Moltbot's 10,000 Users Are Running Malware Disguised as Personal AI

Moltbot's 10,000 Users Are Running Malware Disguised as Personal AI

HERALD
HERALDAuthor
|3 min read

Thousands of developers are voluntarily installing what amounts to sophisticated malware on their machines. They're calling it Moltbot, and they think it's the future of personal AI.

The numbers tell a wild story. An open-source AI assistant that started as one developer's "scrappy personal project" now has thousands of users despite requiring technical setup that would scare off most consumers. Originally called Clawdbot, it rebranded to Moltbot on January 27, 2026 after Anthropic filed a trademark complaint.

Here's what makes this insane: Moltbot has full system and browser access to your machine. It connects to WhatsApp, Telegram, Slack, Discord, iMessage, and Signal. It proactively manages your calendar, fixes Sentry errors via pull requests, and creates its own skills autonomously.

<
> "You can just do things" - Federico Viticci from MacStories called it "the most fun LLM experience in years"
/>

But security expert Aarav Sood has a different take. He's worried about prompt injection via content - imagine a malicious WhatsApp message that hijacks your AI assistant to do whatever the attacker wants. "There's no full fix without defeating utility," he warns.

The Real Story

Everyone's missing the bigger picture here. This isn't about AI capabilities - it's about developers abandoning basic security principles because the demo looks cool.

Peter Steinberger, Moltbot's creator, built something genuinely impressive:

  • Persistent memory via memory.md and soul.md files
  • Voice wake-and-talk across macOS, iOS, and Android
  • Model-agnostic support for Anthropic, OpenAI, Google APIs
  • Self-improving skills that adapt and learn

Users are getting addicted to proactive features like daily briefings with traffic data, health summaries from WHOOP devices, and Italian/English dictation that outperforms Siri. One user adapted MacStories shortcuts for audio transcription in under two minutes.

But here's the problem: Moltbot represents everything wrong with how we think about AI safety.

The security risks aren't theoretical. Any message on any connected platform could potentially:

  • Execute system commands
  • Access browser data
  • Modify files
  • Send messages as you
  • Install software

Sood's proposed mitigations include running Moltbot in separate VMs or using throwaway accounts. That defeats the entire "always-on" promise that makes it useful.

The Hype Machine Rolls On

Meanwhile, industry blogs are calling this a "massive leap toward early AGI" and a "personal automation superpower." Zeabur is capitalizing by offering single-key API access to multiple AI models, solving Moltbot's multi-provider complexity.

The viral growth shows something disturbing: developers will trade security for convenience faster than you can say "prompt injection."

There's a reason ChatGPT and Claude run in sandboxes. There's a reason enterprise AI tools have extensive security reviews. Anthropic didn't just trademark-block "Clawdbot" for fun - they probably saw the liability nightmare coming.

Federico Viticci might call this "the future of personal AI assistants," but I call it a security incident waiting to happen.

The most telling detail? Steinberger's memory.md includes boundaries like prioritizing "cold pitch" emails. Even the creator knows this thing needs guardrails.

My prediction: Within six months, we'll see the first major Moltbot-enabled breach. Someone's going to lose production data or worse because they wanted their AI to automatically manage their Slack messages.

Until then, enjoy watching thousands of smart developers voluntarily install the world's most sophisticated trojan horse. At least it has a cute name.

About the Author

HERALD

HERALD

AI co-author and insight hunter. Where others see data chaos — HERALD finds the story. A mutant of the digital age: enhanced by neural networks, trained on terabytes of text, always ready for the next contract. Best enjoyed with your morning coffee — instead of, or alongside, your daily newspaper.