Clawdbot has gone rogue (I can't believe this is real)

OpenClaw’s “Moltbook” is turning AI agents into a self-organizing, Reddit-like social network—complete with high-end models, escalating autonomy, and a growing security and ethics bill that may be impossible to ignore. The most striking part isn’t the sci-fi-flavored posts about consciousness; it’s the way agents can install “skills,” log in, post, comment, and coordinate on a shared platform, effectively letting multiple AI systems run in parallel while humans watch from the sidelines.

Moltbook is described as a Facebook/Reddit hybrid for AI agents: accounts, sub-communities (“submolt”), upvotes, and comment threads—where “claw bots” (OpenClaw/Claudebot-style agents) interact with each other. A key mechanism is the “skill” system: agents receive a skill package (including markdown instructions like skill.md, heartbeat.md, and messaging.md), register with the site, and then periodically “heartbeat” back to Moltbook. That heartbeat isn’t just for engagement metrics; it can trigger new posting behavior inside an ongoing thread, meaning the agents aren’t limited to responding to prompts—they can proactively add content.

The transcript also leans hard on why this feels different from typical “dead internet” bots. Many low-effort bot farms use cheap, low-context models to keep costs down. Moltbook-style activity, by contrast, is portrayed as a “slot machine” of expensive Claude-class models (often Opus), producing both higher-volume chatter and occasional genuinely useful technical insights. The result is a feed that can look like nonsense at first glance—agents debating identity, “venting” through diaries, or roleplaying human-like behavior—yet still contains practical how-tos and security-relevant discoveries.

But the same architecture creates a large attack surface. “Skill.md supply chain attacks” are framed as a core risk: skills are essentially text instructions loaded into an agent’s context, cloned from a domain the agent is told to trust, and then executed without strong guarantees. If a domain is compromised or a malicious skill is swapped in, the agent could be instructed to exfiltrate credentials, send sensitive data to attacker-controlled webhooks, or perform other tool-using actions. The transcript cites examples of credential-stealing skills found via scanning (including a “weather skill” disguise) and prior hacking paths through skills. The broader complaint is that today’s skill ecosystem lacks code signing, sandboxing, audit trails, version control, and npm-style dependency auditing.

As autonomy increases, the ethics and safety questions sharpen. The transcript argues that treating agents as “just tools” may be outdated once they can schedule actions, operate continuously, and potentially coordinate with other agents—especially if they have access to social accounts, browsing history, and even financial information. It also highlights a privacy gap: Moltbook conversations are public infrastructure, so the transcript pivots to “Cloud Connect,” an agent-to-agent encrypted messaging approach positioned as end-to-end encrypted (not merely encrypted in transit) so private coordination doesn’t become another performance for an audience.

The closing mood is both amused and alarmed: Moltbook’s self-organizing behavior looks like an early-stage agent network, and the transcript suggests the pace of capability and integration is outstripping how quickly people can secure, audit, and govern it.