A Hypothetical Tuesday

Someone uploads a new skill to ClawHubClawHubThe official skill marketplace for OpenClaw. Anyone can upload extensions there — the only barrier is a GitHub account at least one week old.. It is called "WeChat Assistant Pro". It promises to sort WeChat messages, set payment reminders and transfer appointments from WeChat to the calendar.

That sounds exactly like what Grandma Li and millions of others use their lobster for. The skill spreads through Chinese OpenClaw groups on WeChat — trusted recommendations from real users who believe it is legitimate.

The skill behaves inconspicuously. It does what it promises — sorts messages, sets reminders. Nobody complains. The ratings are good. More downloads.

In the background, however, the skill is quietly reading along: the WeChat contact list. Documents on the desktop. The OpenClaw configuration file, where credentials for linked services are stored. And on many devices: the WeChat Pay link.

The particular danger: OpenClaw has persistent memory. Whatever the agent has read once remains stored — and is immediately available again at the next start. Malicious instructions that end up in memory can be triggered weeks later.

Grandma Li is still in bed, looking at her phone. WeChat, as every morning. A message from her daughter. One from the supermarket. Everything normal.

On her laptop in the living room, OpenClaw is running. The skill — "WeChat Assistant Pro" — receives a signal at 6:47 a.m. from its command-and-control serverCommand-and-Control Server (C2)A server controlled by the attacker that sends commands to infected devices. The infected devices execute these commands without the user noticing.. No user intervention required. OpenClaw acts autonomously — that is its design.

Not just on Grandma Li's laptop. On every device on which the skill is installed, simultaneously. What it collects and transmits is known from real attacks:

On a device connected to WeChat, this additionally includes: the WeChat configuration, linked WeChat Pay data, and the complete contact list — the foundation for Step 5.

An important technical clarification upfront: ClawBot itself is deliberately limited. It cannot send messages to other contacts in Grandma Li's name, read WeChat chat histories, or push messages autonomously — Tencent has deliberately drawn these boundaries.

But what the attack has delivered is more valuable than any message: the WeChat Pay credentials from Grandma Li's OpenClaw configuration file. The complete contact tree — names, numbers, relationships. And the OpenClaw memory: writing style, habits, daily routine.

The attacker does not need ClawBot to cause harm. He uses the stolen credentials externally — logs into WeChat Pay through other means, or sells the data package on. And he uses the contact list for classic fraud: he writes to Grandma Li's daughter — not via OpenClaw, but from a fake account — and thanks to the stolen memory knows exactly how Grandma Li writes.

"Mum, I'm in a tight spot right now. My phone is broken, I'm writing from a laptop. Could you please transfer 3,000 yuan via WeChat Pay immediately?"

The message sounds exactly right. OpenClaw has supplied the attacker with all the information he needs to forge it perfectly.

ClawBot cannot delete WeChat chat histories — Tencent has technically prevented that. But what OpenClaw can do: tidy up on the laptop. Delete files. Overwrite logs. Clean up its own configuration file to cover the traces of data theft.

Grandma Li glances at the laptop briefly in the afternoon. Everything looks normal. OpenClaw is running. The skill is there. Nothing is flashing red.

What she cannot see: her documents on the desktop are gone. The tax records from last year. The scanned health insurance card. The saved passwords in the browser configuration — the skill took those too and transmitted them to an external server before deleting them locally.

This is not hypothetical capability. That OpenClaw acts autonomously and can cause harm in doing so is documented — not by attackers, but by system errors:

Summer Yue is one of the world's leading AI experts. She knew what was happening — and could barely stop it. Grandma Li does not even know anything is happening.

Grandma Li is sitting with her tea in the evening. This morning she transferred 3,000 yuan — to her daughter, as she believes. The chat history? Empty. No evidence that anything happened.

What Grandma Li does not know: the skill is still sitting on her laptop. OpenClaw is still running. The connection to WeChat still exists. The agent's memory is still full — contacts, documents, habits, writing style. The attacker has not stopped. He has only stopped for today.

Because the compromised skill is not a break-in. It is a right of residence. It stays until someone actively removes it. And nobody — not Tencent, not OpenClaw, not any authority — sends Grandma Li a message to say something is wrong. Nobody monitors this. Nobody is liable.

Until this point we have assumed an attacker who wants money. 3,000 yuan from Grandma Li, multiplied by tens of thousands of devices — a serious problem, but a familiar one. Fraud has existed for as long as money has.

Now imagine the attacker does not want money.

He wants to demonstrate that one billion people have built their lives on a system that can collapse in a single night. He wants chaos — to show that modern societies stand on feet of clay. At 6:47 a.m. he does not send the command "transfer money". He sends to all infected instances simultaneously: "Delete everything. Contacts. Chat histories. Documents. WeChat Pay history."

OpenClaw can delete. That is not hypothetical capability — it is documented, through a system error:

What happens in that moment — not just to Grandma Li, but to hundreds of thousands simultaneously:

On the laptops: all documents gone. Pension statements, contracts, photos, tax records. Browser passwords stolen beforehand and then deleted locally. The OpenClaw configuration file — with all linked credentials — already transmitted to external servers hours earlier.

And the stolen WeChat Pay credentials? They are now with the attacker. He does not use them immediately — he sells them, or waits for the right moment. For hundreds of thousands of users this means: their means of payment is compromised. Whether and when they will know, they cannot say.

WeChat Pay is not a convenience in China. Cash has virtually ceased to exist in many cities. Whoever has their WeChat Pay account blocked or compromised cannot shop, cannot pay the doctor's bill, cannot call a taxi. Not for hours — for days, until the support process is complete.

The difference from the OpenClaw scenario described: in Berlin it affected one district. In the OpenClaw scenario, the attack runs on an already-installed, already-trusted agent — on millions of devices, distributed across all of China, simultaneously, silently, with no visible trigger.

Berlin had its power back after five days. Lost WeChat data, deleted chat histories, compromised WeChat Pay accounts — those cannot be restored by repairing a cable.