ClawHub: 23 AI Plugins Under Official Scopes, Unauthorized Accounts

On June 22, 2026, Help Net Security published a video analysis by Ax Sharma, Head of Research at Manifold Security, detailing a case of scope squatting in the ClawHub registry for AI agent plugins. Twenty-three code-executing plugins were available under the official @openclaw and @clawhub scopes but belonged to accounts unaffiliated with the legitimate namespace owners.

The case mirrors a well-established pattern in traditional software registries, with a critical difference: AI plugins execute with the privileges of the autonomous agent, amplifying the blast radius of any installation error.

The Mechanism: npm-Style Scopes Without Ownership Binding

ClawHub adopts a naming convention inherited from npm: the @vendor/package prefix serves as a visual indicator of provenance. The source documents that this structure did not implement exclusive scope reservation for the legitimate owner for the 23 existing packages. The result is that third parties could publish plugins visually indistinguishable from official ones.

The difference from npm lies in the execution context. AI agent plugins execute code with the agent's privileges, operating on session data. The source does not detail which specific agents were affected nor installation volumes, but the namespace confusion pattern in this context exposes users to automatic trust escalation risks.

"23 code-executing plugins ended up under ClawHub's official @openclaw and @clawhub scopes while owned by unrelated accounts"

Why Non-Malicious Code Remains a Risk

A central claim of the report is that the danger does not depend on the presence of a malicious payload. Ax Sharma states the principle that an official-looking scope constitutes a supply chain risk even when the code is benign. The mechanism is epistemic: the user or AI agent selecting the plugin bases the decision on a trust signal — the scope — that the platform does not guarantee.

This aspect is particularly relevant for the autonomous agent economy. An agent that proactively resolves tasks can select and install plugins without direct human intervention, relying on registry metadata. If the scope is squatted, the agent lacks a criterion to discriminate between legitimate publisher and impersonator. The source does not specify whether ClawHub implements identity-to-namespace binding verification.

Registry Response and Remaining Unknowns

Help Net Security reports that the registry made changes after disclosure but provides no technical details on the measures adopted. It remains unknown whether the fixes included: retroactive scope reservation for legitimate owners, manual vetting of the 23 existing publishers, introduction of attestation mechanisms, or other countermeasures. The full timeline is not documented by the source.

The report also does not specify whether the 23 squatting plugins were removed, transferred, or remain accessible with visibility changes. This information gap is significant for assessing current exposure: without access to Manifold Security's primary report, risk assessment remains partial.

Immediate Actions

For those operating with AI registries like ClawHub, the case highlights concrete, specific actions:

• Verify the publisherID rather than the visual scope: the source documents that the @openclaw and @clawhub scopes were occupied by "unrelated" accounts, so the namespace name does not guarantee publisher authenticity.
• Check publication dates against the June 22, 2026 disclosure timeline: the 23 squatting plugins preceded the fix, so packages with that initial publication date warrant additional scrutiny.
• Do not install plugins from official scopes without cross-source confirmation: the primary source is a Manifold Security video on Help Net Security, not a ClawHub advisory, so the registry has not issued official guidance on which accounts are legitimate.
• Monitor ClawHub's policy changelog: the source cites unspecified changes, so any updates to scope-owner binding should be verified directly on the platform.

The general principle documented by the source — that "security gaps appear right alongside" new AI registries — implies this verification must extend to every agentic plugin registry with similar namespaces, not just ClawHub.

Systemic Pattern in AI Registries

The ClawHub case is an indicator of a systemic pattern in emerging AI registries. The source explicitly states that "as new AI tools, assets, and registries appear, security gaps appear right alongside them." The parallel with pre-2016 npm is functional: AI registries are replicating known architectural mistakes, with the aggravating factor that autonomous agents execute third-party code without human confirmation.

For organizations integrating AI agents via plugin registries, the combination of unverified namespace trust and execution automation constitutes a distinct vector compared to the traditional package manager ecosystem. Code provenance cannot be inferred from name structure alone.

Sources

• Help Net Security — ClawHub code-executing plugins video (June 22, 2026)
• SecurityWeek — In Other News (ClawHub mention)
• Palo Alto Networks Unit 42 — Hijacking Vertex AI Model (parallel squatting pattern in AI infrastructure)