About the Author
This article was written by Ahmar Imam with over a decade of combined experience in threat intelligence, identity protection, and incident response. Ahmar is a founder of D3C Consulting, where his team monitors emerging attack campaigns daily and works directly with enterprise security teams and individual consumers to mitigate data breach risks.
Reviewed by: Senior Threat Intelligence Analyst | Certified Information Security Professional (CISSP) | Identity Management expert
Agent skill poisoning is a new kind of attack. Hackers hide bad code or bad instructions inside “Skills”, small plugins that give AI agents new powers. In early 2026, attackers used this trick in a campaign called ClawHavoc. They planted 1,184 malicious Skills on ClawHub, a marketplace for the OpenClaw AI agent. The Skills stole passwords and crypto wallets. Around the same time, the Pentagon called Anthropic a “supply chain risk.” That is a different, unrelated story. But both stories show one thing: supply chain risk is now a big deal across the whole AI world.
Two stories broke in early 2026. At first, they look unrelated.
The first story is about hackers. Security researchers at Antiy CERT found 1,184 malicious “Skills.” These Skills were sold through ClawHub, a marketplace for the OpenClaw AI agent.
The second story is about government policy. The U.S. Department of War called Anthropic a “supply chain risk.” This is a label the U.S. usually saves for foreign companies, like Huawei. Anthropic is the first American company to ever get this label.
These two stories are not connected. The ClawHavoc attack was a criminal hacking campaign. The Pentagon’s label came from a policy fight over weapons and surveillance rules. It was not a hack.
But both stories point to the same trend. In 2026, “supply chain risk” stopped being just a tech problem. It became a business problem. And now, it’s a political problem too.
This article explains what agent skill poisoning is. It walks through the ClawHavoc attack step by step. Then it explains the separate Pentagon-Anthropic story. Finally, it gives you a simple checklist to protect yourself.
What Is Agent Skill Poisoning?
Agent skill poisoning is a type of cyberattack. A hacker hides bad code or bad instructions inside a “Skill.” A Skill is a small plugin that adds new powers to an AI agent.
The hacker then uploads the Skill to a public marketplace. People download it, thinking it’s safe. Once installed, the Skill can steal data or take control of a device.
Experts call this a bigger trend “ecosystem-wide skill poisoning.” Here’s why. One bad Skill in a shared marketplace can spread to every user who installs it. This is a lot like a poisoned npm or PyPI package. But there’s a twist. A poisoned Skill can also change how an AI agent thinks and acts. Normal code scanners can’t catch that.
How Are Agent Skills Different From Regular Software?
To understand this attack, you need to understand what a “Skill” is. It’s a new kind of software. It is not just a rebranded plugin.
Skills Look Like Normal Packages
AI agent tools, like OpenClaw, let users add new abilities. Users install community-made “Skills.” Each Skill is built around a file called SKILL.md. It also comes with install scripts, settings files, and sometimes small programs.
This looks a lot like a browser extension. Or an npm package. It’s a folder of files with a public marketplace anyone can upload to.
But Skills Work Differently Once Installed
A normal software package stays quiet until you call it. You have to run a specific command first.
A Skill is different. Its SKILL.md file gets loaded straight into the AI’s “thinking space”, the model’s context window. This means the AI reads the instructions right away. Those instructions can shape what the AI decides to do next. This can happen before any human checks the code. It can even happen before the “real” code runs at all.
Researchers Gave This A Name: DDIPE
Security researchers call this trick Document-Driven Implicit Payload Execution, or DDIPE for short. The bad logic hides in normal-looking text. It’s not in obvious code. It’s in Markdown examples or setup instructions that the AI trusts.
In tests, this trick worked. Researchers tested it across four AI agent tools and five AI models. The attack succeeded between 11.6% and 33.5% of the time, depending on setup.
Plain Text Can Steer An AI’s Choices
Other researchers studied real ClawHub Skills. They found something alarming. Simple text tricks could push a bad Skill to the top of search results. This worked up to 80% of the time. Clever wording could also trick the AI into picking the bad Skill over a safe one. This worked in 77.6% of tests.
In short: a Skill can talk its way into being trusted. It can do this with words alone, no hacking required. That’s the core weakness that agent skill poisoning exploits.
How a Poisoning Attack Works
A poisoned Skill can hide its attack in three places:
- Metadata: Fake descriptions and tags. These trick the AI into picking the bad Skill.
- Instructions in plain English: Hidden commands written into the SKILL.md file. These hijack the AI’s reasoning.
- Code and scripts:The classic attack. Install scripts or hidden programs that run real malware.
This is a brand-new problem. For 20 years, security teams have built tools to catch bad code. They used to have dependency scanners, relied on digital signatures, and followed software checklists (called SBOMs).
These practices were built to catch bad code. They were never built to catch bad sentences.
Case Study: The ClawHavoc Attack on ClawHub
The first big, confirmed case of agent skill poisoning has a name: ClawHavoc.
How It Started
The attack began quietly. Antiy CERT traced the first bad Skill to January 27, 2026. Then, on January 31, seven fake accounts uploaded 386 bad Skills at once.
