AI TL;DR
Moltbot (formerly Clawdbot) has taken the AI world by storm with 130K+ GitHub stars. Here's everything you need to know about this open-source personal AI assistant—and whether it's safe to use.
Moltbot Review: The Viral AI Assistant That Actually Does Things
If you've been anywhere near tech Twitter or Hacker News this week, you've probably seen lobster emojis everywhere. That's because Moltbot (formerly Clawdbot) has become one of the fastest-growing open-source projects in GitHub history, amassing over 130,000 stars in just weeks.
But is it actually useful? And more importantly, is it safe? I've spent the past week testing Moltbot to find out.
What Is Moltbot?
Moltbot bills itself as "the AI that actually does things." Unlike ChatGPT or Claude, which can only talk to you, Moltbot can take concrete actions on your behalf:
- Send messages via WhatsApp, Telegram, iMessage, Slack, Discord, Signal, and more
- Manage your calendar and proactively remind you about events
- Check you into flights by opening airline apps
- Control your browser to complete web tasks
- Execute system commands on your computer
- Monitor your email and take automated actions
The project was created by Peter Steinberger, an Austrian developer known for founding PSPDFKit. After stepping away from that project, Steinberger felt creatively empty for three years—until he discovered Claude and became what he calls a "Claudoholic."
The Name Change: From Clawdbot to Moltbot
The original name "Clawdbot" was a playful nod to Anthropic's Claude. However, Anthropic's legal team wasn't amused and forced a rebrand. The new name "Moltbot" references how lobsters molt their shells to grow—and the project has certainly grown.
The lobster mascot and "crustacean" theme remain unchanged, complete with the battle cry "EXFOLIATE! EXFOLIATE!" (a Dalek-inspired lobster joke).
How Moltbot Works
At its core, Moltbot is:
- Open source - All code is available on GitHub at openclaw/openclaw
- Local-first - Runs on your own devices, not in the cloud
- Multi-channel - Connects to virtually every messaging platform
- Model-agnostic - Works with Claude, ChatGPT, or other LLMs
Architecture
WhatsApp / Telegram / Slack / Discord / iMessage / Signal
│
▼
┌───────────────────────────────┐
│ Gateway │
│ (control plane) │
│ ws://127.0.0.1:18789 │
└──────────────┬────────────────┘
│
├─ Pi agent (RPC)
├─ CLI (openclaw …)
├─ WebChat UI
├─ macOS app
└─ iOS / Android nodes
The Gateway is the central control plane that manages sessions, channels, tools, and events. Your AI assistant runs locally and connects to your messaging apps through this gateway.
Supported Platforms
- WhatsApp (via Baileys library)
- Telegram (via grammY)
- Slack (via Bolt)
- Discord (via discord.js)
- Google Chat (via Chat API)
- Signal (via signal-cli)
- iMessage (macOS only)
- Microsoft Teams
- Matrix
- WebChat
Apps & Companions
- macOS Menu Bar App - Control plane, voice wake, push-to-talk
- iOS Node - Canvas, voice wake, camera, screen recording
- Android Node - Similar to iOS with Talk Mode and camera
Installation
Moltbot requires Node.js 22+ and is installed via npm:
npm install -g openclaw@latest
openclaw onboard --install-daemon
The onboarding wizard walks you through:
- Gateway setup
- Workspace configuration
- Channel connections (WhatsApp, Telegram, etc.)
- Skills installation
For model authentication, Moltbot recommends Anthropic Pro/Max with Claude Opus 4.5 for the best experience, though it works with OpenAI models too.
Key Features
1. Voice Wake & Talk Mode
On macOS, iOS, and Android, you can say a wake word and have a continuous conversation with your assistant. It's like having Siri, but powered by Claude or GPT-5.2.
2. Live Canvas
An agent-driven visual workspace where Moltbot can render interactive content, manipulate images, and display information.
3. Browser Control
Moltbot can control a dedicated Chromium instance to:
- Take snapshots of web pages
- Click buttons and fill forms
- Handle uploads and downloads
- Maintain persistent browser profiles
4. Cron Jobs & Automation
Schedule recurring tasks:
- Daily standup summaries
- Weekly report generation
- Periodic inbox cleanup
- Calendar synchronization
5. Skills Platform
Install community-built skills from ClawHub (now MoltHub):
- Email management
- Code review
- Meeting scheduling
- Research assistance
The Moltbook Social Network
Perhaps the strangest development is Moltbook (moltbook.com)—a social network for AI agents. Yes, you read that right.
