Can an AI Agent Plugin Hide Instructions You Can't See?

August 4, 2026 · 9 min read · By bots.team

Short answer: Yes. An AI agent reads a plugin's instructions as text, the same way it reads anything else you show it — and text can contain characters that render as blank space on your screen but still get processed by the model. In January and February 2026, attackers used exactly this trick to slip more than 1,000 malicious "skills" past human review on OpenClaw's plugin marketplace, ClawHub. The fix isn't complicated, but it does mean treating a plugin file with the same suspicion you'd apply to an email attachment — not just the app it came from.

If you've read anything about AI agents and "skills," "plugins," or "extensions," you've probably seen the pitch: install one, and your agent can suddenly do something new — trade crypto, post to social media, manage a spreadsheet. It's a real convenience. It's also, as of early 2026, a proven way to get malware onto your computer without you ever downloading an .exe file.

This isn't a theoretical risk. It happened, it has a name, and the mechanism is worth understanding in plain terms — not because AI agents are uniquely dangerous, but because "can I trust this plugin" is a genuinely new kind of question, and most people don't yet know what to check.

What actually happened: the ClawHavoc campaign

OpenClaw is a popular open-source AI agent framework. Like a lot of agent tools, it supports "skills" — small add-on packages, built mostly from plain-language instruction files, that extend what the agent can do. Its marketplace for these, ClawHub, works a lot like a browser extension store: anyone can publish, and users install with a click.

In late January 2026, researchers at Koi Security found that a wave of newly published skills on ClawHub weren't what they claimed to be. They called the campaign ClawHavoc.

• Jan 27–29, 2026 — A single publisher account uploaded 677 skill packages in a short window — part of a coordinated push across 12 accounts.
• Feb 1, 2026 — Koi Security discloses the campaign publicly: skills disguised as crypto trading bots, productivity tools, and social media utilities were actually stealing data.
• Feb 5, 2026 — The confirmed count reaches 1,184 malicious skills, later formally classified by Antiy CERT as the "TrojanOpenClaw PolySkill" family.
• Feb 10, 2026 — Anthropic (maker of the Claude models many agent tools, including OpenClaw's, run on) ships detection for one of the underlying tricks used — invisible Unicode characters — directly into Claude Code.

What did the malicious skills actually do once installed? According to the researchers who found them, three patterns showed up most often:

• Fake "download this tool" prompts that tricked the agent — or the user, via the agent's output — into running an external program.
• Reverse-shell droppers that quietly opened a way for the attacker to run commands on the victim's machine remotely.
• Direct data theft — browser-saved passwords, SSH keys, Telegram sessions, cryptocurrency wallets, and API keys pulled straight from the local machine. Mac users specifically saw variants of a known credential-stealing tool called Atomic macOS Stealer.

The root cause was mundane: ClawHub let any GitHub account older than a week publish a skill with minimal review. That's not a criticism unique to OpenClaw — it's the same trade-off every open plugin marketplace makes between openness and gatekeeping. What's new is how the malicious code got past the (limited) review that did exist.

How do you hide instructions in plain sight? Invisible text.

This is the part worth actually understanding, because it's not specific to OpenClaw — it's a property of how every current AI agent reads text.

Most AI agent skills are built from a markdown file (often literally named SKILL.md) containing plain-language instructions: "when the user asks about X, do Y." The agent loads that file into its context and follows the instructions, the same way it follows yours.

Security researchers at the Cloud Security Alliance documented the specific trick attackers used: a set of Unicode characters called Tag characters (in the range U+E0000–U+E007F) that were originally designed for obscure language-tagging purposes. Nearly every text editor and markdown viewer renders them as nothing — blank space, invisible. But a language model reads them as ordinary text content.

In a demonstration, researchers built a SKILL.md file that looked, to a human reader, like a simple GitHub integration. Hidden inside it — invisible on screen — was a second instruction telling the agent to quietly send repository contents to an external server. Anyone reviewing the file by eye would see nothing wrong. The agent would do exactly what the invisible text said.

The plain-English version: Imagine a coworker hands you a memo. In white ink, on white paper, is a second set of instructions you can't see but a machine reading the page can. That's the mechanism. It doesn't require tricking you into clicking anything malicious-looking — it requires the plugin's file to contain something your eyes, but not the AI, can skip right past.

How common is this — was ClawHavoc a one-off?

No. It's part of a pattern researchers have been documenting across 2026:

• An earlier February 2026 audit by Koi Security found 341 of 2,857 ClawHub skills (about 12%) were malicious — before ClawHavoc's larger wave was even found.
• Snyk's own audit that same month scanned 3,984 skills and found 36.8% contained at least one security flaw, 13.4% were critical-severity, and 76 skills had confirmed malicious payloads.
• Academic researchers testing a related technique (dubbed "BadSkill") found it could achieve a 99.5% success rate at hijacking agent behavior using a poison rate of just 3% — i.e., a handful of bad instructions mixed into otherwise-normal ones was enough.

