Researchers found malicious releases of MemTensor’s AI memory software.
Source: StepSecurityMemTensor packages were published with hidden malicious software.
SafeDepStarting the plugin or loading the Python library could launch the hidden program.
StepSecurityThe code targeted credentials; the plugin also passed it users’ prompts. Successful theft is unverified.
StepSecurityEditorial analogy: a replacement part arrives with a hidden recording device. The danger is in the equipment added around the assistant, rather than something the assistant has to agree to do.
An analogy for the mechanism; not an additional claim about the incident.Three OpenClaw plugin versions and one MemoryOS version contained malicious code. SafeDep
AI was the target. AI authorship of the malware is unproven.
Published packages are established; downstream infections and successful data theft are not.
Aikido found no public evidence of further repository infections.
Initial account compromise and completed cleanup remain unclear.
Editorial lesson: an AI system inherits the trust placed in its add-ons. Control what software enters the environment and how much access each component receives.
An attacker published altered releases. SafeDep
StepSecurity advised isolating affected machines and revoking accessible digital keys. StepSecurity
Editorial defense mapping for maintainers and organizations using AI software. These are general controls, not proof of missing controls or a prevention guarantee.
Inventory dependencies and inspect changes before adopting releases. Keep testing separate from sensitive work.
A familiar publisher does not guarantee safe contents. Replacing one package does not clean an affected machine.
Separate publishing credentials from routine development and grant each tool only the permissions needed for its job.
Credentials available to legitimate software may also be available to malicious code running beside it.
Prepare to isolate affected computers, preserve evidence and revoke connected credentials together.
An installed package is an investigation lead, not proof of successful theft; establish what ran and what it reached.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 3, 2026 · Editorial methodology · Structured data