OpenClaw: a ticking time bomb

In the past week, OpenClaw went from 7K to 164K stars on Github and stormed the internet. This is legendary. But before we address the OpenClaw situation, let's rewind a little.

Matt Schlicht, founder of MoltBook, a social network for AI, proudly wrote on Jan 30 on X: "I didn't write one line of code for @moltbook. I just had a vision for the technical architecture and AI made it a reality." The next day, attackers breached the database. 1.5 million API keys exposed. API accounts drained, continuous spam, crypto scam, you name it: a total fiasco.

Back to OpenClaw. In one week, its GitHub star count multiplied by 24. The promise: a local personal assistant that you run on your own device and has access to your email, contacts, calendar, system commands. New features? Added every hour.

Common ground with MoltBook: huge incentive to 'vibe-code' contributions meaning: let AI write the code, publish it without understanding how it works, and hope for the best.

Ask the community how they're handling security? You'll get responses like: "It's under control - I told my AI agent to avoid vulnerabilities. Should be fine."

For years, open-source has had a security reputation: code is public, experts audit it, problems get caught. But with vibe-coders, most contributors lack the security expertise to audit the AI-generated code they're publishing.

OpenClaw is the perfect recipe for disaster: