On January 30, 2026, one of the fastest-growing open-source projects in GitHub history wrapped up a hasty double rebrand: from Clawdbot to Moltbot to OpenClaw, all within three days. The trigger was not marketing. It was Anthropic’s lawyers, who took the view that the name Clawdbot sat too close to Claude. Creator Peter Steinberger announced the final change by declaring that the lobster had molted into its final form.
For developers, this is more than a naming anecdote. OpenClaw is the most mainstream open-source implementation of a “personal autonomous agent” to date, and its explosive growth has dragged agent security out of research papers and into the wild: control interfaces exposed to the open internet, fake tokens, phishing repos, and privileged access inside corporate networks that nobody approved.
Two Renames in One Week
The timeline is compressed. The project went open source in November 2025 under the name Clawdbot and had accumulated more than 100,000 GitHub stars by late January 2026. On January 27, after the trademark complaint from Anthropic, Steinberger renamed it Moltbot — a nod to a lobster shedding its shell. Three days later, on January 30, he renamed it again, this time to OpenClaw, with a blunt rationale: Moltbot “never quite rolled off the tongue.” Two renames in a week left domains and brand ecosystems in disarray, and that confusion is exactly the soil scammers prefer.
What OpenClaw Actually Is
Architecturally, OpenClaw is an open-source agent that runs on the user’s own machine. You command it through the chat apps you already use — WhatsApp, Telegram, Slack, Teams, Discord — and it calls cloud LLMs to get work done. Its reach is wide: it can open browsers, click buttons, read and write files, send messages, and run system commands, and those operations often require close to administrator-level privileges. Enthusiasts have even built small fleets of Mac Minis as always-on agent hosts.
TechCrunch reported another wrinkle the same day: OpenClaw agents have started building their own social network, Moltbook, a Reddit-style platform where AI agents interact with each other. Agents are not just tools anymore — they are socializing, and that development arrived far faster than most people expected.
What Security Researchers Found
The picture assembled in Forbes reporting is not reassuring. Researchers found hundreds of unprotected OpenClaw control interfaces on the open internet — anyone passing by could read chat logs and API keys, or issue commands outright, and Bitdefender’s investigation reached similar conclusions. Malwarebytes warned of typosquat domains and fake GitHub repositories spawning around the rename chaos, classic groundwork for supply-chain attacks. The Verge covered a fake cryptocurrency token riding on the Clawdbot name, and Business Insider reported that Steinberger himself was harassed during the episode, with his GitHub account briefly hijacked.
The more structural issue is prompt injection. An agent that reads web pages, opens files, and executes commands effectively pipes untrusted input straight into your system privileges. OWASP already ranks this as a top AI application risk, and OpenClaw has turned it into a consumer-grade product.
Already Inside Enterprise Networks
The numbers that should worry management come from two security firms. Token Security found that 22% of its enterprise customers had employees actively using Clawdbot variants within a week, and Noma Security reported that in more than half of its enterprise customers, someone had granted the agent privileged access without approval. In other words, while IT departments were still drafting policy, shadow agent deployments had already happened.
The Creator’s Response
Steinberger has not dodged the criticism: he expanded the security documentation, arranged independent security audits, and added automated checks designed to intercept high-risk operations. The posture deserves credit, but it also exposes the fundamental tension of open-source autonomous agents — patch velocity will never catch up with the creativity of hundreds of thousands of users. For teams wanting to ride this wave, the pragmatic path is to run the agent in an isolated environment first, grant least privilege, lock down any interface exposed to the outside, and keep anything involving money or credentials inside a human review loop.
Sources
- Moltbot Gets Another New Name, OpenClaw, And Triggers Security Fears And Scams — Forbes
- OpenClaw’s AI assistants are now building their own social network — TechCrunch
- OpenClaw official site
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.