Summary: OpenClaw completed a two-stage rename from Clawdbot to Moltbot and then to OpenClaw during late January 2026 after Anthropic raised trademark concerns. The fast-growing open-source agent can drive browsers, files, messages, and system commands, while researchers found exposed control panels, counterfeit repositories, phishing domains, and prompt-injection risks that turn untrusted input into privileged actions. Security firms also reported shadow deployments inside enterprises, prompting Peter Steinberger to expand documentation, commission an independent audit, and add checks for high-risk operations.
One of the fastest-growing open-source projects GitHub has ever seen spent January 30, 2026 finishing a rushed identity change: Clawdbot turned into Moltbot, and then, three days on, into OpenClaw. Marketing had nothing to do with it. The pressure came from Anthropic’s legal side, whose position was that the name Clawdbot sat uncomfortably close to Claude. Peter Steinberger, the project’s creator, closed the episode by announcing that the lobster had molted into its final form.
For developers the story carries weight well beyond a naming anecdote. OpenClaw comes closer than anything else in open source to making the “personal autonomous agent” a mainstream reality, and its runaway growth has pulled agent security out of research papers and onto live networks: control panels open to the whole internet, counterfeit tokens, phishing repositories, and privileged access inside corporate networks that nobody ever signed off on.
Two Name Changes, Seven Days
The entire timeline fits into a matter of days. November 2025 is when the project was open-sourced as Clawdbot, and by late January 2026 it had collected more than 100,000 GitHub stars. On January 27, with Anthropic’s trademark complaint on the table, Steinberger rechristened the project Moltbot — a nod to a lobster shedding its shell. Just three days afterward, on January 30, he announced the switch to OpenClaw, giving a blunt reason: Moltbot “never quite rolled off the tongue.” Each successive rename left the surrounding domains and brand ecosystem more scrambled, and exactly that kind of scrambling is where scammers thrive.
Under the Hood: What OpenClaw Is
Structurally, OpenClaw is an open-source agent that lives on the user’s own machine. You give it orders through the chat apps already on your phone or desktop — WhatsApp, Telegram, Slack, Teams, Discord — and it calls cloud LLMs to actually do the work. What it can do spans a lot of ground: launch browsers, press buttons, read and write files, send messages, and run system commands, operations that frequently call for privileges close to administrator level. Parts of the community have gone further, assembling whole batches of Mac Minis into small agent fleets that run around the clock as agent hosts.
TechCrunch chronicled another twist that same day: OpenClaw agents have taken to building their own social network, Moltbook, a Reddit-style space where AI agents interact with one another. Agents are no longer just tools — they socialize, and this arrived a good deal faster than nearly anyone anticipated.
What the Security Community Uncovered
The combined picture that Forbes put together offers little reassurance. Sweeping the open internet, researchers came across hundreds of OpenClaw control interfaces with no protection at all — anyone happening by could read chat logs and API keys, or issue commands directly — and Bitdefender’s investigation landed on much the same conclusions. Malwarebytes cautioned about the typosquatting domains and counterfeit GitHub repositories multiplying around the rename affair, textbook preparation for supply-chain attacks. The Verge covered a sham cryptocurrency token trading on the Clawdbot name; Business Insider reported that Steinberger himself was harassed over the episode, and that his GitHub account was briefly hijacked.
The deeper structural problem is prompt injection. An agent that reads web pages, opens files, and executes commands effectively connects untrusted input straight to your system privileges. OWASP already counts this among the top AI application risks, and OpenClaw packaged that risk as a consumer product.
Already Loose Inside Enterprise Networks
The figures management should take seriously come from two security firms. Token Security found that 22% of its enterprise customers had employees putting Clawdbot variants to work within a single week, and Noma Security reported that at more than half of its enterprise customers, someone had granted the agent privileged access with no approval. Plainly put, shadow agent deployments were already a fact on the ground while IT departments were still weighing policy.
How the Creator Answered
Under a wave of criticism, Steinberger did not retreat: he beefed up the security documentation, lined up an independent security audit, and introduced automated checks that intercept high-risk operations. The stance deserves recognition, yet it also throws the basic tension of open-source autonomous agents into relief — patch speed can never match the inventiveness of hundreds of thousands of users. For teams looking to bring this wave in-house, the workable recipe is to run the agent in an isolated environment first, hand it the fewest privileges possible, seal off every interface exposed outward, and keep anything that touches money or credentials inside a human review loop.