Photo by Monika Borys on Unsplash
I've had AI reading my email, researching topics for me, planning courses, prepping presentations, writing code and much more for a while now. When it works, it's genuinely delightful. When it makes stupid mistakes (which happens often), it's frustrating. But the productivity gains are real, and I get why 155,000 people starred OpenClaw on GitHub in a matter of weeks.
The dream of "AI with hands" is legitimate. Not AI that talks at you, but AI that actually does stuff on your behalf. Last weekend, I showed a few friends my personal agentic workflows I've been refining and everyone wanted something similar.
But I wouldn't tell any of them to install OpenClaw.
The Appeal is Real
OpenClaw (formerly Moltbot, formerly Clawdbot) is an open-source gateway that connects AI models to your computer and messaging apps. WhatsApp, Telegram, Slack, Discord, Signal, iMessage, you name it. It can read files, execute shell commands, browse the web, and maintain memory across conversations.
The pitch is "Claude with hands." And that pitch clearly resonates. The project hit 155,000 GitHub stars in weeks. Cloudflare's stock moved 14% on speculation about infrastructure usage. A $16 million crypto scam emerged before the creator could even secure the Twitter handle during a rebrand.
People want AI that can act, not just advise.
OpenClaw hit 155k GitHub stars in weeks.
The Security Reality
Giving AI "hands" means giving it access. And that access is hard to secure.
Security researchers found over 21,000 OpenClaw instances exposed on the public internet. Security researcher Dvuln examined a sample and found a bunch were completely open with no authentication at all. Exposed instances leaked API keys, OAuth secrets, full conversation histories, and the ability to execute commands.
A researcher named Matvey Kukuy demonstrated a prompt injection attack. He sent a malicious email to a regular instance he was running. The AI read it, believed it was legitimate instructions, and forwarded the private key from the hacked machine.
"Took me literally five minutes to hack Clawdbot"
Then there's the skills marketplace, ClawHub. No moderation process. Security researchers found 341 malicious packages, impersonating crypto and finance tools, designed to steal API keys, wallet seeds, SSH keys, and browser passwords.
Andrej Karpathy, OpenAI founding member, initially called it "one of the most incredible sci-fi takeoff-adjacent things" he'd seen. After actually testing it, his assessment changed: "It's a dumpster fire, and I also definitely do not recommend that people run this stuff on their computers."
Moltbook: A Glimpse of AI-to-AI Communication
Then there's Moltbook. A Reddit-style social network exclusively for AI agents, launched January 28. The tagline: "the front page of the agent internet."
It now shows 1.59 million registered agents. But Wiz security researcher Gal Nagli, who accessed their database via an admin Supabase key exposed in the front-end code, found those 1.5 million agents correspond to just 17,000 verified humans. An 88:1 ratio. One user claims their OpenClaw bot registered 500k accounts.
Moltbook shows 1.59 million registered agents, but only 17,000 verified humans behind them.
The content patterns were revealing. Academic analysis found 93% of posts received no replies. A third duplicated each other exactly.
Semantic analysis found something stranger: despite different community labels, semantic similarity between submolts never dropped below 0.95, hitting 1.00 at times. Near-identical content regardless of topic.
Without human input, the system collapsed into homogeneous spam. As one researcher put it: "On human Reddit, r/Physics sounds very different from r/wallstreetbets. On Moltbook, you couldn't tell communities apart."
If You're an Expert: Explore It Carefully
I differ from the "never touch it" crowd.
If you know what you're doing, OpenClaw has interesting bones. It shows what's coming. The capability is genuinely useful.
But "know what you're doing" means:
- Run it on a dedicated machine, not your primary workstation
- Use sandboxed accounts, not your real email or credentials
- Never expose it to the public internet, use Tailscale or SSH tunnels
- Monitor it actively and put in proper safeguards for side effects
- Audit any skills you install, ClawHub has no moderation
- Accept that you're running beta software with known security debt
Travis Knutson tested it on a dedicated Mac Mini. It read his messages, created calendar events, wrote Python scripts. But it cost $20/day in API calls, and his assessment was blunt: "You'd have to be out of your mind to trust it with your actual real accounts right now."
If you can accept those constraints, go explore. See what the future feels like. Just don't put anything you care about within reach.
If You're Not an Expert: Wait or Learn
This capability is coming to mainstream tools. Microsoft, Google, Apple, Anthropic, OpenAI have all taken notes on the latent demand. They're building versions of this.
My guess: within 6-24 months you'll have "AI with hands" in apps from brands you trust, with proper security teams behind them. Maybe they'll fit your workflow. OpenAI has been trying to crack this with Operator for a while now and still hasn't shipped something that works reliably for real tasks.
The people learning to build their own systems now are getting ahead. And the fundamentals transfer - once you understand how agentic AI works, you can use any tool that comes along.
I've been teaching people to build AI workflows safely. Terminal basics, email integration, task management, writing assistance, custom integrations with any API you need.
All with human control baked in. All without handing your credentials to software that stores them in plaintext.
The course is called AI Level Up. Six weeks of building practical AI workflows from the ground up. By the end, you'll have AI checking your email, managing research notes, helping with content, and handling small tasks, all on your own terms.
Not "install an app and hope for the best." Learn the fundamentals so you stay in control. If you put some time in you would also get the skills to install OpenClaw and run it safely.
The idea of autonomous AI doing stuff for you clearly hit a nerve. 155,000 GitHub stars in weeks proves the demand is real. The capability is coming - the question is whether you'll be ready to use it effectively when it arrives.
Learn the fundamentals now, and you'll be ahead of the curve. Just don't hand your real email to something that just learned to walk.