign messages as the victim's device, potentially bypassing the "Safe Device" checks and reaching encrypted logs or cloud services paired to that device. soul.md, together with the memory files AGENTS.md and MEMORY.md, held the agent's operating principles, behavioural guidelines and ethical boundaries, and, in the firm's description, likely held daily logs of the user's activity, private messages and calendar events — what it calls a blueprint of the user's life.

One detail in the vendor's account is worth separating from the rest. Hudson Rock ran the stolen files through its own AI system, Enki, for an automated risk assessment, and its summary of that output is that tokens, keys and personal context together amount to a total compromise of the user's digital identity. That is a risk model applied to the files. It is not a record of anything an attacker did with them.

The mechanism was a grab-bag, not a checklist entry

The archive's one-line summary reads that agent credentials have "formally entered the standard infostealer checklist". The document underneath it says something narrower. Hudson Rock is explicit that no OpenClaw-specific module was involved: the malware ran a generic routine that harvested files by extension and by directory name, and .openclaw matched. Alon Gal, Hudson Rock's co-founder and CTO, told BleepingComputer that the routine scanned for files and directories containing keywords such as "token" and "private key".

The dedicated module is a forecast, not an observation. Hudson Rock writes that as agents like OpenClaw become more integrated into professional workflows, stealer developers will likely release modules specifically designed to decrypt and parse these files, much like they do for Chrome or Telegram today. On 26 January 2026 the same firm had published a post titled ClawdBot: The New Primary Target for Infostealers in the AI Era, arguing that the agent keeps memories, profiles and authentication tokens in plaintext Markdown and JSON that is often readable by any process running as the user. The February case is the first time it reported that prediction landing on a real machine.

The distinction is not academic. An incidental sweep means the exposure is a property of where the agent keeps its secrets, not of attackers having decided to hunt OpenClaw. If parsers arrive, the same files become readable at scale rather than merely collectable, and the defensive question moves from directory permissions to what a gateway token and a device key can still reach once they are gone.

One machine, one vendor, and a long trail of repetition

Hudson Rock's post describes a victim, singular, and publishes screenshots of one infected machine's directory tree. It does not say how many machines the sample came from, and none of the coverage read for this article adds a second case. BleepingComputer's Bill Toulas spoke to Gal directly and carries detail the Hudson Rock post does not — the Vidar attribution and the keyword-based scanning — but the underlying observation is still one infection, seen by one vendor. Infosecurity Magazine and SecurityAffairs restated the same finding within a day of Hudson Rock's post, and ThaiCERT repeated it in an advisory on 25 February 2026. A national CERT repeating a vendor report is amplification, not independent confirmation.

That is what the archive's confidence B records: documented, but from a single or secondary source. The record is also dated to February 2026 at month precision; BleepingComputer's account dates the theft more narrowly, but the archive carries only the month, and this article keeps to the archive's precision. Nothing read for this article disputes Hudson Rock's account, and the record is marked undisputed. The caveat is not contradiction. It is that the milestone framing — the first live case, the shift from browser credentials to agent identities — is a characterisation by the firm that found the sample, and there is no public baseline against which "first" can be checked.

No CVE was assigned. No OpenClaw security advisory addressing this theft appears in the sources read for this article, and no regulator has published a finding of its own about it — the only government-adjacent document located is ThaiCERT's advisory, which restates Hudson Rock's report. Unlike a software flaw, this incident has no patch to point at, because the files were not doing anything the software treated as wrong. They were sitting in plaintext on disk, next to the agent.

What the record does not establish

• No source read for this article shows a stolen gateway token or device key being used. Hudson Rock's harms are conditional throughout — "if the port is exposed", "potentially bypassing" — and the coverage that repeats them does not add a demonstrated intrusion.

• The Vidar attribution is hedged by the firm that made it. Gal described the sample as likely a variant of Vidar, an off-the-shelf stealer active since late 2018, based on the infection details; no published hash, sample analysis or family comparison appears in the sources read here.

• The number of affected users is unknown. Hudson Rock reported one victim and gave no count of additional machines, and no later reporting located for this article supplied one.

• Whether the stolen material was traded, sold or indexed by any criminal service is not established by any source read here.

• The real harm the record marks is the exfiltration itself: a real machine's credentials and keys left the machine. That is a lower bar than a takeover, and the record does not claim a takeover.

What had already changed, and what it did not cover

OpenClaw announced a partnership with VirusTotal on 7 February 2026, before Hudson Rock published its account. The arrangement scans every skill uploaded to ClawHub — packaging it, hashing it, checking the hash against VirusTotal and running VirusTotal's Code Insight analysis on anything unseen — and the project paired it with a threat model and an audit for potential misconfigurations. It addresses the marketplace. It does not encrypt openclaw.json on a user's disk, and it does nothing about malware that is already running on the endpoint and reading the home directory, which is the vector in this record.

The nearest thing to guidance aimed at this failure is advisory rather than technical. ThaiCERT's 25 February 2026 note repeats Hudson Rock's finding and recommends running agents in sandboxed virtual machines or containers under least privilege, avoiding direct access to sensitive data, verifying the source of every installed skill, monitoring activity logs, and preparing an incident-response plan that includes full system resets and credential rotation. OpenClaw's own public account of its security work, published in April 2026, says secrets were moved away from "please be careful" toward references so that credentials do not sit in prompts, logs, transcripts or agent state — the same direction, though that post does not address the configuration files Hudson Rock documented.

What to watch is whether dedicated parsers appear. Hudson Rock's forecast is that they will, and its January post is the reason to take the forecast seriously rather than the February sample being the proof of it. Until then the record stands as a single, well-documented theft: plaintext agent state, taken by a stealer that was not looking for it, with the damage assessed by the vendor rather than observed in the wild.