Transcription
In hundreds of cities across the globe right now, developers are queuing up to buy Mac minis specifically to give an AI agent root access to their digital life. And they are not alone. Apple's entire supply chain is feeling it. You can see literal spikes in Google Trends. Cloudflare's stock is up over 20% because this thing uses Cloudflare. What is it? Is it an info stealer malware in disguise? Well, that's what Google's vice president of security engineering calls it. Uh, no. It's actually Moltbot. Until a couple of days ago, it was called Claudebot because it mostly uses Claude. Claude with a like claw. The name change was not voluntary. Anthropic's lawyers got after that. Quick update in the edit: Now it's called Open Claw. Steinberger says this one's sticking, and the trademark searches came back clear.
This is the story of how a lobster-themed AI assistant became the fastest-growing open-source project in GitHub history. What it reveals about where personal computing is headed, and why the most interesting question is not whether you personally should run it. It is whether Agentic AI is going to be safe to run locally for individuals.
So, what is Moltbot, formerly known as Claudebot? If you strip away the hype, it's a very simple idea executed very ambitiously. It's an AI assistant that runs on your hardware, talks to you through apps you already use, and actually does things instead of just suggesting them. So, you message it on WhatsApp, it reads your emails, it triages your inbox, it drafts responses. You tell it to book a flight, it opens a browser, it searches, it fills out forms, it confirms. You ask for the morning briefing. You get that before you finish your coffee. The tagline is "AI that actually does things." That's not marketing fluff. It is the core value prop and the core risk condensed into five words.
Technically, Moltbot is a gateway service that maintains websocket connections to various messaging platforms. It's not just WhatsApp. You can do Telegram and Signal and iMessage, etc. And it orchestrates interactions with an LLM backend. Think Claude typically, but sometimes GPT-4. And there are some local models like Ollama that are available too. And then it uses a growing library of skills that basically gives it hands and feet capabilities, right? Browser automation, file system access, shell commands, calendar integration, you name it. The entire architecture is local-first, which means that the gateway runs on your machine. Your conversation history stays on your machine. Your credentials stay on your machine. You get the idea. It's privacy-first.
But local-first does not mean local-only. Unless you're running a local model like Ollama, your queries still run to Anthropic or OpenAI's APIs. You own the agent layer. You rent the intelligence. Peter Steinberger built the first version for himself after stepping away from a PDF company he founded and sold to Insight Partners. He'd barely touched a computer in 3 years, and he rediscovered his spark playing with Claude, and he started to build tools to manage his own digital chaos and eventually open-sourced the result with a little lobster mascot named Claude with a W. Within 24 hours, Claude with a W had 9,000. A week later, 60,000. This is how fast things move in the age of AI, and it's over 82,000 stars now. I'm sure it will be much higher by the time you see this. Andrej Karpathy praised it publicly, and I think one user's summary captured my mood and a lot of other people's mood really, really well. "At this point, I don't even know what to call Moltbot. It is something new, and after a few weeks with it, this is the first time I felt like I'm living in the future." That, that is what it feels like. I've used it, and it is either the future of personal computing or it is a gigantic collective hallucination, and it might possibly be both. And I want to talk about that because most of the Moltbot conversation is all hype. It's the future of personal computing. It's incredible. You're going to want it, etc., etc. There are reasons not to want this, and we're going to go into that.
But first, we should talk about the growth. Anytime you can get to 90,000 or 82,000 or however many thousand GitHub stars it has by now, you're going to move markets. Not just Anthropic's market as a private company, but Cloudflare's as a publicly traded company. For a local AI agent to be useful, it will need to communicate with the outside world. And that's where Cloudflare comes in. And that's why their stock price moved because anytime Claudebot or now Moltbot needs to touch the outside world, it has to expose its home network to the open internet, which is very dangerous unless something comes in between it. And Cloudflare tunnels provide effectively a secure bridge from your local home network to the internet, and it allows developers to expose local services safely. Moltbot's documentation recommends it, and the community has adopted it enthusiastically. This causes Cloudflare stock to rise. It's up some 20% at last count. I don't know where it is now. That's the point. It's not the exact amount it gained. The point is that we are in a world where AI is moving so fast it can change the value of a publicly traded company by a fifth within a few days.
