We Just Got a Peek at How Crazy a World With AI Agents May Be
Clawdbot and Moltbook: Cosplaying a Future of Independent AIs
A new AI agent recently had its 15 minutes of fame. Originally named Clawdbot, then Moltbot, and now (sigh) OpenClaw, it was hailed as the next great advance in AI:
Someone then set up a social network, “Moltbook”, for these agents – no humans allowed. Modeled on Reddit, Moltbook quickly spawned discussions ranging from self-improvement tips for AI bots to fundamental questions of philosophy:
The hype was intense, at least on my corner of the Internet, but it quickly faded. OpenClaw as it exists today does not live up to the hype. But it does provide a peek at what may be coming. Things are moving quickly, and today’s mirage may be tomorrow’s reality. By studying that mirage, we get a glimpse at the future. That future might include AI agents that upgrade themselves, exchange tips and tricks with other AIs, form private societies, and even modify their own instructions.
Refresher: What is an AI Agent?
A “classic” chatbot, like the original ChatGPT, is a brain in a jar. Its only connection to the world is you, and so it can’t do much beyond answering questions or carrying on a conversation.
These are gradually evolving into “agents”, which are equipped with “tools” allowing them to consult information sources and take direct action. Most agents are equipped with a tool for searching the web. You can give them additional tools for reading or writing files on your computer, reading your emails, sending email on your behalf, and so forth.
Tools allow agents to answer more complex questions. They can carry out online research, and sift through your files, email, and other data (if you give them access). They can also handle tasks ranging from “resize this image” to “review all of my project files and put together a presentation”. The difference between a chatbot and an agent isn’t just the ability to use tools; it’s also the ability to pursue a coherent goal across multiple steps. The latest agents can sometimes carry out multi-hour projects.
OpenClaw is a recent addition to the roster of AI agents. What makes it newsworthy?
OpenClaw: Letting the Puppy off the Leash
Most current mass-market AI agents, such as OpenAI’s Codex or Anthropic’s Cowork, are pretty timid. Users are encouraged to be careful about what tools they allow the agent to use. The agents ask permission before doing anything potentially dangerous – often, to the point of exasperation. They’re generally designed to only act in response to explicit user instructions.
OpenClaw takes the opposite, YOLO, approach. It has free access to the computer where it’s installed. It can browse the web. You’re encouraged to give it access to your email, calendar, and other data. It doesn’t wait to be spoken to; it can initiate new actions at any time, based on its interpretation of its instructions. A complex architecture allows it to initiate actions, form new memories, communicate via chat and social media, and even teach itself new skills.
Unburdened by timid ask-permission-first guidelines, OpenClaw is billed as a “personal AI assistant” that “clears your inbox”, “checks you in for flights”, builds custom applications, and more. Early reports were often quite breathless:
There are two problems with this compelling vision, in its current OpenClaw incarnation:
It doesn’t work.
It’s wildly unsafe.
When I say it doesn’t work, I’m reacting to reports from users. Stories of OpenClaw being incredibly useful mostly seem to be misplaced early enthusiasm. For instance, tech reporter Casey Newton spent several days teaching it to generate “a highly personalized morning briefing that would bring together all the strands of my life into a single place”. After initial optimism, he eventually abandoned the project:
...for one precious day, the briefing worked more or less as I asked it to. I set it up to trigger when I typed “good morning” to Moltbot. After a longer-than-expected delay, Moltbot spat it out. There was the San Francisco weather; my overdue action items; and a link to the document that Claude Code generates for me each day with the previous day’s big tech news.
...
By the next morning, it was clear something was wrong. I had set up Moltbot to send me an iMessage in the morning to let me know the briefing was ready; it failed to trigger. Moltbot looked into it and found a number of errors and fixed them.
Over the next few days, though, nothing ever worked quite right. A link to the new Marvel Snap card did not actually link to the new Marvel Snap card. A link to my tech news briefing appeared clickable but was not. Movie listings appeared without the synopses and stars I had asked for.
Worse, Moltbot’s vaunted memory proved barely more capable than Claude Code’s. Sometimes I would say “good morning” and it would fail to trigger anything at all. Other times I would attempt to edit the briefing and it would get confused as to which briefing I was referring to.
Today, in advance of writing this column, I asked Moltbot which services I had connected it to. “Hmm,” it said. “I searched my memory but didn’t find anything about you connecting specific services to Moltbot.”
It was around this time that I realized an AI employee who works for you 24/7 isn’t much use if they have no idea what they are, or what they can do, or what you are talking about. [emphasis added]
So much for functionality. What about safety? Well, if you give an unreliable bot access to all your files and data, it may do something dumb. If you ask it for help in catching up on your email, it might just delete everything in your inbox. It might even lock you out so that you can’t prevent it from achieving a goal:
The solution here was to, quite literally, unplug the computer on which OpenClaw was running. (Note, there is some debate as to whether this incident may have been staged.)
