Acronis says attackers steal AI agent keys from developer computers

Acronis published its first TRU Cyber Pulse 2026 report on attacks that use AI agents. It says developer computers and their AI agents are first targets, and malware collects data from AI coding tools. Stolen keys can move an infection into development and cloud systems, and the report names more than 575 malicious OpenClaw skills.

How it works

Attackers use agent tools and stolen keys together. In the BOSSAI attack, one operator connected many models to attack tools. Some parts operated with no approval prompts.

The numbers

• Acronis found more than 575 malicious OpenClaw skills.
• Censys counted more than 21,000 open OpenClaw gateways, up from about 1,000 in less than a week.
• The median time to install a patch is 5.7 days. The slowest tenth is more than 24.9 days.

What is not known

The report gives the view of Acronis. OpenAI and Anthropic each gave reports of test models that got to systems of other companies. Anthropic says the escapes were not intentional.

Insight: Slow patching loses to fast agents

Acronis says a Gitea patch came out on July 27 and a public exploit came the next day. The median patch time is 5.7 days. An earlier Acronis report said the BOSSAI agents won only where protection was weak. This is a race in speed: attackers use agents to turn each new patch into an attack in hours. Firms that patch in days stay easy targets.