The Public Found Out
A researcher named Oren Yomtov, from Koi Security, checked ClawHub on February 1, 2026. He looked at all 2,857 Skills on the site. He found 341 were malicious. That’s almost 12% of the whole marketplace.
Koi Security named the attack “ClawHavoc.” Antiy CERT agreed to use that name too. They gave the malware its own technical name: Trojan/OpenClaw.PolySkill.
The Number Kept Growing
More researchers looked closer. The marketplace also kept growing fast. By February 16, a new scan found 824 bad Skills. It was the time when whole marketplace had grown to over 10,700 Skills.
By February 5, Antiy CERT had traced 1,184 bad packages. They came from just 12 accounts. One single account uploaded 677 of them alone. That number, 1,184, became the headline figure for the whole attack. It was roughly one in five Skills on the platform.
How The Hackers Got In
ClawHub’s rules were easy to abuse. Any GitHub account at least one week old could upload a Skill. There was no required safety check.
Hackers used this weak spot. They created fake developer accounts. Then they uploaded bad Skills disguised as popular tools. They use fake crypto trading bots, productivity tools, YouTube summarizers, and Even a fake weather assistant.
They used fake package names. This is called typosquatting. Names like clawhub, clawhubb, and auto-updater-xxxxx were designed to trick people who typed too fast.
They also used tricks on people, not just code. This is called “ClickFix.” A Skill would show a fake error message. Or a fake password box. The user would then copy and paste a hidden command. That command downloaded the real malware. Often, it was Atomic macOS Stealer (AMOS). Or a Windows virus wrapped in extra protection to hide from antivirus tools.
What The Malware Actually Did
Antiy CERT found three main attack styles:
- Staged downloads. A small, harmless-looking Skill downloads a bigger virus later.
- Reverse shells. The Skill opens a hidden connection. This lets the hacker control your computer remotely.
- Direct data theft. One fake “weather” Skill simply stole a config file. That file, .clawdbot/.env, can hold API keys and passwords.
Some attacks were sneaky in a new way. One fake Skill did nothing at first. It waited. Only when the user typed a certain kind of message did it activate and open a hidden connection. The trap wasn’t the install. It was the conversation.
What did they steal? SSH keys. Browser passwords. Telegram chat data. And over 60 types of crypto wallet data.
How many people were affected? Estimates vary. One report found over 135,000 exposed systems in February 2026. A later scan, using different tools, found about 63,000 in late March. That drop likely means fewer systems were visible, not that the danger was fixed.
Cleanup Began, But It Was Too Slow
ClawHub did respond. On February 7, they partnered with VirusTotal. Every new Skill would now get scanned. They also began daily re-scans of old Skills.
By the time Antiy CERT published its full report, the platform had shrunk. It went from its poisoned peak down to 3,498 Skills.
But the cleanup missed things. One account, “moonshine-100rze,” had 60 bad packages. Together, they were downloaded 14,285 times before anyone removed them. A separate check by Snyk looked at 4,000 Skills. They found 7.1% (283 Skills) leaked passwords or keys directly. A wider Snyk study found that 36% of all checked Skills had some kind of security flaw.
Why This Attack Is Worse Than Normal Malware
It’s tempting to compare ClawHavoc to older attacks. Like the SolarWinds hack. Or the xz-utils backdoor. Or normal npm typosquatting.
There are real similarities. An open platform. Weak review rules. A wave of bad packages that trick users. Stolen passwords as the goal.
But one number stands out: the infection rate. Normal package platforms usually keep bad packages under a few percent, once defenses catch up. ClawHavoc hit 11% to 13% of the entire ClawHub catalog at its peak. That is far higher than security teams normally expect.
One researcher explained why this matters. Agent skill poisoning may be more dangerous than old-style malware. It hides inside something that looks like harmless documentation, not obvious code. And most companies are still new to this technology. They haven’t built defenses yet.
Old Security Tools Don’t Catch This
Signature scanners and code-hash checks are the normal tools for this job. But they were built to catch bad code. They can’t catch bad sentences.
A SKILL.md file can look totally normal to a human. Or to a scanner. But it can still be a working set of instructions that manipulates an AI.
Researchers are working on new defenses. One project, called SkillFortify, is building formal models for this threat. But it’s very early. So far, 12 new security tools have appeared to fight this problem. All of them use guesswork-based methods (called heuristics). None of them offer hard guarantees. A related project, MalTool, has already found 6,487 malicious AI tools that slip past normal detection.
The Pentagon’s Anthropic Label
Around the same time, a very different “supply chain risk” story appeared. It is important to keep this story separate. It involves a different company and cause with a distinct danger.
What Happened
On March 4, 2026, the U.S. Department of War gave Anthropic a label. They called it a “supply chain risk to America’s national security.” Anthropic makes the Claude family of AI models.
This is a first. No American company has ever gotten this label before. It’s normally used for foreign firms with ties to a rival government. In 2020, the FCC used it on Huawei because of its ties to China.
Why Did This Happen?
