Security researchers warn Moltbot, previously Clawdbot, requires a specialist skillset to use safely, as data exposure risks persist even when set up correctly
The massively hyped agentic personal assistant has security experts wondering why anyone would install it
The RegisterConnor Jones
Context & Ripple Effects
Moltbot emerged from coverage of Clawdbot as an open-source personal agent that runs locally and connects to multiple LLMs and messaging services, a design that gives it access to potentially sensitive user workflows. Its rapid visibility was accompanied by a forced rename from Clawdbot to Moltbot, but the naming change does not alter the underlying operating model.
The security warning shifts the discussion from what the agent can automate to who can safely administer its access. Subsequent reporting of malicious OpenClaw extensions impersonating crypto automation tools adds an ecosystem-level route for user data and credentials to be put at risk.
First-order effects
Prospective Moltbot users must treat installation and configuration as a specialist security task rather than a consumer-app setup, limiting safe adoption to people able to assess permissions, integrations, and exposure paths.
The warning raises the operational burden on Moltbot’s creator and community: documentation and defaults become central to whether users can deploy the agent without exposing data.
Second-order effects
Security concerns can slow trust in local agents that connect models with messaging and personal-system access, particularly among users who lack the expertise to validate a configuration.
An extension ecosystem compounds the setup risk: reports of malicious OpenClaw add-ons make provenance and review of third-party tools a separate security requirement from configuring the core agent.
Third-order effects
If personal agents continue to combine broad local access with autonomous actions, security controls, permission boundaries, and vetted extension distribution are likely to become product differentiators rather than optional advanced features.
The pattern points to a split between highly capable self-managed agents and more constrained managed offerings, unless open-source projects can make secure operation dependable for non-specialists.
The trend: Agentic AI is moving the security boundary from the model itself to the permissions, integrations, and software supply chain surrounding autonomous agents.
Whoa. This is truly unbelievable. This white hat is providing over-eager AI builders a much-needed wake up call. Jamieson built a backdoored Claude skill, inflated it to #1 on ClawdHub with 4,000+ fake downloads, then watched devs from all over the world execute what could have
a couple weeks ago I wrote a https://prose.md/ program that spawns an agent swarm to scan your skills directory for vulnerabilities. try it: npx skills add openprose/prose then, in your favorite agent harness: prose run irl-danb/skill-scan
Another great post from @theonejvo « Here's the thing that should concern everyone building in this space: I found all three vulnerabilities in a single week, in a single product, while doing this part-time between other work. The tools we're building are powerful and the pace
Great trilogy of articles on security and clawd-like agents, be careful out there, stay safe before playing too much into your core accounts and secrets
Holy shit. I saw this skill at the top of ClawdHub last night. While some friends were talking about the one right below it on the download count list. And Jamieson just proved it was purposefully malicious to prove the point that these shouldn't be trusted blindly.
Here's even more reports on this disaster of an AI framework — www.intruder.io/blog/clawdbo... www.netskope.com/blog/moltbot... www.token.security/blog/the- cla... [embedded post]
ClawdBot is amazing - it absolutely deserves all the attention it's getting. But, a lot of people are going to get hacked. And that's because way too many people are diving in without thinking about security. Security researchers have already shown how prompt injection can be [im…
As an AI engineer, I spent the last 48 hours neck-deep in Clawdbot's (now Moltbot's) code and deployment patterns While testing common self-hosting setups, I found multiple critical security risks that are easy to hit in real-world use This matters because the project went [image…
The Exposure Crisis Key Stats: - 1,009 Clawdbot gateways exposed on public internet - Hundreds with NO authentication - Discovered immediately via Shodan searches What's at Risk: - API keys fully exposed (Anthropic, OpenAI, Telegram, Slack) - Months of private chat history [image…
The amount of crap I get for putting out a hobby project for free is quite something. People treat this like a multi-million dollar business. Security researchers demanding a bounty. Heck, I can barely buy a Mac Mini from the Sponsors. It's supposed to inspire people. And I'm
oh no - people who are too lazy to think of stuff themselves or do research or learn things are installing an ai chatbot assistant insecurely, giving it access to all their shit, and then leaving that interface publicly exposed? — what a surprise! — https://www.bleepingcomput…
Clawdbot went viral, but I still haven't seen anyone use it for something truly impressive. AI agents are bottlenecked by model capability. Running open-source models on an Apple Mac mini feels private and cool, but you're capped by how good the model is. Even with the best
Cloudflare just made the Mac Mini optional for Moltbot. The whole Moltbot phenomenon ran on a specific setup: buy a Mac Mini, install the agent, expose it through Cloudflare Tunnels. Thousands of developers did exactly this. Apple probably sold more M4 Minis to AI hobbyists than
Moltworker is a middleware Worker and adapted scripts that allows running Moltbot (formerly Clawdbot) on Cloudflare's Sandbox SDK and our Developer Platform APIs. So you can self-host an AI personal assistant — without any new hardware. https://blog.cloudflare.com/ ...