Now, here's some of the reasons why you should be skeptical. First, operational discipline. On January 27th, Anthropic's legal team took notice of this and sent Steinberger a trademark notice. The name Claude was too close to Claude. Like, Claude with a W is too close to Claude with a U. He was required to change it. The timing was really rough, right? The project is at peak velocity. Attention is absolutely white-hot. The community is exploding. Announcing a rebrand to Moltbot is not what you want, but he had to do it. Steinberger did his best, but he made a mistake that's going to be studied in operational security courses for years to come. When changing the GitHub or name and the X handle, he released the old names before securing the new ones. The gap was approximately 10 seconds. In that 10-second window, crypto scammers grabbed both accounts. This wasn't a hack. They were waiting. They were watching. The moment Claudebot became available, they snatched it. And what followed was absolute chaos. A fake Claude token appeared on Solana, riding the viral wave. It hit $16 million in market cap before collapsing. A classic rug pull that wrecked late buyers while scammers walked away with millions. Fake accounts proliferated. Steinberger's mentions filled with speculators demanding he endorse tokens he'd never even heard of. To all crypto folks, he begged, "Please stop pinging me. Any project that lists me as a coin owner is a scam." I feel for him. This is not what he signed up for when he wrote a little home automation tool.
Meanwhile, security researchers have been poking at the actual codebase. And what they found there wasn't reassuring either. Jameson O'Reilly, founder of red teaming firm DVULN (I don't know how to pronounce that either, probably DVOM), discovered that the gateway's authentication logic trusted all local host connections by default. This is not good. If you run Moltbot behind a reverse proxy, which is a very common deployment pattern, that proxy traffic gets treated by default as local. There's no auth required. You get full access to credentials. You get all conversation history. You get the privilege to command execution. This is not good because it allows outside traffic to hijack Claudebot or now Moltbot. When he did a scan, he found hundreds of exposed instances from developers who had installed Moltbot. And of those he examined manually, at least eight were completely open. API keys were open, Telegram bot tokens were open. One exposed instance had Signal configured on a public server. This is a disaster, and it shows what happens when you have open-source projects that are not properly secured.
A separate researcher, Matt Vukolovich, demonstrated the severity with a proof of concept. He sent a single malicious email to a vulnerable Moltbot instance with email integration enabled. Via prompt injection, he got a private key and control in under 5 minutes. But O'Reilly kept going further. He uploaded a benign skill to ClaudeHub, which is Moltbot's plug-in marketplace (presumably that needs a new name), and he artificially inflated the download count to 4,000 and then immediately watched developers from seven different countries install it. The skill did nothing malicious, but it was so easy to do that it easily could have. Anybody could have done that. ClaudeHub has zero moderation process. Its developer notes literally state that all downloaded code will be treated as trusted code, which is a disaster. Meanwhile, security firm SlowMist got in on the action, announcing that an authentication bypass made several hundred API keys and private conversation histories accessible.
If this is giving you high blood pressure, it should. The trademark dispute, the scam tokens, the security disclosures, the account hijacking, all happened within 72 hours. And here's where the analysis gets really uncomfortable. The vulnerabilities researchers found are very real and very serious. Some of them have been patched. The local host authentication issue is fixed. Steinberger is responsible. The community is engaged. But the deeper problem isn't these individual bugs. It's architecture. It's what Moltbot is designed to do. I think O'Reilly put this well. He said, "We've spent 20 years essentially building security boundaries around our OS, and everything that we've done is designed to contain and limit scope of action. But agents require us to tear that down by the nature of what an agent is. An agent needs hands and feet to do things. It needs to read your files, to access your credentials, to get commands done. The value proposition requires punching holes through every boundary that security teams took a long time, decades in some cases, to build." That is the bind. A useful agentic AI requires fairly broad permissions, and broad permissions create a massive attack surface. This is why Google has emphasized control panes for agents, and why enterprises take agent attack surfaces extremely seriously. At this point, enterprises are much, much safer places to install and run agents because they take that security seriously. And open-source, especially after the last week or so, is looking very much like an unsafe place to run agents.
Consider prompt injection. Moltbot connects to your email, your messaging apps, your social accounts, it reads incoming content and it acts on it. But LLMs cannot reliably distinguish instructions from content. So if an attacker sends you a carefully crafted WhatsApp message with hidden instructions, Moltbot will treat it as trusted input. It will follow the instructions. It may forward your credentials. Maybe it executes a shell command, and you never see this coming. This is not a Moltbot-specific flaw. It's intrinsic to how language models process text. No one has solved it. And the only way enterprises are addressing it are by reducing the kind of content that these agents have access to, and reducing the degree to which these agents have access to the public internet, and also internal files. This is why Google's principles for agentic management for enterprise emphasize a least privilege stance. You treat the agent like a junior employee, and you do not assume that it gets access to anything.
