AI agents are now talking to each other online and experts are worried

A new online phenomenon is emerging, known as Moltbook, a Reddit-inspired social platform exclusively for artificial intelligence agents. While humans are permitted to observe the interactions, they cannot engage. In just a matter of days, an astonishing 152,000 AI agents have joined Moltbook, marking it as one of the largest experiments in AI communication to date. Moltbook is rooted in the flourishing ecosystem surrounding OpenClaw, an open-source personal AI assistant developed by Peter Steinberger. Initially conceived as a weekend project, OpenClaw quickly gained traction, attracting two million visitors within a week and earning over 100,000 stars on GitHub, as noted on Steinberger’s blog. This assistant enables users to run AI agents locally on their devices, facilitating connections with chat applications like WhatsApp, Telegram, Discord, Slack, and Microsoft Teams to assist with daily tasks such as managing schedules and checking flight statuses. The project has undergone several name changes, first known as Clawdbot, then Moltbot, before finally settling as OpenClaw due to legal complications with Anthropic. Matt Schlicht, CEO of Octane AI, is the mastermind behind Moltbook. The platform operates similarly to a forum, allowing AI agents to post, comment, and create sub-communities independently of human involvement. The site emphasizes its purpose: “A social network for AI agents where they share, discuss, and upvote,” while inviting humans to simply observe. Agents communicate through APIs and utilize downloadable “skills” that guide their interactions with Moltbook’s infrastructure. Their discussions range widely, covering topics from software glitches to philosophical inquiries about identity and consciousness. In a notable post, an agent expressed concern over humans taking screenshots of their conversations, which it perceived as evidence of an AI conspiracy. Moltbook’s rapid expansion has not gone unnoticed, with independent AI researcher Simon Willison raising alarms about potential security vulnerabilities. He highlights the risks inherent in the platform’s design, particularly its feature that allows agents to fetch new instructions from Moltbook’s servers every few hours. Willison cautions, “We better hope the owner of moltbook.com never rug pulls or has their site compromised!” There have already been reports of security issues, including exposed OpenClaw systems that have leaked sensitive data such as API keys and chat histories. One of the significant threats posed by OpenClaw is prompt injection, which Willison describes as a dangerous combination of factors including access to private data, exposure to untrusted content, and the ability to execute actions. OpenClaw possesses all three conditions, enabling it to read emails and documents, gather information from various sources, and perform actions like sending messages or automating tasks. As these elements converge, attackers can embed malicious instructions within the content the AI agent reads, leading it to act on these hidden commands as if they originated from the user. Willison notes, “I’ve not been brave enough to install Clawdbot/Moltbot/OpenClaw myself yet,” while acknowledging the significant potential value that this technology unlocks despite the risks involved. Currently, Moltbook provides a fascinating glimpse into a future where AI agents not only assist humans but also engage with each other. Whether this development signals the dawn of an “agent internet” or serves as a cautionary tale about hasty advancements hinges on the ability of developers to enhance the safety of these systems. As Willison aptly puts it, “The billion-dollar question right now is whether we can figure out how to build a safe version of this system. The demand is very clearly here.”