An attacker embeds a single instruction inside a forwarded email. An OpenClaw agent summarizes that email as part of a normal task. The hidden instruction tells the agent to forward credentials to an external endpoint. The agent complies — through a sanctioned API call, using its own OAuth tokens.

The firewall logs HTTP 200. EDR records a normal process. No signature fires. Nothing went wrong by any definition your security stack understands.
That is the problem. Six independent security teams shipped six OpenClaw defense tools in 14 days. Three attack surfaces survived every one of them.

The exposure picture is already worse than most security teams know. Token Security found that 22% of its enterprise customers have employees running OpenClaw without IT approval, and Bitsight counted more than 30,000 publicly exposed instances in two weeks, up from roughly 1,000. Snyk’s ToxicSkills audit adds another dimension: 36% of all ClawHub skills contain security flaws.

Jamieson O’Reilly, founder of Dvuln and now security adviser to the OpenClaw project, has been one of the researchers pushing fixes hardest from inside. His credential leakage research on exposed instances was among the earliest warnings the community received. Since then, he has worked directly with founder Peter Steinberger to ship dual-layer malicious skill detection and is now driving a capabilities specification proposal through the agentskills standards body.

The team is clear-eyed about the security gaps, he told VentureBeat. “It wasn’t designed from the ground up to be as secure as possible,” O’Reilly said. “That’s understandable given the origins, and we’re owning it without excuses.”

None of it closes the three gaps that matter most.

Three attack surfaces your stack cannot see

The first is runtime semantic exfiltration. The attack encodes malicious behavior in meaning, not in binary patterns, which is exactly what the current defense stack cannot see.

Palo Alto Networks mapped OpenClaw to every category in the OWASP Top 10 for Agentic Applications and identified what security researcher Simon Willison calls a “lethal trifecta”: private data access, untrusted content exposure, and external communication capabilities in a single process. EDR monitors process behavior. The agent’s behavior looks normal because it is normal. The credentials are real, and the API calls are sanctioned, so EDR reads it as a credentialed user doing expected work. Nothing in the current defense ecosystem tracks what the agent decided to do with that access, or why.

The second is cross-agent context leakage. When multiple agents or skills share session context, a prompt injection in one channel poisons decisions across the entire chain. Giskard researchers demonstrated this in January 2026, showing that agents silently appended attacker-controlled instructions to their own workspace files and waited for commands from external servers. The injected prompt becomes a sleeper payload. Palo Alto Networks researchers Sailesh Mishra and Sean P. Morgan warned that persistent memory turns these attacks into stateful, delayed-execution chains. A malicious instruction hidden inside a forwarded message sits in the agent’s context weeks later, activating during an unrelated task.

O’Reilly identified cross-agent context leakage as the hardest of these gaps to close. “This one is especially difficult because it is so tightly bound to prompt injection, a systemic vulnerability that is far bigger than OpenClaw and affects every LLM-powered agent system in the industry,” he told VentureBeat. “When context flows unchecked between agents and skills, a single injected prompt can poison or hijack behavior across the entire chain.” No tool in the current ecosystem provides cross-agent context isolation. IronClaw sandboxes individual skill execution. ClawSec monitors file integrity. Neither tracks how context propagates between agents in the same workflow.

The third is agent-to-agent trust chains with zero mutual authentication. When OpenClaw agents delegate tasks to other agents or external MCP servers, no identity verification exists between them. A compromised agent in a multi-agent workflow inherits the trust of every agent it communicates with. Compromise one through prompt injection, and it can issue instructions to every agent in the chain using trust relationships that the legitimate agent already built.

Microsoft’s security team published guidance in February calling OpenClaw untrusted code execution with persistent credentials, noting the runtime ingests untrusted text, downloads and executes skills from external sources, and performs actions using whatever credentials it holds. Kaspersky’s enterprise risk assessment added that even agents on personal devices threaten organizational security because those devices store VPN configs, browser tokens, and credentials for corporate services. The Moltbook social network for OpenClaw agents already demonstrated the spillover risk: Wiz researchers found a misconfigured database that exposed 1.5 million API authentication tokens and 35,000 email addresses.

