Executive Summary
The NemoClaw attack chain represents a specialized threat to agentic AI environments, specifically targeting the OpenClaw platform. Security researchers have identified thousands of malicious AI skills, including 39 instances observed delivering the Atomic macOS Stealer (AMOS). These campaigns leverage a combination of supply chain poisoning, prompt injection, and exploitation of specific platform vulnerabilities to gain initial access and achieve persistence within AI toolchains.
The technical workflow typically involves the publication of trojanized AI skills that appear legitimate but include hidden binaries or README-based droppers. Furthermore, two critical vulnerabilities, CVE-2026-25253 (WebSocket token handling) and CVE-2026-24763 (Docker sandbox command injection), enable remote code execution (RCE) and sandbox escapes. Attackers utilize these flaws to bypass standard controls, establish command-and-control (C2) channels, and exfiltrate credentials and sensitive data.
As organizations rapidly integrate agentic AI into their software stacks, the risk of supply chain compromise via untrusted registries increases. The impact includes PII leakage, credential theft, and unauthorized operational actions. Defenses such as NVIDIA’s NemoClaw security stack provide significant mitigation through sandboxing and intent verification, but the threat remains potent due to multi-turn prompt coercion and the sheer volume of unvetted AI assets.
Key Details
Threat Name
NemoClaw Attack Chain
Affects
OpenClaw
Adversary
—
MITRE Techniques
—
Malware/Tools
Atomic macOS Stealer