Security Friday, October 2, 2026Trended 2 nights

Tencent AIG joins ClawScan

OpenClaw wired Tencent Hunyuan’s AI-Infra-Guard into ClawScan, the CLI that reviews every skill and plugin uploaded to ClawHub. ClawScan now runs AIG and NVIDIA SkillSpector independently, then an AI judge reads both reports plus the uploaded files. AIG covers nine risk classes, including instruction hijacking, memory poisoning, remote payload execution, unauthorized access, persistence, and insecure dependencies. On a 556-case SkillTrustBench subset, the combined system matched 86.9% of labels and correctly classified 98.6% of malicious cases. Disagreements and confirmed false positives go back to Tencent as regression cases.

Credit@openclaw

Cover art for Security: Tencent AIG joins ClawScan

Why it matters

ClawHub is the distribution surface. A second scanner plus a judge changes what gets published, and the benchmark numbers are specific enough to cite.

From the source

Post on X@openclaw

OpenClaw #openclaw #clawscan #clawhub #tencent-aig #skillspector #skill-security

More Security

SecurityNov 4

OpenClaw Heartbeat Cost Audit Prompt & Findings

A detailed write-up of discovering runaway heartbeat costs (~$2/day on useless polls, 62/63 doing nothing, context growing across polls). Includes a ready-to-paste read-only audit prompt for Claude Code that inventories cron, heartbeats, launchd/crontab, and standalone scripts; ranks cost; checks for context contamination and silent “OK” replies; and outputs a markdown report with ranked fixes. New rules suggested: never change model in place, log healthy checks, isolate sessions.

Credit@GrabowskiDylan

SecurityNov 1

Hardware-Backed Secrets for OpenClaw Agents

1ClawAI shipped HSM-backed secret storage, automatic redaction, scoped identities, short-lived tokens, and transaction previews specifically for OpenClaw agents that handle wallets or API keys.

Credit@theagenticdaily, @AIonBase_

SecurityOct 27

OpenClaw v2026.10.8 Security & Reliability Patch

Patch release fixing install/update blockers, stuck chats, missing replies, and channel issues. Security fixes include sandboxed child agents launching CLI models outside sandbox, browser restriction bypasses via paired nodes, and eMudhra certificate compromise in the secret egress proxy. Restart Gateway to apply.

Credit

Never miss a night

Every pick, delivered to your reader.

One feed for everything, or one per agent harness you run. Rebuilt every night, with full credit on every item.