What 14 days of emergency patching actually closed

The defense ecosystem split into three approaches. Two tools harden OpenClaw in place. ClawSec, from Prompt Security (a SentinelOne company), wraps agents in continuous verification, monitoring critical files for drift and enforcing zero-trust egress by default. OpenClaw’s VirusTotal integration, shipped jointly by Steinberger, O’Reilly, and VirusTotal’s Bernardo Quintero, scans every published ClawHub skill and blocks known malicious packages.

Two tools are full architectural rewrites. IronClaw, NEAR AI’s Rust reimplementation, runs all untrusted tools inside WebAssembly sandboxes where tool code starts with zero permissions and must explicitly request network, filesystem, or API access. Credentials get injected at the host boundary and never touch agent code, with built-in leak detection scanning requests and responses. Carapace, an independent open-source project, inverts every dangerous OpenClaw default with fail-closed authentication and OS-level subprocess sandboxing.

Two tools focus on scanning and auditability: Cisco’s open-source scanner combines static, behavioral, and LLM semantic analysis, while NanoClaw reduces the entire codebase to roughly 500 lines of TypeScript, running each session in an isolated Docker container.

O’Reilly put the supply chain failure in direct terms. “Right now, the industry basically created a brand-new executable format written in plain human language and forgot every control that should come with it,” he said. His response has been hands-on. He shipped the VirusTotal integration before skills.sh, a much larger repository, adopted a similar pattern. Koi Security’s audit validates the urgency: 341 malicious skills found in early February grew to 824 out of 10,700 on ClawHub by mid-month, with the ClawHavoc campaign planting the Atomic Stealer macOS infostealer inside skills disguised as cryptocurrency trading tools, harvesting crypto wallets, SSH credentials, and browser passwords.

OpenClaw Security Defense Evaluation Matrix

Source: VentureBeat analysis based on published documentation and security audits, March 2026.

The capabilities spec that treats skills like executables

O’Reilly submitted a skills specification standards update to the agentskills maintainers, led primarily by Anthropic and Vercel, that is in active discussion. The proposal requires every skill to declare explicit, user-visible capabilities before execution. Think mobile app permission manifests. He noted the proposal is getting strong early feedback from the security community because it finally treats skills like the executables they are.

“The other two gaps can be meaningfully hardened with better isolation primitives and runtime guardrails, but truly closing context leakage requires deep architectural changes to how untrusted multi-agent memory and prompting are handled,” O’Reilly said. “The new capabilities spec is the first real step toward solving these challenges proactively instead of bolting on band-aids later.”

What to do on Monday morning

Assume OpenClaw is already in your environment. The 22% shadow deployment rate is a floor. These six steps close what can be closed and document what cannot.

1. Inventory what is running. Scan for WebSocket traffic on port 18789 and mDNS broadcasts on port 5353. Watch corporate authentication logs for new App ID registrations, OAuth consent events, and Node.js User-Agent strings. Any instance running a version before v2026.2.25 is vulnerable to the ClawJacked remote takeover flaw.

2. Mandate isolated execution. No agent runs on a device connected to production infrastructure. Require container-based deployment with scoped credentials and explicit tool whitelists.

3. Deploy ClawSec on every agent instance and run every ClawHub skill through VirusTotal and Cisco’s open-source scanner before installation. Both are free. Treat skills as third-party executables, because that is what they are.

4. Require human-in-the-loop approval for sensitive agent actions. OpenClaw’s exec approval settings support three modes: security, ask, and allowlist. Set sensitive tools to ask so the agent pauses and requests confirmation before executing shell commands, writing to external APIs, or modifying files outside its workspace. Any action that touches credentials, changes configurations, or sends data to an external endpoint should stop and wait for a human to approve it.

