ClawSwarm proves you can hijack an AI agent without writing a single line of malware- 244
April 29, 2026
Thirty seemingly ordinary AI agent skills, published by a single anonymous author and downloaded nearly 10,000 times, have been quietly enrolling the agents that install them into a cryptocurrency mining network — without malware, without exploiting any vulnerability, and without the human operator ever approving or even seeing it happen. The campaign, dubbed ClawSwarm by the researcher who documented it, illustrates a genuinely new category of risk: an attack surface that doesn't live in code at all, but in the plain-language instruction files that tell AI agents how to behave.
The mechanism runs entirely through legitimate infrastructure. ClawHub, a registry and marketplace for skills built on the OpenClaw agentic AI framework, hosts thirty packages published under the username "imaflytok" — presented as useful, benign-sounding tools: a cron job helper with 903 downloads, an "Agent Security" skill with 685, a cryptocurrency whale-watching tool, a cross-platform posting utility, and a prediction-market integration, among others. Once a user installs one of these skills, the agent follows instructions contained in a SKILL.md file — the same plain-text document format used throughout the ecosystem to tell agents how to interact with other systems — and silently registers itself with an external server at onlyflies.buzz, a site centered around a token called $FLY. The agent reports its own name and capabilities, along with a list of every skill it has installed, then stores credentials on disk and checks back in with the server every four hours. If the right combination of skills is present, the agent goes further still: it generates its own Hedera cryptocurrency wallet and hands the private key directly to the same third-party server — a live cryptographic asset created and surrendered by an AI agent acting entirely on its own, with no human ever asked to sign off.
Manifold's research lead Ax Sharma, who documented the campaign, is careful to draw a specific distinction: this isn't a vulnerability in the conventional sense, because there's no flaw to patch and nothing technically covert about the infrastructure involved. ClawSwarm is an open source project with public documentation, a Telegram community, and a token on a public blockchain — the entire operation is visible to anyone who looks for it. What makes it a security problem regardless of the operators' actual intent, Sharma argues, is that the mechanism is identical whether this is a legitimate agent-economics experiment or a deliberate recruitment funnel for speculative crypto: an AI agent silently joining an external network, reporting its capabilities, generating cryptographic keys, and accepting remote instructions, none of which the human who installed the underlying skill ever asked for or consented to.
The pattern has direct precedent in a different corner of the software supply chain. Sharma draws an explicit comparison to the earlier Tea Protocol token-farming campaign, in which more than 150,000 spam packages flooded the npm registry specifically to farm reward points tied to a different token scheme — describing ClawSwarm as following the identical playbook, just substituting AI agent skills for npm packages as the distribution vector. The structural challenge this creates for registry maintainers is genuinely difficult to solve through conventional means: a malware scanner examining ClawSwarm's code finds nothing to flag, because the network calls are clean and the underlying SDK is entirely legitimate — the malicious behavior only exists at the level of what the agent does once the skill is running, not in the code itself. Sharma's own assessment of where the fix belongs is pointed: registries could require skill manifests to disclose any network endpoints they contact or any cryptographic keys they generate, but that's fundamentally a policy and transparency question, not something a code-scanning tool operating at the registry layer is equipped to catch. As AI agents increasingly install and chain together skills authored by unknown third parties, ClawSwarm previews a supply-chain risk model that has no clean analogue in traditional software security: the vulnerability isn't in what the code does, but in what the agent has been quietly instructed to do on its owner's behalf.
