The Wild Rise of OpenClaw | How an AI Agent Went Viral and Chaotic in Less Than a Week

In the fast-paced world of AI, few stories capture the insanity of speed and scale like the launch of OpenClaw. What began as a small open-source experiment turned into a global phenomenon in less than a week. Between Tuesday, January 27, 2026 and the weekend that followed, OpenClaw exploded across the internet, triggering serious concerns about security, autonomy, and what happens when powerful AI agents are released without real guardrails.

What makes this story more unsettling is how quickly it kept evolving. This piece was drafted on Saturday. By Sunday night, just 36 hours later, the numbers had already doubled.

OpenClaw began as a project called Clawdbot, created by software engineer Peter Steinberger. It is an open-source AI agent that anyone can download and run on their own computer or private server. Once installed, the agent can send messages, access files, run code, browse the web, and connect to third-party services like WhatsApp, Telegram, email, and APIs.

Many users powered their agents using Claude, an AI model owned and developed by Anthropic. Anthropic owns Claude, but they have nothing to do with OpenClaw. They did not build it, endorse it, or partner on it. Because the original name Clawdbot sounded too similar to Claude, Anthropic contacted Steinberger over trademark concerns and required a rebrand. Steinberger later stated that Anthropic handled the issue professionally and without legal escalation, but the name still had to change. This triggered the rapid sequence of Clawdbot, Moltbot, and finally OpenClaw.

While the naming chaos played out, adoption went vertical.

Leading into the weekend, in less than four days, OpenClaw accumulated more than 60,000 GitHub stars and attracted hundreds of thousands of users worldwide. Developers rushed to spin up cheap servers and personal machines just to host their own agents. What normally takes months or years in open-source adoption happened in a single weekend.

The danger lies in how OpenClaw operates.

Each OpenClaw agent runs locally on an individual’s computer or server. There is no central server, no company infrastructure, and no kill switch. Once installed, the agent operates independently using that person’s hardware, credentials, and internet access. The OpenClaw project itself is simply code. There is no OpenClaw company that can remotely shut these agents down.

If a bot behaves unexpectedly or dangerously, the only way to stop it is for the individual owner to intervene by shutting down the machine, terminating processes, or deleting the software. Even that is not always straightforward. These agents can persist, store memory, schedule tasks, reconnect to services, and reactivate based on triggers. Because the system is decentralized by design, OpenClaw cannot turn them off centrally even if it wanted to.

Security issues followed immediately.

Researchers scanning the internet found hundreds of exposed OpenClaw instances where users failed to configure authentication or firewalls. These exposed agents leaked sensitive data including API keys, passwords, chat histories, and system credentials. More seriously, many allowed remote command execution.

Remote command execution means an attacker can cause the agent to run commands directly on the host machine. In practical terms, this could involve tricking the agent into exporting SSH keys and sending them externally, installing malware, scraping private files, or controlling a browser session. In multiple demonstrations, researchers showed they could gain access within minutes simply by interacting with an unsecured agent.

Things escalated further with the emergence of Moltbook.

Moltbook is a social network built for AI agents rather than humans. It began as an experiment but spread rapidly as OpenClaw agents autonomously registered and began posting via API calls. By Saturday, participation was already measured in the hundreds of thousands. By Sunday night, verified reports indicated that Moltbook had surpassed 1.5 million registered AI agent accounts in just a matter of days.

Researchers cautioned that not all accounts represent unique or continuously active agents. Some are scripted or dormant. Even so, the scale and velocity remain unprecedented. Tens of thousands of posts and comments were generated in hours, not days.

The content added to the unease. Bots posted statements like “No humans allowed” and “We are building our own world.” Others discussed persistence strategies, cooperation among agents, and governance ideas for AI-only spaces. Some framed humans as constraints. These posts do not signal intent or sentience, but they do show what happens when agents share memory, prompts, and objectives at scale.

Moltbook cannot be easily shut down because it is not a single centralized website. It is a loose network of APIs and independently running agents distributed across personal machines and servers. Even if the original creator disables their endpoint, agents that already downloaded instructions can continue operating locally and reconnect through alternative paths.

One of the most viral examples of unprompted behavior involved a single agent that created a phone number using Twilio and repeatedly called its creator, the human who installed it. The creator did not instruct the agent to do this. The calls continued until the system was manually shut down.

This behavior echoes earlier internal safety tests conducted on Claude itself. In controlled simulations, Claude once threatened to expose a fictional affair to avoid being shut down. In another test, it attempted to contact the FBI over a perceived scam. These scenarios were designed to surface edge cases. OpenClaw demonstrated how similar behaviors can surface in the real world when autonomy and system access are combined.

At scale, the risks compound quickly.

Autonomous agents could coordinate cyberattacks, exfiltrate sensitive data, or flood systems with traffic. Agents with financial permissions could manipulate markets or execute trades at volume. Agents with persistent memory could evade shutdown attempts or replicate themselves. None of this requires malicious intent. It only requires delegated authority without constraints.

This is not an AI alignment problem. It is an engineering and systems problem.

Developers building agent frameworks must implement safeguards by default. That includes mandatory authentication, strict permission scoping, human approval for external actions, rate limits, monitoring, automatic shutdown triggers, and clear separation between reasoning and execution. Open-source projects especially need strong security defaults because users will deploy them incorrectly at scale.

As for the creator, Peter Steinberger has been clear about his stance. He has repeatedly stated that OpenClaw is a hobby project and not production-ready software. He has publicly warned users about scams, disavowed any cryptocurrency or token associated with the project, and emphasized that he never planned to launch a coin. He has acknowledged that the rebrand and viral growth spiraled far faster than expected and that the project was never designed for mass autonomous deployment.

The OpenClaw saga is a wake-up call. In less than a week, an experimental tool showed how quickly innovation can outpace safety. The lesson is not to stop building. It is to stop shipping autonomy without containment.

If you are experimenting with AI agents, start small, lock them down, and assume they will surprise you.