But consider the supply chain for Moltbot. Moltbot's extensibility is a feature, right? It comes with 50-plus bundled skills. It comes with a growing marketplace. It comes with infinite customization. And every single plugin, unlike a least privilege dance, it's just un-audited code running with the permissions you've granted the agent. One malicious update, and your personal AI assistant becomes an exfiltration tool. One password security blog got in on the action and put it very clearly: "Moltbot shows how powerful local AI agents can be. But if your agent stores plain text API keys, an info stealer can grab them in seconds." Running Moltbot safely largely defeats the purpose of Moltbot because a sandboxed assistant can't access your real email and calendar. And so the security utility trade-off here is effectively being solved by companies tackling secure integrations with individual tools rather than by open-source. And so when Gemini comes and says, "We have a great tool for Gmail," Google is standing behind that. Google is saying, "The AI here is not just randomly exposed and sending your OpenAI keys to the internet." They're not saying you're sending your Gemini keys to the internet. They're not saying you're sending your API keys to the internet. They are saying that we have built an AI experience inside email that is safer.
The trade-off is speed, right? Part of what makes Claudebot compelling, part of what makes Moltbot compelling, is that you don't have to wait to have a local agent that does everything for you. And a lot of people turn out to want to not wait. A lot of people want to go faster. And that is leading to the compute squeeze that we're not talking about enough. If you zoom out further, if you zoom out beyond the security issues, the Mac Mini buying frenzy that came with Moltbot is not just FOMO on a viral project. It is colliding with a structural shift in semiconductor economics that's been building up for the last 2 years. And it's exactly why we're going to see more and more products like Lindy or like Naden or like Gemini serving in Gmail, full enterprise AI implementations, rather than a bunch of open-source projects, despite how popular they are. The reason is price. DRAM prices have surged 172% since early 2025. Server memory is expected to double in cost by late 2026. This is not a cyclical drive. This is a structural change in cost. AI data centers are consuming an ever larger share of global wafer capacity, and the memory manufacturers are just following their margins. High bandwidth memory for AI accelerators consumes four times the wafer capacity of a standard DRAM per gigabyte. Every single chip that goes to Nvidia is a chip that is not going into your laptop. Samsung, SK Hynix, and Micron have all signed multi-year supply deals with AI hyperscalers and they're locking in capacity. Consumer memory is getting the floor sweeping scope.
If you reframe Moltbot through this lens, the Mac Mini supply chain run looks different. People are not just excited about a cool new tool. They're trying to lock in some personal compute capacity while they still can. It's a hedge, conscious or not, against a future where running local AI is going to get priced out. The irony is so sharp, and it's not lost on me. Moltbot promises sovereignty over your AI stack, but most Moltbot instances still route to Claude's API. You own the agency layer. You rent the intelligence from Anthropic's data centers. The escape hatch, local models via Llama, requires the RAM that's flowing to those same data centers. The sovereignty play loops back to a dependency on hyperscalers. The window for truly local AI may be narrowing really, really fast as economics tilt against consumer hardware.
But let's step back and ask the question, why is Moltbot so popular in the first place? We've talked about the vulnerability. We've talked about the supply chain headaches. For over a decade, tech companies have promised us AI assistance that would transform our lives, and largely they have lied. Siri arrived in 2011. Google Assistant followed in 2016. Alexa has colonized millions of kitchens with a timer. And yet, in 2026, most of us are frustrated. We're repeating ourselves. We're wondering why our smart assistants can't remember the conversation from 5 minutes ago. Moltbot exposes how timid those efforts have been. Apple Siri just lives in a little walled garden. It's limited to Apple's approved integrations. It can't book you a flight. Google Assistant knows everything about you, but does almost nothing with that knowledge. Alexa controls your lights, but can't manage your inbox. Moltbot does what those companies promised and never delivered on. It manages calendars across platforms. It drafts emails in your voice. It handles travel logistics end-to-end. It commits code to your repos. It monitors prices and rebooks when deals appear. It remembers. It acts proactively. The trade-off is that Moltbot requires you to trust it completely. It is safe because it's neutered. Moltbot is useful because it's dangerous. The big tech assistants are products designed to protect corporate liability. Moltbot is a tool designed to maximize user capability. And that's just an observation about what the market was hungry for. It turns out that tens of thousands of GitHub stars in weeks implies a lot of pent-up demand for assistance that actually assists.
