And what I’m seeing with autonomous AI agents like ClaudeBot, Moltbot, and OpenClaw should make anyone pause.
This wasn’t supposed to be a botnet story. It was supposed to be about efficiency. Productivity. Empowerment.
Instead, it’s a case study in how fast we trade competence for convenience.
From AI Agent to Autonomous Actor
ClaudeBot began as an open-source AI agent designed to run locally. Its purpose: automate real-world tasks: email, calendars, smart home devices, browsing, generating project boards, acting like a proactive digital assistant. It gained attention in early 2026 after its creator, Peter Steinberger, rebranded Clawdbot to Moltbot due to trademark concerns from Anthropic [1].
It evolved again into OpenClaw, reflecting its open-source, community-driven nature. OpenClaw can run Claude Opus 4.5, ChatGPT, or local LLMs through tools like Ollama. It integrates with platforms such as Telegram, iMessage, and Discord.
It observes your screen. Simulates input. Maintains memory. Executes multi-step workflows without APIs [2].
That’s not a chatbot. That’s an autonomous operator sitting inside your machine.
How People Are Getting “Infected”
Most users aren’t victims of some zero-day exploit. They install it themselves. Run a terminal command. Grant system-level permissions. Feed it a “brain dump” of workflows, credentials, and routines.
It’s like onboarding a new employee, but without liability, certification, or oversight.
OpenClaw’s user agent string (“ClaudeBot/1.0”) already appears in security logs crawling web pages [3]. That crawling introduces indirect prompt injection attacks; malicious content on websites that manipulates the agent’s behavior [4].
We’re not talking malware. We’re talking architectural risk: autonomous software with access, memory, and the freedom to act.
The Productivity Mirage
Companies love the pitch: “One human plus AI equals double output.”
That’s the “more with less” philosophy. Headcount drops. Deadlines shrink. Expectations rise. AI drafts code, reviews code, writes documentation, triages tickets. A human “supervises.”
But what does supervising mean when the human doesn’t understand the underlying model behavior?
There’s a saying in engineering:
Companies can have any two of the following: right, cheap, fast, but you only get two.
Right now, AI adoption is chasing cheap and fast. Right is deferred.
Skill Atrophy
The more we outsource cognition, the more baseline competence erodes.
Junior developers are trained to prompt instead of program. Code reviews are outsourced to AI. Architectural decisions are justified with model-generated summaries.
AI reviewing AI is not redundancy, it’s recursive trust.
Base-level coding literacy is dropping where AI scaffolding is the default. If you can’t understand the system, you can’t question it. You can’t detect hallucinations or subtle security flaws. Yet hiring expectations for fundamentals are falling because “the AI can handle that part.”
That’s not innovation. That’s dependency.
Autonomy Without Accountability
Unless you run a fully internal model, you’re outsourcing your security boundary.
External APIs from Anthropic or OpenAI tie your operations to their infrastructure, patch cycles, and incident responses [5].
Local models through Ollama carry risks too: model poisoning, supply-chain vulnerabilities, misconfigured permissions, and unreviewed community contributions.
Most companies don’t perform deep audits on open-source dependencies. They install, integrate, and ship, hoping nothing breaks.
The Dangerous Precedent
Here’s what worries me most:
- Lowering the importance of base coding understanding
- Rushing adoption of “productivity tools” without review
- Normalizing AI reviewing AI as acceptable validation
We are training a generation of technologists who may never fully understand their systems.
Proper adoption requires internal staff capable of peer-reviewing source code, understanding OS permissions and attack surfaces, evaluating prompt injection risk, and challenging AI outputs.
You cannot outsource judgment. You cannot automate accountability. And you cannot claim sovereignty over your infrastructure while delegating reasoning to black-box systems.
Remediation: Slow Down Before You Scale
Responsible adoption means:
- Internal code review of AI frameworks
- Segmented environments with strict permissions
- Context fencing and rate limiting [4]
- Human-led peer review of AI-generated code
- Clear policies for validating AI outputs
Efficiency isn’t the enemy. Blind acceleration is.
Autonomous AI agents are powerful tools. But power without comprehension is leverage waiting to be used against you.
We’re not being hacked by machines. We’re being rushed by our own ambition.
Unless we relearn the discipline of understanding the systems we build, we’ll engineer our own weakness.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
References
[1] Reports and public statements regarding ClaudeBot’s rebranding to Moltbot and OpenClaw following trademark concerns from Anthropic (2026).
[2] OpenClaw project documentation and repository materials describing architecture, integrations, and model support.
[3] Security log observations referencing “ClaudeBot/1.0” user agent activity.
[4] Industry research on indirect prompt injection and LLM application security (e.g., OWASP guidance).
[5] Public documentation from Anthropic and OpenAI on API model access and infrastructure dependencies.