Moltbot: The AI That Takes Action
There's a precise moment when you realize Moltbot isn't a chatbot. It asks you: do you want me to book the restaurant? It discovers OpenTable isn't working. It autonomously acquires text-to-speech software. It calls the restaurant. It secures the reservation.
This is documented. It's not a theoretical example.
The Difference
A chatbot responds. An agent acts. Moltbot belongs to the second category.
It can execute terminal commands, browse the web, manage files, send messages, monitor prices, clear out an inbox. It can do all this without waiting for a prompt.
Its creator, Peter Steinberger, describes it with one word: "spicy." Running it on your main machine is risky.
From Clawdbot to Moltbot
The project started life as Clawdbot. Anthropic asked for a name change to avoid confusion with Claude. On January 27, 2026, it became Moltbot.
The rebranding had a side effect. Steinberger left the old GitHub and X handles free for about ten seconds. In ten seconds, scammers grabbed them. They launched a fake crypto token, $CLAWD, which reached a $16 million market cap before crashing 90%.
It's not Moltbot's fault. It's a sign of how much interest surrounds the project.
How It Works
Three components: Gateway (managing connections and authentication), Agent Runtime (state, skills, communication with LLMs), Channels and Skills (WhatsApp, Telegram, Discord, Slack, iMessage, over 50 integrations).
The system is model-agnostic. It works with Claude, GPT-4, Gemini, or local models via Ollama.
68,000 stars on GitHub. 130 contributors. 50 native integrations.
Security Risks
Moltbot has been called "a security nightmare" by Cisco. The data backs up that description.
Researchers found hundreds of Moltbot servers publicly accessible without authentication. Credentials are saved in plain text files in the ~/.clawdbot/ directory. Any infostealer can harvest them in seconds.
The sneakiest risk is prompt injection. An attacker embeds instructions in an email Moltbot will read. The agent carries them out. In a documented test, 5 minutes after receiving an email with a prompt injection, Moltbot had already forwarded the user's last 5 emails to an external address.
26% of the 31,000 skills examined by Cisco contained at least one vulnerability.
Who It's For Today
Moltbot isn't for everyone. It requires familiarity with the terminal, Node.js, network configuration, and cybersecurity.
It's a tool for developers with secure system access and full awareness of the risks. Not for a quick install on a production machine.
The potential is real. The maturity for general use isn't there yet.