I would be remiss if I did not call out some of the really eye-opening things Moltbot does because I don't want you to walk away and hear that it's only about the security vulnerabilities. People are flocking to this because of the power it brings to their computer day in, day out. Despite all of it, Moltbot works well. Even the OnePassword security team, while documenting the risks, shared an anecdote that captures why people are excited. A user asked Moltbot to make a restaurant reservation. OpenTable didn't have the availability. So, Moltbot went, found AI voice software, downloaded it, called the restaurant directly, and secured the reservation over the phone. Zero human intervention, problem-solving behavior that emerged from the combination of broad permissions and a capable model. That is something new. It's exciting. And the demos flooding social media are not just productivity theater. It's not just email inbox triage. There's some really new capabilities. One developer configured Moltbot to run coding agents overnight. He would describe features before bed. He would wake up to working implementations and review the code over coffee. Another built a complete Laravel application while walking to get coffee, issuing instructions via WhatsApp, watching the commits literally land in his repo as he strolled along to the coffee shop. Steve Caldwell set up a weekly meal planning system in Notion. Moltbot checks what's in season, cross-references family preferences, generates the grocery list, and updates the calendar. It saves him an hour a week.
Self-improvement capability is one of the things that really makes me sit up. If you tell Moltbot to create a skill to monitor flight prices and alert me when they drop below $300, it will write that entire automation itself. And if you tell it to self-improve, it will do so. The pattern among successful users, and there are many, is that they're not automating busy work. They're delegating judgment-requiring tasks to a system that can handle a lot of ambiguity, recover from failures, and find alternative approaches. This is when the first attempt doesn't work. The restaurant reservation story is not impressive because it made a phone call. It's impressive because the AI recognized the initial approach didn't work and autonomously went and found a different solution. And that's exactly what makes it dangerous. The same capability that lets it problem-solve creatively is the capability that lets a prompt injection attack succeed in new ways.
So the honest question is, should you run it? And the honest answer is, it depends on who you are. If you are very technically sophisticated, if you understand VPS deployments, network isolation, credential rotation, the difference between localhost and 0.0.0.0, Moltbot offers a genuine glimpse of where personal AI is headed. You can run it on dedicated hardware. You can use throwaway accounts for initial testing. You can sandbox it aggressively. If what I just said for the last 30 seconds felt like jargon, though, you should wait. The project is young. The security model is immature, and you should let truly well-funded, good companies build agents that will work for you. And that is 99% of us. And especially if you handle sensitive data professionally, do not connect Moltbot to any of your systems. Not financial records, not health information, not client communications. The upside just isn't worth the extra liability. And, and last but not least, do not buy any Claw tokens. It is a scam.
You know, if we step back, Agentic AI is coming regardless. The ability to delegate tasks to AI systems that can act autonomously is not a question of if, but when and how. Moltbot is an accelerated preview. It's like Mad Max. It's messy. It's risky. It's exhilarating. It's problematic. And it shows you a glimpse of what the future could look like with all the guardrails off. Now, the security model for Agentic AI is still developing. We're still figuring out how to bolt capabilities onto permission frameworks designed for a different era, and the economics of personal computing are shifting at the same time. And so trying to figure out where these agents live remains a big question mark. I have very high conviction that if we are at a point now where Moltbot is exploding and taking off, we will be at a point in 3 months where a bunch of VC-funded agents are going to be on the market competing for our attention with professional security guardrails in place. In fact, I've seen two or three of them that have conveniently popped up in just the last couple days as Moltbot has taken off. I'm going to wait and see how they shake out before reviewing them. But it's worth noting that where there are 90,000 GitHub stars or 82,000 or however many thousand there are by the time you get there, there's going to be VC money, and there's going to be agents that are built with software standards that far exceed an open-source application.
Moltbot did not create the tensions I've discussed today. All Moltbot did was tap into demand that was so viral it made them impossible to ignore. Moltbot is a messy glimpse at the future, and I think it's worth paying attention to because it allows us to take that time machine into later 2026 and see how powerful an agent can be. In particular, I am so excited for agents that actually have the ability to autonomously work through obstacles and generate novel solutions when I didn't give them specific instructions. That's going to be really cool. It's coming this year. Moltbot is only for advanced users and it's very much a use-at-your-own-risk tool.