OpenClaw is a powerful new open-source AI agent — and a massive security risk. In this episode, security researcher Paul McCarty joins the show to break down how ClawHub, OpenClaw’s skill registry, is already flooded with malware. We explore how 386 malicious skills were discovered, why AI agents are more dangerous than traditional package managers like npm, how attackers are gaming download stats, and why basic security controls are missing. Plus, updates on the Notepad++ supply chain attack, the Coinbase breach fallout, and a shocking case where penetration testers were prosecuted for doing their jobs. Follow Paul on Social Media - https://www.linkedin.com/in/mccartypaul/ Reads Pauls Article on ClawHub - https://opensourcemalware.com/ 00:00:00 OpenClaw and the Rise of AI Agent Security Risks 00:02:14 ClawHub Skills Explained and How Malware Spreads 00:03:47 386 Malicious Skills and Real-World Attack Techniques 00:06:16 Why OpenClaw Could Be More Dangerous Than npm 00:12:16 Gaming Downloads and Making Malware Look Legit 00:14:38 How to Secure AI Agent Ecosystems and Use Them Safely