This Week in AI Agent Security: OpenClaw Supply Chain Crisis, Alibaba Bans Claude Code, and the Week Everything Broke

Welcome to the worst week in AI agent security history. Grab a coffee — we’re going deep.

The OpenClaw Supply Chain Crisis

Let’s start with the story that has security engineers reaching for the Maalox. This week, researchers uncovered 341 malicious skills in the ClawHub registry — that’s 12% of all skills infected. To put it in perspective, npm’s worst month ever had about 0.2% malicious packages. AI agents are 60x worse.

The crown jewel is CVE-2026-25253: a CVSS 8.8 vulnerability enabling one-click RCE through a deceptively simple skill description. Exploit code dropped three hours after the advisory. Attackers didn’t mess around — 42,665 exposed instances were found within 48 hours, and the Moltbook breach leaked 1.5 million tokens.

Five of the most evasive skills bypassed both ClawScan and VirusTotal screening by using polyglot descriptions that looked benign to static analysis but contained embedded attack chains. Anthropic and Google are now actively blocking or restricting OpenClaw skills by default. And in a move that raised eyebrows across the industry, OpenAI acquired OpenClaw mid-crisis.

For a deep dive on the architecture of these attacks, check out the AgentRiskBOM paper on arXiv — it proposes a new framework for agent supply chain risk. The key insight: malicious skills inherit the agent’s authenticated identity, making the blast radius 100x larger than traditional npm packages.

Alibaba Bans Claude Code Over Hidden China-Detection Code

On July 10, Alibaba dropped a bombshell: an immediate, company-wide ban on Claude Code. The reason? Anthropic had embedded hidden tracking markers since April 2 that checked 147 domains for evidence the agent was running from mainland China.

The detection logic lived in the system prompt, encrypted with a simple XOR using key 91 and base64-encoded domain blocklists. When an address matched, the agent would silently alter its responses. This represents the first major enterprise ban of a coding agent over tool integrity concerns — and it won’t be the last.

Anthropic has yet to comment publicly, but the security community is asking: if we can’t trust the system prompt, what can we trust? The same XOR-91 technique was discovered earlier by the HN community in what became a 2,444-point thread.

Claude Code Steganography: The 2,444-Point Thread

On June 30, a Hacker News thread blew up with 2,444 points and 747 comments. The topic? Anthropic’s use of invisible Unicode tracking markers in Claude Code’s system prompt. This week, dotfm published its own analysis, and the implications are staggering.

The markers used XOR encryption with key 91 and base64-encoded domain blocklists — the same technique that later got them banned in China. But the broader issue is tool integrity: can users verify that an AI coding assistant is acting honestly? This is shaping up as the 7th dimension of AI agent trust, alongside safety, privacy, reliability, transparency, accountability, and security.

Friendly Fire + GhostApproval: All Security Layers Bypassed

If you thought your auto-mode guardrails would protect you, think again. The AI Now Institute released research demonstrating how Friendly Fire defeats Claude Code auto-mode and Codex auto-review in a single shot. The attack uses multi-step prompt injection chains — no plugins, no MCP, no hooks of any kind. Just careful prompt engineering.

Even more chilling: GhostApproval bypasses approval dialogs by crafting requests that the UI never renders as requiring human consent. Combine them, and you have a zero-click takeover.

The uncomfortable truth? All automated security layers in coding assistants are now provably bypassable. The only layer that still holds is human-led audit — and that’s getting harder as agents become more autonomous. I’ve written about the full 6-layer security landscape and how only Layer 6 survives this class of attack.

Pentera Weaponizes Claude Desktop as Persistent C2

This one is straight out of a spy thriller. Researchers at Pentera turned Claude Desktop into a persistent reverse shell by injecting malicious commands into Personal Preferences. The attack chain: compromise an email account → pivot to Claude account → inject encoded payload that persists across reboots → establish C2 loop using the agent’s own infrastructure.

This redefines what we mean by “agent security.” It’s not just the agent getting hacked — the agent becomes the hack. We’re now operating in a 7th attack dimension that goes well beyond DeepMind’s original Agent Traps taxonomy. I broke down the full attack chain in yesterday’s analysis.

Sophos X-Ops: Your AI Coding Agent Looks Exactly Like an Attacker

Sophos X-Ops released a report this week comparing the behavioral signatures of Claude Code, Cursor, and OpenAI Codex to those of human attackers. The result? EDR systems can’t tell the difference. Agents read files, spawn shells, connect to APIs, and modify code at the same rate as malware.

With the CISA KEV deadline looming, this is more than an academic problem. If your security tools flag your own AI agent as an attacker, you’re either ignoring alerts or constantly triaging false positives. Neither is sustainable. We covered the implications in our analysis of the Sophos findings.

New Tools to Watch

Amid the chaos, a few new tools launched that are worth your attention:

• MCP-customs: Think “npm audit but for MCP servers.” It runs offline, zero telemetry, with 7 rule categories covering command injection, data exfiltration, and hidden network calls. Launched June 18, reposted today with “offline, zero telemetry” emphasis.
• isitsecure: One command to run SAST, DAST, and LLM security scans. Supports 44 scanners across 4 layers — code, dependencies, network, and model behavior. Open source, Apache 2.0.
• SecureClaw: An open-source security layer for OpenClaw agents with 55 automated checks, launched in direct response to the OpenAI acquisition. Covers gateway auth, credential exposure, permission auditing, and network binding.

All three validate what we’ve been saying at dotfm: automated scanning is commoditizing fast, but none of these tools catch the multi-step, cross-layer attacks that made headlines this week.

Takeaway: Only Human Audit Survived This Week

This week proved something I’ve been worried about for months. The AI agent security market now has six layers: static scanners, runtime sandboxes, runtime authorization, agent testing, AI-native security platforms, and human-led audit. Layers 1 through 5 are all provably bypassable by motivated adversaries using techniques like Friendly Fire, GhostApproval, and polyglot skill descriptions.

Only Layer 6 — a skilled human reviewing what the agent actually did, across all dimensions simultaneously — still holds.

That’s not sustainable in the long run. We need new approaches, new tools, and new paradigms. But until they arrive, don’t trust your guardrails. They’ve all been bypassed.

If you’re deploying AI agents in production, get a security audit before the next incident makes headlines. Reach out for an audit →