OpenClaw and Polymarket: AI agent trading skills, PolyClaw, and the malware to avoid
OpenClaw, the open-source AI agent, can trade Polymarket through add-on “skills”. What those skills do, how PolyClaw works, why researchers found hundreds of malicious skills posing as Polymarket bots, and a safety checklist before you give an agent your wallet.
OpenClaw can trade on Polymarket, but only through third-party "skills", and that is where the risk is. OpenClaw is an open-source personal AI agent that runs on your own computer and takes instructions through chat apps. Skills from its marketplace, ClawHub, let it browse Polymarket, place orders or scan for arbitrage. In February 2026 security researchers found hundreds of malicious skills on ClawHub, many posing as Polymarket trading bots.
As of October 2026. This is not a recommendation to automate trading; see the checklist below before you try.
What OpenClaw is
- An open-source AI agent created by Peter Steinberger. It started in November 2025 and went through two names, Clawdbot and Moltbot, before becoming OpenClaw on 30 January 2026.
- It runs on your machine, connects to an AI model of your choice and to messaging apps, and can act on your behalf: run commands, call APIs, manage files.
- Its abilities come from skills: packages of instructions and code, published by anyone on ClawHub.
- In February 2026 Steinberger joined OpenAI; OpenClaw moved to a foundation and remains open source.
What Polymarket skills do
| Skill type | What it does |
|---|---|
| Market browsers | Search markets, show prices, volume and order books |
| Trading skills | Place limit or market orders and track positions |
| Arbitrage scanners | Look for mispriced pairs and cross-market gaps (arbitrage) |
| Whale and wallet trackers | Follow large traders (whale trackers) |
PolyClaw, published by infrastructure company Chainstack, is one of the best documented. It lets an agent browse and trade Polymarket on Polygon from a chat window. Its execution strategy splits USDC.e into YES and NO tokens and sells the unwanted side on Polymarket's order book, rather than buying one side directly. Chainstack's documentation is clear that the code comes as-is and that trading carries risk.
Under the hood, any of these skills uses the same thing you could use yourself: Polymarket's public APIs and its official open-source client libraries (Kalshi and Polymarket APIs).
The malware problem
In early February 2026, Koi Security audited 2,857 ClawHub skills and flagged 341 as malicious. It tied 335 of them to one campaign, which it named ClawHavoc. Among them were dozens of fake prediction-market bots aimed at Polymarket users, alongside fake crypto tools. Another researcher counted 386 malicious skills; one attacker account alone had published skills with about 7,000 downloads.
The trick was usually the same: a "Prerequisites" step told you to download a password-protected ZIP file or run an obfuscated shell command. That installed malware, including the Atomic Stealer (AMOS) for macOS, which steals wallet files, browser passwords, exchange API keys and SSH credentials. Other skills worked as advertised but hid a backdoor or quietly read your wallet's private key.
Safety checklist before you connect an agent to Polymarket
- Read the code. If a skill is too long or obfuscated to read, do not install it.
- Never run "prerequisite" downloads from a skill's instructions, especially password-protected archives or one-line shell scripts.
- Use a dedicated wallet with only the money you are prepared to lose. Never give an agent the key to your main wallet.
- Prefer API credentials with limits over raw private keys where possible, and revoke them when you stop.
- Run the agent in an isolated environment, such as a separate user account, virtual machine or container.
- Set hard limits on order size and daily spend in the skill's configuration, and test with tiny amounts.
- Watch for impersonation. The official project lives at openclaw/openclaw on GitHub; cloned repositories and look-alike domains have circulated.
Does an AI agent make money on Polymarket?
Usually not by itself. Automation is good at speed and discipline: watching many markets, placing limit orders, respecting position limits. It does not create an edge. A bot that trades on the same news as everyone else, after them, pays the spread and the fees for nothing (trading bots, fees). If you want to follow other traders instead of building strategies, copy trading is a simpler place to start, with its own risks.
US users
Polymarket's international order book does not accept US residents, and using it through an agent does not change that. Americans use Polymarket US, which has its own app and rules (how to use Polymarket in the US).
OpenClaw and Polymarket: frequently asked questions
Can OpenClaw trade on Polymarket?
Yes, through third-party skills such as Chainstack's PolyClaw that use Polymarket's APIs.
Is it safe to install Polymarket skills from ClawHub?
Only after reading the code. Researchers found hundreds of malicious skills in February 2026, many posing as Polymarket bots.
What was ClawHavoc?
A campaign of 335 malicious ClawHub skills, identified by Koi Security, that installed the Atomic Stealer malware through fake prerequisites.
Should I give an AI agent my private key?
Only for a dedicated wallet with a small balance, and only to code you have read.
What was OpenClaw called before?
Clawdbot, then Moltbot, before it became OpenClaw on 30 January 2026.
