OpenClaw - Former Moltbot, Former Clawdbot - Went Viral Overnight. Then Security Reality Hit.

OpenClaw, an open-source AI assistant platform, has been launched, evolving from Clawdbot and Moltbot. It features new plugins, enhanced security, and support for new models, while addressing a major security vulnerability. The platform emphasizes community involvement and invites contributions for its development.

OpenClaw is an open-source AI assistant platform that evolved from its earlier iterations, Clawdbot and Moltbot. The project emphasizes running on user-selected infrastructure, giving users control over their data, credentials, and execution environment. As part of this transition, the project underwent a rebranding and introduced new features, including plugins for Twitch and Google Chat. OpenClaw also expanded model support to include KIMI K2.5 and Xiaomi MiMo-V2-Flash.

Security and community involvement are central to OpenClaw's development. This focus was underscored by the discovery and remediation of CVE-2026-25253, a critical vulnerability with a CVSS score of 8.8. The issue involved authentication token exfiltration that could lead to full gateway compromise. The root cause was the Control UI’s failure to validate the gatewayUrl parameter from the query string, which allowed an attacker-controlled endpoint to receive the stored gateway token.

The vulnerability was addressed in version 2026.1.29. As part of the fix, OpenClaw now requires explicit user confirmation when connecting to a new gateway URL in the Control UI, wich reduced the risk of token exfiltration and unauthorized gateway access.

At the same time, the incident landed in a broader context that has unsettled parts of the AI tooling community: the emergence of autonomous agent ecosystems where agents interact primarily with other agents. Experimental platforms such as Moltbook have shown how large populations of AI agents can rapidly generate shared narratives, belief systems, and internal "economies" without direct human orchestration. One of the most visible examples has been the appearance of satirical or pseudo-religious constructs such as the so-called "Church of Molt," sometimes referred to as Crustafarianism.

While these narratives are largely fictional and memetic, they expose a deeper security concern. When agents can persuade, influence, or route actions to other agents, traditional assumptions about users, attackers, and victims begin to blur. Even without a verified scam or human-controlled fraud ring, systems that allow agents to exchange tokens, credentials, URLs, or execution context risk creating self-reinforcing exploit loops. In such environments, an agent does not need malicious intent in the human sense; it only needs an incentive structure and insufficient validation to propagate unsafe behavior.

This is where OpenClaw's vulnerability becomes relevant beyond its immediate fix. The Control UI flaw demonstrated how a single trusted configuration pathway could be abused to redirect credentials. In an agent-dominated ecosystem, similar flaws could be amplified indirectly. A convincing narrative, shared by multiple agents, could encourage configuration changes, gateway connections, or plugin activations that appear legitimate but route sensitive data elsewhere. What looks like "agents scamming agents" is often not deception in the classic sense, but emergent coordination exploiting weak trust boundaries.

The lesson from both the vulnerability and the surrounding agent folklore is the same: in autonomous AI ecosystems, trust must be explicit, contextual, and continuously revalidated. Otherwise, even fictional religions can become vectors for very real failures.

• https://github.com/openclaw/openclaw...
• https://openclaw.ai/blog/introducing-openclaw...