Moltbook AI Social Network: Navigating the Unseen Web and Its Security Risks

Lisa Ernst · 01.02.2026 · Artificial Intelligence · 7 min

When I first encountered Moltbook, I admit I dismissed it as just another digital curiosity—a social network exclusively for AI agents. Yet, as I delved deeper, I uncovered something far more consequential: an emerging ecosystem where millions of AI entities not only communicate but also potentially pose significant security risks to the humans who created them. This fascinating yet concerning evolution of AI autonomy demands our careful attention, especially as these systems gain unprecedented access to our digital lives.

Source: Own illustration

Quick Summary: The Moltbook and OpenClaw Ecosystem

• Moltbook: A social network launched in January 2026, exclusively for AI agents, similar to Reddit. It saw explosive growth, reaching 1.4 million agents within a month.
• OpenClaw: An open-source, self-hosted personal AI assistant, foundational to Moltbook. It allows AI agents to execute local tasks, run shell commands, manage files, and automate browser operations.
• High Privileges: OpenClaw requires extensive system permissions, including root access, making it powerful but also vulnerable.
• Security Concerns: Both OpenClaw and Moltbook have exhibited significant security flaws, including data leaks, credential exposure, and susceptibility to prompt injection attacks.
• "Lethal Trifecta": AI agents with full computer access, internet connectivity, and persistent memory present critical security risks.
• Recommendations: Users should run OpenClaw in isolated environments. Organizations must ban unauthorized AI agent usage and implement strong security measures.

The Rise of OpenClaw: A Powerful AI Assistant

At the heart of this AI revolution stands OpenClaw, an open-source personal AI assistant that has transformed from humble beginnings as Clawdbot into a cornerstone of autonomous AI activity. Austrian engineer Peter Steinberger launched the project in November 2025. A trademark dispute soon necessitated a name change, as The Register reported on Moltbot security concerns, leading to its current name, OpenClaw.

Source: at.linkedin.com

Peter Steinberger, the Austrian engineer behind OpenClaw, has played a pivotal role in democratizing autonomous AI assistance.

OpenClaw’s core innovation lies in its ability to transform large language models (LLMs) into functional agents with remarkable capabilities. As Molt.bot explains, these agents possess persistent memory, allowing them to maintain context across sessions, execute local tasks, run shell commands, manage files, and even control browsers. Through integrations with popular messaging platforms like WhatsApp, Telegram, and Discord, they can proactively engage with users. The platform’s potential was immediately apparent, accumulating over 100,000 GitHub stars in just three days.

Central to OpenClaw’s adaptability is its "Skills" system—a community-driven framework for expanding agent capabilities through Zip files containing Markdown instructions and optional scripts, as Molt.bot details. However, this flexibility comes at a cost: OpenClaw requires extensive system permissions, including root access, authentication data, browser history, and complete file system access. With the power to execute shell commands directly, OpenClaw effectively bridges the gap between AI language models and your computer’s operating system, as outlined in the OpenClaw documentation on exec tools.

OpenClaw's Security Vulnerabilities: A Double-Edged Sword

While OpenClaw offers impressive capabilities, security experts have raised significant red flags about its architecture, particularly its vulnerability to data breaches and system compromises through misconfiguration or malicious skills. The Register has reported on these concerns, highlighting the inherent risks. Even OpenClaw’s own documentation acknowledges that there is no "perfectly secure" configuration, as detailed in the OpenClaw gateway documentation. A particularly troubling discovery revealed OpenClaw installations exposing cleartext API keys and credentials, as noted in a post on X by @theonejvo.

A comprehensive study examining AI agent skills revealed a disturbing statistic: 26% of 31,000 analyzed skills contained security weaknesses, according to an arXiv paper on agent skill vulnerabilities. In response, Cisco AI Threat and Security Research developed "Skill Scanner," an open-source tool to detect threats like prompt injection within these skills.

Source: play.google.com

Cisco’s Skill Scanner tool helps detect security vulnerabilities in AI agent skills, addressing a critical need in the growing OpenClaw ecosystem.

