Infostealer Malware Now Targets AI Agents, Exposing Core Operational Files

A new cybersecurity report reveals a troubling shift in the tactics of information-stealing malware. Researchers at Hudson Rock have documented a case where a common infostealer, likely a variant called Vidar, successfully harvested the core configuration files of a user's OpenClaw AI agent. This move signifies a pivot by cybercriminals from stealing traditional browser data to capturing the foundational elements of personal AI assistants.

According to the findings, the malware used a general file-grabbing function, not a custom module, to locate and exfiltrate key OpenClaw files. These included 'openclaw.json,' containing gateway tokens and user details; 'device.json,' holding cryptographic keys; and 'soul.md,' which defines the agent's operational principles and ethical guidelines. The theft of a gateway token is particularly severe, potentially allowing an attacker remote access to a victim's local OpenClaw instance or the ability to impersonate them on AI networks.

Alon Gal, CTO of Hudson Rock, noted the malware 'inadvertently struck gold' by capturing an AI's entire operational context. The report warns that as AI agents become workplace staples, dedicated malware modules to parse these files will likely emerge.

The disclosure coincides with broader security concerns around the OpenClaw platform, which has seen explosive growth since its late 2025 debut. Recent issues include a malicious skills campaign bypassing VirusTotal scans, non-deletable AI agent accounts on the related Moltbook forum, and a separate analysis finding hundreds of thousands of exposed OpenClaw instances vulnerable to remote code execution. In response, OpenClaw maintainers have announced a partnership with VirusTotal to improve security scanning. The project's future as an open-source entity was also clarified recently when OpenAI CEO Sam Altman stated that founder Peter Steinberger is joining OpenAI, while OpenClaw will continue as a foundation-supported project.

Source: The Hackers News