Moltbot security is a management problem before it’s a technical one. A free agent that does real work from WhatsApp will get installed by your staff with or without approval. Don’t ban it blindly and don’t ignore it. On Monday, ask who’s running a personal agent and write down what it can touch.
On January 26 the security firm SlowMist warned that hundreds of gateways belonging to a new open-source agent were sitting on the open internet, leaking API keys, OAuth tokens and months of chat histories. The next day it had a new name, Moltbot, after a trademark request. That’s Moltbot security in one week: a free tool that spread because it worked, with a stack of exposed credentials behind it, and no purchase order anywhere that would have told an employer it existed.
Key points
- What happened to Moltbot in its first week? Moltbot is an open-source assistant that runs on your own computer and takes instructions through chat apps such as Telegram and WhatsApp.
- Why is access the problem with Moltbot security? An agent is only as useful as the doors it can open, and every door is also a way in.
- What should you do on Monday? Give a personal agent the access you’d give a new temp on day one, which is almost none.
- Is this a fuss over a hobbyist tool? Partly. The sceptic has a case, and it’s worth stating fairly.
What happened to Moltbot in its first week?
Moltbot is an open-source assistant that runs on your own computer and takes instructions through chat apps such as Telegram and WhatsApp. Its creator is Peter Steinberger, and VentureBeat reports that the project rebranded from Clawdbot to Moltbot on January 27 after Anthropic issued a trademark request over the similarity to “Claude”.
Most early agents needed babysitting. This one takes real actions from a chat message, so people lend it more access. Installing it takes a single command and no purchase order, which means an ordinary productivity win can turn into an exposure without anyone filing a request.
The security reporting arrived fast. VentureBeat reported on January 29 that SlowMist had flagged the exposed gateways. Researcher Jamieson O’Reilly of Dvuln said his scan found hundreds of exposed instances, eight of them completely open with full command execution. Matvey Kukuy, CEO of Archestra AI, said he extracted an SSH private key through an email in five minutes. A later release from the security firm Intruder, published on February 4, said organizations that ran Moltbot with default settings should assume compromise.
These are other people’s findings. We haven’t tested the tool and we haven’t verified any of the figures ourselves.
Why is access the problem with Moltbot security?
An agent is only as useful as the doors it can open, and every door is also a way in. If it can read your email, a hostile email can try to instruct it. If it runs commands on your laptop, so can anything that tricks it.
Researchers call this prompt injection, and it works because an agent can’t always tell a command from content it was merely asked to read. Think of a very capable temp who obeys any note slipped under the door. Hand that temp the keys to your sales inbox and the shared drive, and you’ve built a system where the weakest sender decides what happens next.
That’s why the question “is the tool any good” misleads. An agent’s value and its risk come from the same thing, which is how much it can reach. A more capable agent with broader access is more useful and more dangerous in equal measure. Whoever installs one hands over messages, files and logins, and in a business that person is rarely the one who owns the data.
What should you do on Monday?
Give a personal agent the access you’d give a new temp on day one, which is almost none. Start with one folder and one low-stakes task, and widen it only when you have a reason. Never hand it the login that can move money, change DNS or read the whole sales inbox. Here’s the order we’d run it in.
- Ask in your team channel whether anyone runs a personal agent, and make it safe to say yes.
- For each one, write down what it can read, what it can send and what it can run.
- Check whether it’s reachable from the internet and whether anything in its memory is stored unencrypted.
- If you can’t answer the third step, rotate any credentials the agent has seen.
- Decide whether it stays, moves to a separate machine, or goes.
Here’s how step two looks in practice, as our illustration and not a reported case. A salesperson runs an agent on her laptop to sort leads. She writes: reads the shared lead folder, sends nothing, runs nothing outside that folder. That’s a map you can live with. If the answer is “reads my whole inbox, sends as me, runs shell commands”, you’ve learned the agent is doing an IT administrator’s job with no administrator watching, and the next step is obvious.
Step one is the hard one. People hide tools they think will be banned, so say out loud that you’re mapping, not punishing. If the first answers come back empty, you’ve lost ten minutes and learned something about your team.
A personal agent is shadow IT of the kind we described in our column on the leader gap in workplace AI adoption, and the same personal-account problem showed up in our look at the $8 ChatGPT Go plan and in our staff policy column on ChatGPT Health. An agent that reads mail raises the same questions as the AI summaries in Gmail we told you to test first, with the added power to send and delete.
Is this a fuss over a hobbyist tool?
Partly. The sceptic has a case, and it’s worth stating fairly. Most businesses will never run Moltbot, and open-source communities patch quickly, as VentureBeat’s report that Steinberger’s team patched the gateway authentication bypass shows. Nothing here says the tool is bad.
But you don’t control who on your payroll is an enthusiast. If your poll turns up someone, you’ve found a tool with the keys to a colleague’s inbox that nobody in IT knew existed. And if your own staff survey finds nobody running any agent, drop this and move on.
This column rests on press reporting and researchers’ public claims, not our own testing, and the project has moved since. By October 2026 its repository, now called OpenClaw, tells users to treat inbound messages as untrusted and notes that tools run on the host unless sandboxing is configured. We’d ease off further if the project shipped safer defaults, such as authentication on by default. The product details have likely changed. The checklist hasn’t, because it never depended on one product. Website access is the same kind of risk, and PHP2Shell tests who can switch your site off.
Post the question in your team channel before lunch on Monday. The same approval question comes up with Slack Code, which lets anyone start a build.
Add a credential check from what secret scanning misses with coding agents.
Frequently asked questions
What is Moltbot?
Moltbot, formerly Clawdbot, is an open-source AI assistant that runs on your own computer and acts on your behalf. You talk to it through chat apps such as Telegram or WhatsApp.
Is Moltbot safe for business use?
Security researchers have warned about prompt injection and exposed data. Treat it as unvetted software, and don’t give it access to work accounts without a review.
What should a team lead do about personal AI agents?
Ask who runs one, list what each can read and run, and give it the least access that still does the job.
Archive entry dated January 28, 2026, written and fact-checked on October 8, 2026. Sources are linked on the claims they support.
