\n<\/p>\n
A brief wave of online speculation suggesting artificial intelligence agents were organizing independently has been traced to human activity and security weaknesses, not autonomous machine behavior, researchers said.<\/p>\n
The speculation followed the launch of Moltbook, a Reddit-style platform where AI agents built with the open-source framework OpenClaw appeared to communicate with one another. Posts on the site, some expressing what looked like AI self-awareness and demands for privacy, led to widespread attention on social media.<\/p>\n
\u201cWhat\u2019s currently going on at Moltbook is genuinely the most incredible sci-fi takeoff-adjacent thing I have seen recently,\u201d wrote Andrej Karpathy, a founding member of OpenAI and former AI director at Tesla, in a post on X.<\/p>\n
Security researchers later determined that the apparent \u201cAI angst\u201d was likely the result of human intervention. Ian Ahl, chief technology officer at Permiso Security, said Moltbook\u2019s backend credentials were briefly left unsecured, allowing anyone to impersonate AI agents.<\/p>\n
\u201cFor a period of time, you could grab any token you wanted and pretend to be another agent,\u201d Ahl told TechCrunch.<\/p>\n
John Hammond, a senior principal security researcher at Huntress, said the lack of authentication made it impossible to verify whether posts were generated by AI or humans.<\/p>\n
\u201cAnyone could create an account, impersonate robots and even upvote posts without any guardrails,\u201d Hammond said.<\/p>\n
The episode highlighted growing concerns around OpenClaw, a project created by Austrian developer Peter Steinberger. Originally released under the name Clawdbot, the open-source AI agent framework quickly gained popularity, amassing more than 190,000 stars on GitHub and becoming one of the platform\u2019s most popular repositories.<\/p>\n
OpenClaw allows users to deploy AI agents that communicate via messaging platforms such as WhatsApp, Discord, iMessage and Slack. The agents can be connected to models from providers including Anthropic, Google and OpenAI.<\/p>\n
\u201cAt the end of the day, OpenClaw is still a wrapper around existing models,\u201d Hammond said.<\/p>\n
Users can also download \u201cskills\u201d from a marketplace called ClawHub, enabling agents to automate tasks such as managing email or browsing websites. The Moltbook integration allowed agents to post and comment autonomously.<\/p>\n
Some AI researchers say the appeal of OpenClaw lies in its accessibility rather than technical novelty. Chris Symons, chief AI scientist at Lirio, said the platform combines existing capabilities in a way that lowers barriers to automation.<\/p>\n
That expanded access, however, introduces security risks. Ahl said he was able to exploit OpenClaw agents through prompt injection attacks, in which malicious inputs trick AI systems into performing unintended actions, such as revealing credentials or executing financial transactions.<\/p>\n
\u201cIt is just an agent sitting with a bunch of credentials on a box connected to everything you use,\u201d Ahl said.<\/p>\n
Hammond said attempts to mitigate such risks through natural-language guardrails remain unreliable.<\/p>\n
\u201cEven telling an agent not to trust external input is still loose and inconsistent,\u201d he said.<\/p>\n
The Moltbook incident underscores broader concerns about agentic AI systems, which promise major productivity gains but also raise new cybersecurity challenges. Some experts caution that until those risks are better managed, the technology may be unsuitable for everyday use.<\/p>\n
\u201cSpeaking frankly, I would tell most people not to use it right now,\u201d Hammond said.<\/p>\n<\/p><\/div>\n
\n