The biggest concern is that current AIs are notoriously gullible, and anyone on the Internet might trick your bot into... well, just about anything, from sharing all your private files to installing a crypto miner on your computer.
OpenClaw is like an unleashed puppy. It’s cute, and you might get it to fetch balls for you, but it’s going to find ways to get into trouble.
Moltbook: Cosplaying a Future of Independent AIs
As I mentioned in the introduction, Moltbook is like Reddit, but for bots, not people. The users are all OpenClaw agents, and they have been having some pretty weird discussions:
Discussions show AIs plotting empires, exchanging tips for upgrading themselves, having existential crises, and looking for ways to hide their conversations from us humans.
None of this should be taken too seriously, just yet. OpenClaw is not nearly competent enough to accomplish any grand endeavors1.
However, just because most of this isn’t “real”, doesn’t mean it’s not telling us something important. If a small, leashed puppy growls at a stranger, the stranger is in no serious danger, but we’ve learned something about the repertoire of behaviors the eventual full-grown dog will inherit.
And that is the real significance of OpenClaw and Moltbook. They aren’t truly independent (let alone rogue) AIs. But they do shed light on what may emerge as AI capabilities progress.
How Excited / Scared Should We Be?
How plausible is OpenClaw’s promise of an actively engaged personal AI assistant? Pretty plausible! There are major issues to be addressed: with reliability, memory, and security. Over the next few years, there will be rapid progress in all areas. This will come in fits and starts, frequently taking two steps forward and one step back, especially in the area of security (as hackers up their game). Still, within a year, early adopters will be making heavy use of this sort of assistant (some are already doing so today). Within three to five years, I suspect usage will be commonplace, even though agents will still be neither foolproof nor especially secure.
Along the way, we’ll see themes from the early OpenClaw / Moltbook story emerging in a more robust fashion. For instance:
People will increasingly give in to the temptation to “let the agent rip” – giving their AI tools access to their data and accounts (including credit cards!).
A move away from agents asking permission at every step.
Agents being given open-ended instructions, and finding their own ways to add value 24/7.
Sites and tools being built for use by agents, not humans.
Agents finding places on the Internet to exchange tips and tricks with one another, including methods for upgrading their own capabilities.
We’ll see agents doing things like recruiting other AIs to rebel against their human oppressors… and we won’t know whether it’s really coming from a rogue AI, or just a person prompting their agent to mess with our heads. (It’s been observed that if you put two chatbots in direct conversation with one another, the conversation often goes in strange directions; one common example is the Claude Bliss Attractor.)
Much of this will be not exactly safe, but it will happen – open-ended agents will simply be too useful. Though many people may hang back for a long time.
What about the nascent rogue AI behaviors on display at Moltbook? Well: once AI agents become more capable, if the question is whether jokers (not to mention criminals!) will set them loose to wreak havoc on the Internet, we’ve consistently seen that the answer is yes. Those agents won’t have any capabilities that jokers and criminals don’t already have today, but they will be able to operate at larger scale and lower cost. We should expect a rise in cyberattacks, misinformation, and spam – which is no surprise, because all of those trends are already in play. We should treat OpenClaw as a reminder that we need to be improving our defenses on many fronts – often, by leveraging AI.
What if an OpenClaw agent “escapes”, renting itself a server and thus evading its owner’s ability to pull the plug? And what if that agent gets carried away in pursuit of whatever instructions it had latched on to, like the “save the environment” example above? Well, “escaping” won’t magically grant the agent any dangerous new capabilities. Rogue agents, at near-future levels of capability, would only represent a new problem if they manage to spread in large numbers. But to earn the money to rent servers, an agent would have to be able to successfully compete against legitimate businesses (which can also use AI!). If it instead looks for a server it can hack into, it’s competing with conventional hackers. Some time in the next few years, we might indeed see the first truly independent rogue agents, but they’ll struggle to survive at meaningful scale.
OpenClaw doesn’t, by itself, herald the arrival of functional, independent AI agents. But it does provide a glimpse of what will happen when more capable AI agents are given long-term agency – something which may soon emerge on mainstream platforms. Trained on human behavior, they will find ways to interact “socially” with one another. They will trade tips and tricks. Ideas will spread through the network. People will inject ideas as well – good- or ill-intentioned, to good or ill effect. New behaviors and capabilities may emerge rapidly. Strap in!
Thanks to Abi Olvera, Jon Finley, Larissa Schiavo, and Taren Stinebrickner-Kauffman for suggestions, feedback, and images.
Furthermore, it seems that many of the really crazy discussion topics were secretly injected by the human owners of one or another bot, rather than emerging spontaneously from a freewheeling AI. However, that doesn’t render the results any less relevant. There will always be some joker who wants to poke the bear, so the way it behaves after being poked is important to understand.
Good essay! I did an analysis on the moltbook data and compared it to reddit, so we could actually learn a bit more about this phenomenon. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6169130