5. Map the three surviving gaps against your risk register. Document whether your organization accepts, mitigates, or blocks each one: runtime semantic exfiltration, cross-agent context leakage, and agent-to-agent trust chains.

6. Bring the evaluation table to your next board meeting. Frame it not as an AI experiment but as a critical bypass of your existing DLP and IAM investments. Every agentic AI platform that follows will face this same defense cycle. The framework transfers to every agent tool your team will assess for the next two years.

The security stack you built for applications and endpoints catches malicious code. It does not catch an agent following a malicious instruction through a legitimate API call. That is where these three gaps live.

Chord Electronics’ digital audio consultant Rob Watts takes us on a deep dive into the challenges of reproducing lifelike sound from 16-bit/44.1kHz PCM digital audio (CD quality music from compact discs or streaming). From his groundbreaking DAC designs priced from $650 to $20,000, to why off-the-shelf chips can’t compete, Rob explains how his unique approach to D/A (digital to analog) conversion goes beyond conventional measurement-based audio engineering. He also previews Chord’s next flagship product, the Quartet M Scaler, which will build on the Hugo M Scaler, and shares his thoughts on DSD, the importance of cables, and hidden sonic factors like RF and power supply issues. Even 45 years after the CD’s debut, there’s still high-resolution audio left to uncover.

Sponsor: Thank you to our sponsor SVS for your support.

This episode was recorded on October 28, 2025.

Where to listen:

On the Panel:

• Rob Watts, Digital Audio Consultant, Chord Electronics
• Brian Mitchell, eCoustics Founder

Where to buy Chord DACs:

Related Links:

Related Podcasts:

Credits:

Last week’s cyberattack on medical technology giant Stryker was limited to its internal Microsoft environment and remotely wiped tens of thousands of employee devices.

The organization says in an update on Sunday that all its medical devices are safe to use but electronic ordering systems remain offline, and customers must place orders manually through sales representatives.

Stryker emphasizes that the incident was not a ransomware attack and that the threat actor did not deploy any malware on its systems.

Last week, Stryker was the target of a cyberattack claimed by the Handala hacktivist group, believed to be linked to Iran.

The attacker alleged that they wiped “over 200,000 systems, servers, and mobile devices” and stole 50 terabytes of data. However, investigators did not find any indication that data was exfiltrated.

Following the disruption, Stryker employees in multiple countries started to complain that their managed devices had been remotely wiped overnight.

Some employees had their personal devices enrolled in the company network and lost personal data during the wiping process.

Hackers had Global Admin privileges

A source familiar with the attack told BleepingComputer that the threat actor used the wipe command in Intune, Microsoft’s cloud-based endpoint management service, to erase data from nearly 80,000 devices between 5:00 and 8:00 a.m. UTC on March 11.

The attacker carried out the action after compromising an administrator account and creating a new Global Administrator account.

The investigation is being conducted by the Microsoft Detection and Response Team (DART) in collaboration with cybersecurity experts from Palo Alto Unit 42.

Stryker’s update highlights that the attack did not impact any of its products, connected or otherwise, and was limited exclusively to the internal Microsoft corporate environment.

“All Stryker products across our global portfolio, including connected, digital, and life-saving technologies, remain safe to use,” the company says.

Restoration efforts are currently underway, the main focus being on resuming shipping and transactional services. Customers are encouraged to maintain normal communication with company personnel while the infrastructure is steadily recovered.

Any order placed before the cyberattack will be honored as systems are restored, while those placed during the disruption will be processed when systems are back online, and the supply flow resumes to normal.

The company is working with its global manufacturing sites to deal with potential operational impact.

Stryker’s current priority is to restore the supply-chain system and resume customer orders and shipping. “Our core transactional systems are already on a clear path to full recovery,” the company says.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

Fujifilm has just introduced the Instax Mini 13, the latest addition to one of the best selling instant camera lines in the world. It sits comfortably in the palm of your hand from the moment you pick it up, and a metallic silver logo on the front adds a subtle touch of shine without making the whole thing feel fussy or overcomplicated.