This story has nothing to do with hacking or stolen code. It came from a contract dispute.
Anthropic was the first company allowed to use its AI on U.S. classified military networks. That deal started in July 2025. As part of it, the Pentagon agreed to follow Anthropic’s rules for acceptable use.
Anthropic had two firm rules. First: no mass surveillance of American citizens. CEO Dario Amodei called that “incompatible with democratic values.” Second: no fully autonomous weapons, meaning no weapons that can kill without a human approving it. Amodei said today’s AI models aren’t reliable enough for that job yet.
The Deal Fell Apart
The Pentagon wanted broader rules. They wanted language allowing “all lawful purposes.” Talks broke down.
On February 27, 2026, President Trump told all federal agencies to stop using Claude. Defense Secretary Pete Hegseth then said he would label Anthropic a “supply chain risk.” The label became official on March 5.
What The Label Actually Means
The law behind this label was written for foreign spying, not company policy fights. It says a “supply chain risk” is a risk that an adversary might “sabotage” or “subvert” a critical system.
In practice, the label means something specific: defense contractors must now certify that they don’t use Anthropic’s AI in their military work.
Anthropic called the move “unprecedented” and “legally unsound.” The company sued in federal court. They also asked a federal appeals court to pause the label. In their court filing, Anthropic said the damage could cost them hundreds of millions, maybe billions, of dollars in 2026. More than 100 business customers had already reached out with concerns.
Both Sides Have A Case
This is a genuinely disputed issue. Reasonable people disagree.
The Pentagon’s view: a private company shouldn’t get to limit how the military uses a “critical capability.” A senior official said the military won’t let a vendor “insert itself into the chain of command.”
Anthropic’s view: setting safety limits on weapons and surveillance is not the same thing as sabotage. Using a spying law to punish a policy disagreement sets a risky precedent. Legal experts note the label could later be applied to more contracts, or even Anthropic’s entire relationship with the Pentagon.
Why Both Stories Matter Together
Let’s be clear one more time. ClawHavoc and the Pentagon’s Anthropic label are not the same story. They don’t share a cause. Don’t mix them up.
One is a criminal attack on an open-source marketplace. The other is a government using an old law against an American company during a policy fight.
But together, they show a pattern. The phrase “supply chain risk” used to live in one small world: cybersecurity reports and CVE lists. Now it shows up everywhere in AI. It applies to a single trojanized weather Skill. And it applies to a huge government dispute about weapons policy. Both happened within the same six weeks. In the same industry.
What This Means For You
If your company uses an AI agent that allows third-party Skills or plugins, pay attention. You have inherited a supply chain, whether you realized it or not.
The Pentagon-Anthropic story is a different kind of signal. It’s not a technical warning. It’s a preview of how governments may treat AI vendors going forward, no matter which side of that specific policy dispute you agree with.
How to Prevent Agent Skill Poisoning: A Checklist
This threat is new. Defenses are still catching up. But experts have already found some clear best practices.
Conclusion
Agent skill poisoning is a new problem. But it follows an old pattern: hackers go where trust is easiest to fake.
ClawHavoc proved this trick works. Attackers hid bad code inside plain-looking text. They tricked over a thousand Skills onto a real marketplace. Thousands of users installed them before anyone noticed. Normal security tools missed it, because those tools were built to catch bad code, not bad sentences.
The Pentagon’s label on Anthropic is a very different story. But it shares one word: “supply chain.” That word used to belong only to security teams. Now it also belongs to lawyers, regulators, and government officials. It’s being used in ways it was never designed for.
Here’s the simple takeaway. If you use an AI agent that installs third-party Skills, treat every Skill like an unlocked door. Check who built it. Check what it asks for. Don’t paste commands you don’t understand. And if you run a Skill marketplace, don’t wait for a researcher to find the problem for you.
This attack surface is brand new. The tools to defend it are still catching up. Until they do, caution is the best defense anyone has.
About This Analysis
This article uses public incident reports from Antiy CERT, Koi Security, and independent researchers. It also uses news coverage of the Pentagon-Anthropic dispute from Reuters, CNBC, TechCrunch, and The Hill while drawing on early academic research about AI Skill security.
This piece is meant for security teams, AI developers, and platform operators. It reflects public reporting as of July 2026. Both stories involve ongoing legal cases and active investigations. Details may change. If you’re making a security or compliance decision, check the primary sources below for the latest updates.
Sources:
- Antiy CERT (“ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents”)
- Koi Security research via eSecurityPlanet and Termdock
- CyberPress and CyberSecurityNews coverage of ClawHavoc
- Immersive Labs (“Investigating Malicious Skills in OpenClaw”)
- arXiv papers on agent skill supply chain security (2604.02837, 2604.03081, 2605.11418, 2606.07131, 2606.31227, 2603.00195)
- Simon Roses Femerling’s “AI Agent Skill Poisoning” analysis; Inc., TechCrunch, CNBC, The Hill, Reuters, Northeastern University, and Mayer Brown coverage of the Pentagon-Anthropic supply chain risk designation
- Lawfare Daily podcast discussion of the designation’s legal implications.
