Show HN: From Clawdbot to OpenAI: Dissecting the supply chain that sold out

But the real story isn't the hiring—it's the supply chain decay.

I’ve audited the technical strata of the transition, specifically focusing on:

CVE-2026-25253 (The 1-Click RCE): How missing WebSocket origin validation allowed any website to hijack a local agent and exfiltrate host credentials.

The "ClawdHub" Poisoning: How an unvetted "skills" marketplace became a delivery mechanism for AMOS infostealers while the community was distracted by name changes.

Vibe-Coding vs. Engineering: Why building agents with "root-by-default" and no permission boundaries made this project a lethal liability for the 60k+ developers who starred it.

This post is a forensic look at the "Lethal Trifecta" of agentic AI: Root access, untrusted content exposure, and missing gates.