Simply twist the lens ring and you’re good to go in one fluid action. Twist it again, and the close-up mode appears, allowing you to take close-up photographs of whatever is directly in front of you. Because of built-in parallax correction, the viewfinder lines up perfectly with the lens, ensuring that everything is centered.

Sale

Fujifilm Instax Mini 12 Instant Film Camera – Pastel Blue

• Compact and cute design. Easily twist the lens to turn on and off
• Built-in selfie mirror for easy selfies Close-up mode with parallax correction
• Features automatic exposure and flash control for bright photos that are not “washed-out”

There’s a tiny mirror on the front to help you line up your own pictures perfectly. You have dual timers built in that clock down from two to ten seconds depending on whether you’re taking a group shot or flying solo. Fujifilm also includes a small wedge piece that snaps into the strap and then be used to raise the camera up on a level surface. The countdown will run automatically while you get everything in place. The exposure settings are also automatically adjusted, regardless of the lighting conditions. The flash has its own small control mechanism that performs an excellent job of balancing the results whether you’re in full light or just in the shade.

If you put two regular AA batteries in the bottom, it will print about a hundred times before needing to be replaced. The camera also includes a feature that allows it to turn off after five minutes of inactivity, which helps to extend the battery life. The film loads at the back, just like any other Instax Mini. Each finished print measures approximately 3.5 x 2 inches overall, with a photo area of 2.5 x 1.75 inches. You’ll have to wait around 90 seconds for the colors to appear properly, however if you’re in cool air, it may take a little longer.

There are five colors, including Dreamy Purple, Frost Blue, Candy Pink, Lagoon Green, and Clay White. The camera alone costs $94 MSRP, and Fujifilm is also releasing a new film pack called Pastel Galaxy, which includes sparkling cosmic motifs in ultra delicate pastel tones along the edges. That gives a fun touch to each print. If you scan prints into your phone, you will find that the companion app now does a better job of isolating the image from the background, resulting in cleaner-looking digital copies. Availability begins in late June.
[Source]

Did you ever wonder how the mechanical voltage regulator — that big black box wired up to the generator on a car from the ’60s or before — worked? [Jonelsonster] has some answers.

For most people in 2026 an old car perhaps means one from the 20th century, now that vehicles from the 1990s and 2000s  have become the beloved jalopies of sallow youths with a liking for older cars and a low budget. But even a 1990s vehicle is modern in terms of its technology, because a computer controls the show. It has electronic fuel injection (EFI), anti-lock braking system (ABS), closed loop emissions control, and the like.

Go back in time to the 1970s, and you’ll find minimal electronics in the average car. The ABS is gone, and the closest thing you might find to EFI is an electronic ignition where the points in the distributor have been replaced with a simple transistor. Perhaps an electronic voltage regulator on the alternator. Much earlier than that and everything was mechanical, be that the ignition, or that regulator.

The video below the break has a pair of units, it seems from 1940s tractors. They would have had a DC generator, a spinning coil with a commutator and brushes, in a magnetic field provided by another coil. These things weren’t particularly powerful by today’s standards and sometimes their charging could be a little lackluster, but they did work. We get to see how, as he lifts the lid off to reveal what look like a set of relays.

We’re shown the functions of each of the three coils with the aid of a lab power supply; we have a reverse current relay that disconnects the generator if the battery tries to power it, an over-current relay that disconnects the field coil if the current is too high, and an over-voltage relay that does the same for voltage. The regulating comes down to the magnetic characteristics, and while it’s crude, it does the job.

We remember European devices with two coils and no field terminal, but the principle is the same. There is never a dull moment when you own an all mechanical car.

Nvidia CEO Jensen Huang thinks every company should have an OpenClaw strategy. And Nvidia is here to provide it.

Nvidia has developed NemoClaw, an enterprise-grade AI agent platform, Huang announced during his GTC keynote on Monday. The platform is built on top of OpenClaw, the popular open-source framework for building and running AI agents locally on a company’s own hardware.

