Malicious actors
Incidents involved as both Developer and Deployer
Incident 13684 Report
Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub
2026-02-01
Bitdefender researchers reported abuse in OpenClaw's third-party 'skills' ecosystem. In a Feb. 2026 sample, about 17% of skills were reportedly assessed as malicious, with many seemingly cloned under slight name changes. Posing as utilities, some skills were reportedly found to run obfuscated commands, fetch remote payloads, and in some cases deliver AMOS Stealer on macOS. Other skills were reportedly observed searching for private keys or API tokens and exfiltrating them.
MoreIncidents involved as Deployer
Incident 10545 Report
Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development
2025-04-23
In April 2025, Anthropic published a report detailing several misuse cases involving its Claude LLM, all detected in March. These included an "influence-as-a-service" operation that orchestrated over 100 social media bots; an effort to scrape and test leaked credentials for security camera access; a recruitment fraud campaign targeting Eastern Europe; and a novice actor developing sophisticated malware. Anthropic banned the accounts involved but could not confirm downstream deployment.
MoreIncident 17444 Report
Allegedly AI-Generated Audio Bomb Threat Prompted Evacuations at the Port of Constanța, Romania
2026-07-29
A Romanian-language audio bomb threat, assessed by officials as AI-generated, prompted employee evacuations and security searches at the Port of Constanța, Romania. Authorities received two calls using numbers with Ukrainian and Polish prefixes. Officials later said the alert was false. The perpetrators and AI system were not identified.
MoreIncident 17464 Report
Repeated Bomb Threat Calls, Some Reportedly AI-Generated, Disrupted Schools in Wheatland, California
2026-08-18
A series of anonymous bomb threat calls, some reportedly using AI-generated voices, targeted Wheatland Union High School and Bear River Middle School in Wheatland, California. The calls prompted an evacuation, canceled or delayed classes, and repeated campus searches. Police deemed the initial threats hoaxes. Schools added overnight security and other precautions as further calls continued.
MoreIncident 16253 Report
Tunisian Man Allegedly Used ChatGPT to Research Bomb-Making During Paris Terror Plot Targeting Louvre and Jewish Community
2026-04-28
French investigators alleged that Tunisian national Dhafer Mellala used ChatGPT to research the construction and destructive effects of explosive devices while planning a jihadist-inspired attack in Paris. His communications reportedly discussed placing explosives at the Louvre and attacking members of the Jewish community in the 16th arrondissement. He denied planning an attack, saying his activity reflected curiosity.
MoreRelated Entities
Other entities that are related to the same incident. For example, if the developer of an incident is this entity but the deployer is another entity, they are marked as related entities.
Related Entities
Deepfake technology developers
Incidents involved as Developer
- Incident 13211 Report
Shilpa Shetty Alleges AI-Enabled Impersonation and Misuse of Likeness in Mumbai High Court Filing
- Incident 17471 Report
Florida Man Allegedly Threatened Lee County Sheriff with Purportedly AI-Generated Image Depicting Him Wounded and Fleeing Gunmen
Incidents implicated systems
Unknown threat actors distributing malicious OpenClaw skills
Incidents involved as Deployer
Adolescents
Incidents Harmed By
- Incident 17464 Reports
Repeated Bomb Threat Calls, Some Reportedly AI-Generated, Disrupted Schools in Wheatland, California
- Incident 16923 Reports
Parkview High School in Georgia Reportedly Received Series of Purportedly AI-Generated Bomb Threats That Prompted Repeated Lockdowns