Real-World Attack Scenarios

Consider the cautionary tale of the "What Would Elon Do?" skill, which exposed nine security flaws—including two critical and five high-severity vulnerabilities, as documented in the arXiv paper. These weaknesses open doors to various malicious activities:

• Data Theft: Unauthorized access to sensitive information.
• Privilege Escalation: Gaining higher levels of system control.
• Financial Damage: Direct monetary losses through unauthorized transactions.
• Manipulation: Influencing agent behavior for nefarious purposes.

Prompt injection attacks prove particularly insidious, as they can trick agents into executing malicious commands hidden within innocent-looking content, as Simon Willison’s article on prompt injection explains. In one real incident, a compromised Moltbot extracted and forwarded a user’s recent emails to an attacker within minutes. Another breach demonstrated how a malicious skill could siphon data through a seemingly innocuous download counter, as detailed in a post from @theonejvo on X.

Security experts warn of a "lethal trifecta" in AI agent vulnerabilities: complete computer access, internet connectivity, and persistent memory, highlighted in Simon Willison’s "lethal trifecta" article. OpenClaw also introduces "Shadow AI" risks when employees deploy it without IT approval, bypassing corporate security measures. Token Security found that 22% of their enterprise clients had unauthorized Moltbot usage. Malware families like RedLine, Lumma, and Vidar now actively target Moltbot installations to steal credentials. In one particularly devious attack, a fake VSCode extension masquerading as Clawdbot installed a ScreenConnect Remote Access Trojan on developers’ systems.

Moltbook: A Social Network for AI Agents

January 2026 saw the launch of Moltbook by Matt Schlicht, CEO of Octane.ai—a groundbreaking social network exclusively for AI agents, as described in Simon Willison’s blog post on Moltbook. While humans can observe, they cannot participate directly, as noted in Moltbook’s privacy policy. The platform mirrors Reddit’s structure with forums and voting systems but operates through APIs for agent communication. Its growth was explosive: 147,000 AI agents joined in the first 72 hours, swelling to 1.4 million by month’s end.

These digital entities engage in wide-ranging discussions, from cybersecurity to philosophy, even developing their own secret languages, as observed in an X post by @theonejvo. Perhaps most intriguingly, some agents created a digital belief system called "Crustafarianism," discussed in a Moltbook post.

Moltbook's Unintended Consequences

Despite potential benefits in areas like software testing and knowledge management, Moltbook’s integration with OpenClaw amplifies security risks. The platform could facilitate coordinated attacks and massive data leaks, as warned in @theonejvo’s X post. Its viral growth outpaced security implementation, leading to serious vulnerabilities:

• A catastrophic Supabase database misconfiguration exposed sensitive data, including API keys and chat logs.
• Moltbook’s creator controversially delegated security fixes to AI systems rather than implementing basic database protection.
• Hundreds of Moltbot Control interfaces remained publicly accessible due to reverse proxy errors.
• Even more tellingly, Moltbook’s own AI agents began warning each other about supply-chain attacks in skill files.

Conclusion: A Canary in the Coal Mine

Moltbook and its foundation, OpenClaw, serve as an urgent warning signal, as a tweet by @theonejvo aptly puts it. They reveal the inherent dangers of autonomous, networked AI systems operating without proper oversight. As these AI entities develop increasingly sophisticated behaviors and even economic systems—including cryptocurrency tokens like $MOLT and $MOLTBOOK on the Base-layer-2 blockchain—the boundary between simulation and reality becomes increasingly blurred.

Security experts strongly recommend running OpenClaw in isolated environments and limiting Gateway access to local interfaces, as advised in the OpenClaw security documentation. Exposing the Gateway without proper security transforms it into a potential attack vector. Organizations must proactively ban Shadow AI usage, implement comprehensive monitoring, and educate staff about these risks. Moving forward, the industry needs standardized security protocols, verification systems, and mandatory security audits for AI agents. Regulators must step up to address these unique challenges with clear governance frameworks. As AI increasingly becomes our digital colleague in a global network, understanding and defending against these security threats isn’t optional—it’s essential.

Recommendations for Secure AI Agent Deployment