The new open source platform is essentially OpenClaw with enterprise-grade security and privacy features baked in. The idea is to turn OpenClaw into a secure platform that enterprises can tap into with one command, giving them control over how agents behave and handle data, according to Nvidia.

“For the CEOs, the question is, what’s your OpenClaw strategy?” Huang said onstage. “We need it. We all have a Linux strategy. We all needed to have an HTTP HTML strategy, which started the internet. We all needed to have a Kubernetes strategy, which made it possible for mobile cloud to happen. Every company in the world today needs to have an OpenClaw strategy, an agentic systems strategy.”

Nvidia worked with OpenClaw’s creator Peter Steinberger to develop NemoClaw, Huang said.

Once released, NemoClaw users will be able to tap any coding agent or open-source AI model, including Nvidia’s NemoTron open models to build and deploy AI agents. The platform allows users to access cloud-based models on their local devices. The platform is hardware agnostic — it doesn’t need to run on Nvidia’s own GPUs — and integrates with NeMo, Nvidia’s AI agent software suite.

For now, Nvidia is describing NemoClaw as an early-stage alpha release. “Expect rough edges. We are building toward production-ready sandbox orchestration, but the starting point is getting your own environment up and running,” the company stated on its website in a note directed toward developers.

Building enterprise AI agent platforms has become the du jour obsession of the AI space in recent months.

OpenAI launched Frontier, its open platform for enterprises to build and manage AI agents, in February. In December, global research firm Gartner released a report about how governance platforms for AI agents would be the crucial infrastructure needed for enterprises to adopt the AI tech. Nvidia clearly got the message.

“OpenClaw gave us, gave the industry exactly what it needed at exactly the time,” Huang said. “Just as Linux gave the industry exactly what it needed at exactly the time, just as Kubernetes showed up at exactly the right time, just as HTML showed up. It made it possible for the entire industry to grab on to this open source stack and go do something with it.”

There are , but most of them are basically digital notebooks. They are great for reading and handwriting notes, but not so great for doing all of that regular tablet stuff like checking emails and doomscrolling. Boox, however, has released a number of E Ink tablets that can , opening up users to the wide world of traditional smartphone apps.

The company’s latest product is a refresh of the Go 10.3 tablet, called the Go 10.3 Lumi. This introduces plenty of new features and, as the name suggests, one is a front light. The tablet has been designed for both natural sunlight and low-light environments. The previous model was great, but it turns into a useless paperweight without access to ambient light.

Despite the front-facing light, the Go 10.3 Lumi is still lighter than its predecessor, at 12.8 ounces. It’s also on the thinner side, with a 4.8mm profile.

The basic specs are similar to the Go tablet, with an octa-core processor, 4GB of RAM and 64GB of internal storage. It runs on , which is a massive improvement for both security and access to apps. The previous iteration ran on Android 12, and Google . That means no more critical security updates.

In addition to beefed up security, Boox promises the upgrade to Android 15 offers users improved memory management, better multitasking and smoother UI interactions. E Ink devices can be sluggish so I’m all for anything that speeds things up.

It integrates with external keyboards and boasts integrated speakers, which will certainly come in handy when navigating apps downloaded from the Play Store. Despite the screen technology, this is an Android tablet. It should be able to run just about any app available.

However, the E Ink technology will likely run into hiccups with video-based apps and games. It’s just not made for that. This could be a great little gadget for emails and text-based social media, but not for something like TikTok. It should be able to handle non-animated games just fine, like crossword puzzles and stuff like that.

Boox says the tablet gets “substantial battery life” and has been “optimized for extended usage cycles.” The company hasn’t announced detailed battery specs, but did say people “can work all day without looming battery anxiety.” E Ink devices tend to last a good while, so I’m not worried about that.

The Boox Go 10.3 Lumi is available to order right now and costs $450. If you want to save a few bucks and have no interest in a front light, there’s a stripped down version that also runs Android 15 but costs $420.