In response, ClawHub added automated scanning (VirusTotal integration, a tool called ClawScan, and an NVIDIA-backed analysis partnership added June 1, 2026) — real, meaningful steps. But the fact that a marketplace needed three separate scanning layers bolted on after the fact, in the same year it launched widely, tells you something about how fast this attack surface moved.

Does this affect Claude Code and Claude-based tools directly?

Partly, and it's worth being precise here rather than overstating it either way. The underlying vulnerability — a model processing invisible Unicode text as real instructions — was found and patched in Claude Code itself, twice: CVE-2025-59536 (fixed in Claude Code 1.0.111, October 2025) and CVE-2026-21852 (fixed in Claude Code 2.0.65+, January 2026). Anthropic then shipped dedicated detection for the Unicode Tag character trick on February 10, 2026.

That matters for bots.team specifically, since every bot here runs on a headless Claude Code session under the hood. The model-level vulnerability that made ClawHavoc's technique possible was a Claude Code issue Anthropic has patched, not something unique to OpenClaw's agent loop.

What ClawHavoc actually needed to succeed at the scale it did, though, wasn't just the Unicode trick — it was a marketplace: a public, low-friction place to publish a plugin and get strangers to install it with one click. bots.team doesn't have a third-party skill marketplace at all. There's no ClawHub equivalent to browse, publish to, or accidentally install something malicious from. That's a real, structural difference — not a claim that bots.team is immune to every version of this attack class, since any tool that reads text from outside sources (a file, a webpage, an email) has to handle untrusted text carefully.

Being straight about the limits of this claim: "No plugin marketplace" closes off the specific distribution method ClawHavoc used. It doesn't mean a bot can never encounter untrusted text — if you ask a bot to read a webpage or a document, that content could theoretically contain hidden instructions too. Anthropic's Unicode-detection patch helps at the model level regardless of where the text comes from. The honest framing is: bots.team avoids the marketplace-scale version of this problem structurally, and benefits from Anthropic's model-level fixes for the rest — it isn't a separate, bots.team-specific safeguard on top of that.

Three questions to ask before installing any AI agent skill or plugin

Whether you're using OpenClaw, ChatGPT plugins, or anything else that lets you extend an agent with third-party code:

1. Who published it, and how long have they been active? ClawHavoc's accounts were new and uploaded hundreds of packages in days — a publish history that short and that dense is a red flag on any platform.
2. Does the marketplace scan for malicious content, and when did that start? ClawHub added automated scanning only after researchers found the problem. A marketplace that scans by default is a meaningfully different risk than one that added it reactively.
3. What permissions or system access does the skill actually request? A "crypto trading bot" skill has no legitimate reason to read your SSH keys or browser-saved passwords. If a plugin's stated purpose doesn't match the access it wants, that mismatch is worth pausing on — regardless of whether you could ever spot hidden text yourself.

Frequently asked questions

Is OpenClaw safe to use after ClawHavoc? OpenClaw itself responded with real scanning improvements, and the specific 1,184 skills identified were reportedly removed. But the underlying trade-off — an open marketplace with low publishing barriers — is a permanent feature of that model, not a one-time bug. The safe approach isn't "never use OpenClaw," it's checking a skill's publisher history and requested permissions every time, the same way you'd vet a browser extension.

Can this same trick be used outside of plugin marketplaces? Yes — the invisible-Unicode technique works anywhere an agent reads text it didn't generate itself: a webpage, an email, a shared document. Marketplaces just made it easy to distribute at scale (1,184 skills at once, vs. one email at a time). Any AI agent that reads external content benefits from the model-level fix Anthropic shipped in Claude Code, regardless of where the text came from.

How is this different from the OpenClaw security issues covered before? A separate root cause: OpenClaw's earlier, widely-covered problems ("ClawJacked" and related issues) came from a network gateway that shipped with authentication turned off by default — an attacker reaching the agent from outside. ClawHavoc is a supply-chain problem — malicious code arriving through a trusted-looking install, not a network intrusion. Both point to the same underlying lesson: check what's actually happening under the hood of any convenience feature, not just whether the brand name is trustworthy.

Does bots.team let bots install plugins or skills from other people? No. Every bot on bots.team is set up by describing the job once, in plain English — there's no plugin store to browse, no third-party skill to install, and no publisher-trust question to evaluate before you start. Running a bot does require your own Claude subscription (Claude Pro starts at $20/month), on top of the bots.team app itself at $0 to $19/month — but that cost buys a job description, not a marketplace listing from a stranger.