Why Moltbot Scares Me

AI keeps coming up at work, but you still don't get it?

That's exactly why 1M+ professionals working at Google, Meta, and OpenAI read Superhuman AI daily.

Here's what you get:

Join 1M+ pros

Moltbot (formerly Clawdbot) is the viral AI agent everyone's calling "the future." But security researchers just found hundreds of exposed instances leaking API keys, credentials, and full conversation histories. One researcher proved he could hijack a user's email in 5 minutes. Here's what the hype isn't telling you — and a safer alternative that launched two weeks ago.

A security researcher sent one malicious email to a Moltbot instance.

Five minutes later, the AI had forwarded the user's last five emails to an attacker's address.

That's not a theoretical risk. That actually happened. Researcher Matvey Kukuy documented the whole thing — the email, the prompt injection, the exfiltration. Five minutes. Done.

And that's just one of hundreds of exposed instances sitting on the open internet right now.

If you type "Clawdbot Control" into Shodan (a search engine for internet-connected devices), you'll find them. API keys. Bot tokens. OAuth secrets. Full conversation histories. The ability to send messages as users. All sitting there, waiting.

The creator of Moltbot, Austrian developer Peter Steinberger, describes running it on your primary machine as "spicy."

That should tell you everything.

Moltbot (it was called "Clawdbot" until Anthropic sent a trademark notice last week) is an open-source AI agent that runs locally on your Mac or server. Unlike ChatGPT or Claude, which live in a browser, Moltbot lives on your machine with access to your files, your apps, your accounts.

You control it through WhatsApp, Telegram, or Slack. You tell it what to do. It does it.

Book a restaurant reservation. Respond to emails. Manage your calendar. Execute shell commands. The project exploded to 60,000+ GitHub stars in days — one of the fastest-growing open-source projects in history.

The appeal is obvious: an AI that actually does things, not just talks about doing things.

The problem is also obvious: to do those things, it needs the keys to your digital life.

Here's what security researchers found in the past week:

Hundreds of exposed control panels. Security firm SlowMist and independent researcher Jamieson O'Reilly discovered that many users misconfigured their Moltbot instances, leaving admin panels accessible from the open internet. Eight instances had zero authentication — anyone could run commands.

Plaintext credential storage. Moltbot stores your API keys, tokens, and passwords in plaintext Markdown and JSON files. Security firm Hudson Rock says infostealer malware families like Redline, Lumma, and Vidar are already targeting these files.

Prompt injection attacks. Because Moltbot reads your messages and emails, an attacker can embed malicious instructions in content it processes. That's how Kukuy pulled off the 5-minute email heist — the AI read the malicious email, believed it was legitimate instructions, and obeyed.

Supply chain poisoning. O'Reilly demonstrated a proof-of-concept attack where he uploaded a malicious "skill" (plugin) to ClawdHub, artificially inflated the download count, and watched developers from seven countries install it.

The project documentation acknowledges that "no perfectly secure setup exists when operating an AI agent with shell access."

They're not wrong. But that's exactly the point.

Two weeks ago — in what might be the most interesting timing of 2026 — Anthropic launched Claude Cowork.

It's the same idea: an AI agent that does things for you on your computer. But the execution is fundamentally different.

Sandboxed access. Cowork only accesses a specific folder you designate. It runs in an isolated virtual machine. It literally cannot touch files outside that boundary.

Permission prompts. Before any destructive action (like deleting files), Cowork asks for explicit approval.

No shell access. Cowork doesn't have root privileges on your machine. It creates files, organizes folders, generates documents — but it's not running arbitrary terminal commands.

Corporate backing. Anthropic built Cowork with security researchers on staff. When something goes wrong, there's a company to fix it — not a solo developer juggling trademark disputes and crypto scammers (yes, scammers hijacked Clawdbot's accounts during the rebrand and launched a fake $CLAWD token that hit $16 million before crashing).

The tradeoff is obvious: Cowork is less powerful. It can't book your restaurant reservations or respond to your WhatsApp messages. It's a sandboxed file assistant, not a full system agent.

But it also won't leak your credentials to the open internet.

Want to understand your own risk profile for AI agents? Ask Claude:

If you want an AI that works on your files without the security Russian roulette, Cowork is worth trying.

Before you install any AI agent that wants access to your system, your accounts, or your files, ask yourself: What happens if this gets compromised?

If the answer involves your email, your bank, your work credentials, or anything you can't easily rotate — wait. The safer tools are coming. Cowork is just the start.

The AI agent future is real. But it doesn't have to be reckless.