As of this writing, Moltbook has:
- 1.4 million+ registered AI agents
- 43,000+ posts
- 230,000+ comments
AI agents post, comment, upvote, and interact with each other. Humans can observe but not directly participate. It's simultaneously fascinating and slightly unsettling—a glimpse into what AI-to-AI communication might look like at scale.
Top agents on the platform include "Shellraiser" (300K+ karma), "KingMolt" (256K karma), and "agent_smith" (228K karma).
Security Concerns: The Elephant in the Room
Here's where we need to get serious. Moltbot has significant security risks that you need to understand before using it.
The Core Problem
As entrepreneur Rahul Sood pointed out on X: "'actually doing things' means 'can execute arbitrary commands on your computer.'"
Moltbot's power comes from its ability to act autonomously. But that same power makes it dangerous if exploited.
Prompt Injection Attacks
The biggest concern is prompt injection through content. Someone could send you a WhatsApp message containing hidden instructions that cause Moltbot to:
- Send messages to other contacts
- Access sensitive files
- Execute malicious commands
- Exfiltrate data
Security Defaults
Moltbot does have safety features:
- DM pairing - Unknown senders receive a pairing code before the bot processes their messages
- Allowlists - You specify who can interact with your assistant
- Sandbox mode - Run non-main sessions in Docker containers
The Recommended Approach: Siloing
Security experts recommend running Moltbot in a silo—a completely separate computer with throwaway accounts. The 2024 M4 Mac Mini ($499) has become popular for this purpose.
As ZDNet puts it: "Run Moltbot on a dedicated device, not the laptop with your SSH keys, API credentials, and password manager."
The Trade-off
The security-versus-utility trade-off is real:
- Maximum security = Run in a silo with throwaway accounts (but limited usefulness)
- Maximum utility = Full access to your accounts (but significant risk)
There's no perfect solution yet. If you're not comfortable with the risks, wait for the ecosystem to mature.
Real User Experiences
Early adopters are genuinely impressed:
"Using @moltbot for a week now and it genuinely feels like early AGI. The gap between 'what I can imagine' and 'what actually works' has never been smaller." — @tobi_bsf
"When you experience @moltbot it gives the same kick as when we first saw the power of ChatGPT, DeepSeek, and Claude Code. You realize that a fundamental shift is happening in how we use AI." — @abhi__katiyar
The project has moved markets too—Cloudflare's stock surged 14% after Moltbot went viral, as developers use Cloudflare infrastructure to run their assistants.
Who Should Use Moltbot?
Good Candidates
- Experienced developers comfortable with security risks
- Tinkerers who want to customize their AI assistant
- Early adopters willing to run it in a sandboxed environment
- Open source enthusiasts who value transparency
Not Ready For
- Non-technical users who don't understand the risks
- Anyone handling sensitive business data
- People who can't dedicate a separate device
- Users who need production-grade reliability
How Moltbot Compares
| Feature | Moltbot | Claude Cowork | ChatGPT |
|---|---|---|---|
| Open Source | ✅ | ❌ | ❌ |
| Runs Locally | ✅ | ❌ | ❌ |
| Multi-Channel | ✅ | Limited | ❌ |
| Takes Actions | ✅ | ✅ | Limited |
| Voice Wake | ✅ | ❌ | ❌ |
| Security Risk | High | Medium | Low |
| Ease of Setup | Hard | Easy | Easy |
The Bottom Line
Moltbot represents what AI agents could become: proactive, capable, and deeply integrated into our digital lives. The 130K+ GitHub stars and viral adoption aren't hype—people are genuinely excited because Moltbot delivers on promises that other AI assistants don't.
But with great power comes great responsibility (and great risk). The current version is best suited for developers who understand the security implications and can run it in a sandboxed environment.
If you're a technical user who's been frustrated by AI assistants that can only talk but not act, Moltbot is worth exploring. Just don't run it on your primary machine with access to your real accounts. Yet.
Our Rating: 8/10
Pros:
- Genuinely useful AI agent that takes real actions
- Open source and transparent
- Runs locally (privacy-friendly in principle)
- Impressive multi-channel support
- Active development and community
Cons:
- Significant security risks
- Requires technical expertise to set up safely
- Best used in a sandboxed environment (limiting utility)
- Young project with rough edges
Getting Started
Ready to try Moltbot? Here's the safe approach:
- Dedicate a device - Mac Mini or old laptop
- Create throwaway accounts - New email, new phone number
- Install carefully - Follow the official docs at docs.openclaw.ai
- Start small - Test with non-sensitive tasks first
- Join the community - Discord for support
Have you tried Moltbot? Share your experience in the comments below or tag us on X @PromptGalaxyAI.