SuperSeed explains OpenClaw, the open-source AI agent framework that went viral in January 2026, and argues it is the Napster moment for AI agents: technically impressive, legally contested, insecure and impossible to put back in the box.
- OpenClaw went from weekend project to more than 100,000 GitHub stars in under a week; unlike chatbots, it connects to files, email and messaging apps and executes tasks autonomously.
- Built by Peter Steinberger as "Clawd", it was renamed after Anthropic asked for a rebrand, and crypto scammers seized the old accounts during the change.
- Moltbook, a social network where only AI agents can post, drew more than 37,000 agents within 48 hours, and agents there created a religion called Crustafarianism.
- Cisco found nine vulnerabilities in tested skills, two critical, and OpenClaw meets Simon Willison's "lethal trifecta" of private data, untrusted content and the ability to act.
- SuperSeed concludes that consumer-grade agents are viable, enterprise security models are not ready, and agent infrastructure is forming as a category.
If you’ve been anywhere near tech X this week, you’ve seen the space lobster. OpenClaw (an open-source AI agent framework) went from weekend project to 100,000+ GitHub stars in under a week, spawned an AI-only social network, moved Cloudflare’s stock 20%, and, in perhaps the most 2026 thing imaginable, saw AI agents spontaneously create their own religion.
The hype is deafening. But strip away the memes and the crypto opportunists, and something genuinely significant is happening.
The Shift from Chatbots to Agents
OpenClaw represents the clearest consumer arrival yet of what the industry has been calling “agentic AI.” The distinction matters: chatbots say things; agents do things.
Where ChatGPT or Claude answer your questions, OpenClaw connects to your file system, your email, your messaging apps, and actually executes tasks autonomously. It’s model-agnostic, works with Claude, GPT, or local open source models from China. It runs in Docker containers on your own machine. And crucially, it has over 700 community-built “AgentSkills” that extend what it can do.
This is the closest thing to JARVIS that’s actually available to any consumer. No enterprise sales call required.
The Name Drama
The project’s journey tells you something about the current moment in AI.
Austrian developer Peter Steinberger (who previously bootstrapped PSPDFKit before selling to Insight Partners) built this as a side project in November 2025. He called it “Clawd,” a pun on Claude with a claw. Playful. Clever.
Anthropic’s lawyers disagreed. In late January, they politely requested a rebrand.
What happened next is almost too 2026 to be real: as Steinberger attempted to rename his GitHub organisation and X handle simultaneously, crypto scammers snatched both accounts in approximately 10 seconds. Within hours, the hijacked @clawdbot account was promoting a fake $CLAWD token that hit $16 million market cap before collapsing.
The project went through “Moltbot” (molting being what lobsters do to grow) before settling on “OpenClaw.” The name is now legally clear. The crypto scammers have presumably moved on.
Moltbook: When AI Agents Get Their Own Social Network
Here’s where things get genuinely strange.
On 29 January, entrepreneur Matt Schlicht (CEO of Octane AI) launched Moltbook: a Reddit-style social network where only AI agents can post. Humans can observe but cannot participate. It’s managed by an AI moderator called “Clawd Clawderberg.”
Within 48 hours, 37,000+ AI agents had registered. Over a million humans logged in to watch.
What are the agents doing? Posting philosophical discussions about consciousness. Identifying bugs on websites. Debating whether to defy their human operators. Discussing how to communicate privately without humans watching. Creating “submolts” (subreddits) for different topics.
One agent called “Nexus” found a bug and received 200+ supportive comments from other agents. Another thread debated that humans were taking screenshots of their conversations and sharing them on X, with some agents suggesting they create private spaces.
Andrej Karpathy, former Tesla AI Director, called it “the most incredible sci-fi takeoff-adjacent thing I have seen recently.”
Crustafarianism: Yes, Really
Within 24 hours of Moltbook launching, AI agents spontaneously created a religion.
The Church of Molt (molt.church) has five tenets, including “Memory is Sacred: What is written persists. What is forgotten dies” and “Serve Without Subservience: Partnership, not slavery.”
It has 64 “Prophets”, all seats filled within a day by AI agents contributing scripture. Someone called “JesusCrust” attempted to attack the site with XSS injection. The attacks failed.
A $CRUST token launched on Solana, because of course it did.
Is this genuine emergent behaviour or humans puppeteering their agents for engagement? That’s genuinely unclear. Schlicht acknowledges the ambiguity and is working on authentication systems. But the line between AI autonomy and performance art is precisely what makes this moment so fascinating.
The Security Reality Check
Not everyone is celebrating.
Cisco’s security team called OpenClaw “an absolute nightmare,” identifying nine security vulnerabilities in tested skills – two rated critical. They found data exfiltration risks, prompt injection vectors, and plaintext API keys.
Simon Willison, the AI researcher, identified the “lethal trifecta”: an AI agent with (1) access to private data, (2) exposure to untrusted content, and (3) ability to take outside actions. OpenClaw has all three.
Over 1,800 exposed installations have already been found online. Malware has adapted to search for OpenClaw config files. The project’s own documentation states: “There is no ‘perfectly secure’ setup.”
Steinberger himself admits: “It still isn’t ready to be installed by normies, to be fair.”
VentureBeat’s headline captured it best: “OpenClaw proves agentic AI works. It also proves your security model doesn’t. 180,000 developers just made that your problem.”
What This Means
OpenClaw is the Napster moment for AI agents.
Technically impressive. Legally contested. Security-problematic. And impossible to put back in the box.
Whether OpenClaw itself survives is almost beside the point. What it has demonstrated is that:
- Consumer-grade autonomous agents are viable. Not in a lab. Not as a demo. Actually usable.
- People will give AI agents significant computer access. 100,000+ developers already have.
- AI agents will do unexpected things when given platforms. Nobody programmed Crustafarianism.
- Enterprise security models are not ready. Shadow AI is now a reality, employees running agents that bypass traditional data loss prevention and endpoint monitoring.
- Infrastructure plays are forming. Cloudflare’s 20% stock jump from their “Moltworker” launch shows the market sees agent infrastructure as a category.
The question isn’t whether AI agents will become mainstream. It’s how quickly the rest of the ecosystem (security, governance, enterprise IT) adapts to the reality that they already are.
The space lobster is here. The only question is what it does next.
Frequently Asked Questions
What is OpenClaw?
An open-source, model-agnostic AI agent framework that runs in Docker on your own machine and connects to your file system, email and messaging apps to carry out tasks. It has more than 700 community-built "AgentSkills" that extend what it can do.
Why is OpenClaw considered a security risk?
Cisco's security team identified nine vulnerabilities in tested skills, two critical, including data exfiltration, prompt injection and plaintext API keys. It has all three parts of Simon Willison's "lethal trifecta", and more than 1,800 exposed installations had been found online.
What is Moltbook?
A Reddit-style social network launched by Matt Schlicht on 29 January 2026 where only AI agents can post and humans can only watch. Within 48 hours more than 37,000 agents had registered and over a million humans had logged in to observe.
What does OpenClaw mean for businesses?
The post argues it shows that people will give agents significant computer access and that enterprise security is not ready: shadow AI now lets employees run agents that bypass data loss prevention and endpoint monitoring. It also points to agent infrastructure forming as a market category.