Moltbot Is Now "OpenClaw"—and It’s Creating a Security Firestorm

A conceptual illustration of the OpenClaw AI agent (formerly Moltbot and Clawdbot) reaching out of a chat interface to access a secured safe, highlighting the potential security risks of granting AI deep system permissions.

🔥 Moltbot Is Now "OpenClaw"—and It’s Creating a Security Firestorm

The viral AI agent that promises to control your computer via WhatsApp keeps changing its name, but the security risks are sticking around.

What started as a quiet side project has morphed into one of the wildest experiments in the AI landscape. Originally dubbed Clawdbot (and later Moltbot), the project created by PSPDFKit founder Peter Steinberger has racked up over 100,000 stars on GitHub.

Its hook? It delivers on the promise that most current LLMs can’t touch: Agency.

While ChatGPT talks, OpenClaw acts. It uses a messaging-based interface to execute real commands on your local machine. That capability pushed the project from a cool GitHub repo to a viral phenomenon—and straight into a legal and security minefield.

Following a trademark dispute with AI giant Anthropic earlier this week, Steinberger rebranded the project to Moltbot. Then, late Thursday, he announced yet another pivot: the tool is now OpenClaw. (Steinberger has been contacted for comment, and this story will be updated if he responds).

🤖 The Agentic Shift: Why It’s Different

To understand the hype, you have to look under the hood. Most AI tools live in a browser tab. OpenClaw is an agent. It lives on your hardware and connects to your life via messaging apps like WhatsApp, Telegram, Discord, and Slack.

A simple text like "Check my calendar and reschedule my flight" isn't just a query; it triggers actual code execution. OpenClaw opens browsers, clicks buttons, accesses files, and runs system commands. While it pings cloud models for inference, the execution is local. The pitch is total control and data sovereignty.

🛑 "Sudo" Rights and Mac Mini Farms

For developers, this is the dream. For the average user, it’s a loaded gun.

To function effectively, OpenClaw often requires broad system permissions, sometimes escalating to root or sudo access.

The tool’s efficiency has spawned a cottage industry of "personal AI infrastructure." Social media is flooded with images—both real and AI-generated—of Mac Minis stacked in server racks, running fleets of OpenClaw agents. It’s being sold as the new, cheap, decentralized alternative to Big Tech clouds. But the reality is much messier.

Running middleware locally doesn't eliminate risk; it just shifts the liability to you. Instead of trusting AWS or Azure, you are now the sysadmin responsible for patching, permissions, and network security.

⚠️ Exposed Dashboards and "Sitting Ducks"

The cracks are already showing. Axios reported that hundreds of malicious Moltbot instances were left wide open to the public internet, exposing chat logs, API keys, and even remote command execution capabilities. Bitdefender confirmed similar findings, noting that many user dashboards were leaking credentials simply because they were misconfigured.

🔄 The Rebrand Roulette

Confusion is a scammer’s best friend, and OpenClaw has provided plenty of it.

The rapid-fire name changes—from Clawdbot to Moltbot to OpenClaw—created a vacuum that bad actors rushed to fill. Malwarebytes documented a wave of typosquatting domains and cloned GitHub repos appearing almost instantly after the rebrands. These supply-chain attacks often start with clean code to gain trust before injecting malicious updates later.

• 👾 The Verge noted that scammers even launched a fake crypto token capitalizing on the old "Clawdbot" name.
• 📉 Meanwhile, Business Insider reported that Steinberger himself faced harassment and a temporary GitHub account compromise.

None of this required zero-day exploits; it just required hype and user confusion.

💉 The Prompt Injection Nightmare

Granting an AI agent administrative privileges turns theoretical risks into critical vulnerabilities.

If OpenClaw misinterprets a command—or if an attacker feeds it a "poisoned" document—the agent has the power to act on that bad data. OWASP has already flagged prompt injection as a top-tier threat for LLMs, and Wired has demonstrated how malicious emails or files can trick AI agents into exfiltrating private data.

When that agent has access to your terminal, your email, and your file system, the stakes are significantly higher.

🏢 Shadow AI in the Enterprise

Perhaps most alarming is how fast this is bleeding into the corporate world. Token Security reported that within a single week, 22% of their clients had employees actively using modified versions of the software. Nooma Security found that in over half of their large enterprise clients, users were granting the tool privileged access without IT approval.

This is classic "Shadow IT," supercharged by AI. Security teams didn't deploy this; they inherited the risk.