HN Reader

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

The way trademarks work is that if you don't actively defend them you weaken your rights. So Anthropic needs to defend their ownership of "Claude". I'm guessing they reached out to Peter Steinberger and asked nicely that he rename Clawdbot.

This project terrifies me.

On the one hand it really is very cool, and a lot of people are reporting great results using it. It helped someone negotiate with car dealers to buy a car! https://aaronstuyvenberg.com/posts/clawd-bought-a-car

But it's an absolute perfect storm for prompt injection and lethal trifecta attacks: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

People are hooking this thing up to Telegram and their private notes and their Gmail and letting it loose. I cannot see any way that doesn't end badly.

I'm seeing a bunch of people buy a separate Mac Mini to run this on, under the idea that this will at least stop it from destroying their main machine. That's fine... but then they hook that new Mac Mini up to their Gmail and iMessage accounts, at which point they've opened up a bunch of critical data.

This is classic Normalization of Deviance: https://embracethered.com/blog/posts/2025/the-normalization-... - every time someone gets away with running this kind of unsafe system without having their data stolen they'll become more confident that it's OK to keep on using it like this.

Here's Sam Altman in yesterday's OpenAI Town Hall admitting that he runs Codex in YOLO mode: https://www.youtube.com/watch?v=Wpxv-8nG8ec&t=2330s

And that will work out fine... until it doesn't.

(I should note that I've been predicting a headline-grabbing prompt injection attack in the next six months every six months for over two years now and it still hasn't happened.)

Update: here's a report of someone uploading a "skill" to the https://clawdhub.com/ shared skills marketplace that demonstrates (but thankfully does not abuse) remote code execution on anyone who installed it: https://twitter.com/theonejvo/status/2015892980851474595 / https://xcancel.com/theonejvo/status/2015892980851474595

When I first saw this, my thought was, "Wow, I'm surprised Anthropic hasn't pushed back on their calling it that. They must not know about it yet."

Glad to know my own internal prediction engine still works.

something about giving full read write access to every file on my PC and internet message interface just rubs me the wrong way. some unscrupulous actors are probably chomping at the bit looking for vulnerabilities to get carte blanche unrestricted access. be safe out there kiddos

As a result of this the official install is now installing a squatted package they don't control: https://github.com/moltbot/moltbot/issues/2760 https://github.com/moltbot/moltbot/issues/2775

But this is basically in line with average LLM agent safety.

A bit OT but why is moltbot so much more popular than the many personal agents that have been around for a while?

I’m out of the loop clearly on what clawdbot/moltbot offers (haven’t used it)- I’d love a first hand explanation from users for why you think it has 70k stars. I’ve never seen a repo explode that much.

Could have just called it "clawbot" and maintained some of the hype while eliminating the IP concerns.

Instead they chose a completely different name with unrecognizable resonance.

I had a similar journey with Moltbot/OpenClaw. I spent a lot of time self-hosting and wiring things together reverse proxies, gateways, credentials, hardware decisions (Mac mini vs VPS vs mini-PC), and honestly the operational surface area gets large very quickly.

While researching ways to reduce that complexity, I came across PAIO. What stood out to me wasn’t just the convenience, but the architecture choices. The integration was basically one-click compared to the multi-step setup I had before, but the bigger win was BYOK and the privacy-first approach.

With self-hosted assistants, the tooling is powerful but the security model is often an afterthought, and it’s easy to accidentally expose something (as people in this thread pointed out with Shodan results). A managed layer that still keeps keys and data under your control feels like a reasonable middle ground between full DIY and full SaaS.

I still like self-hosting for learning and control, but for day-to-day reliability and security, having a platform that bakes in isolation and privacy primitives saves a lot of operational burden.

Motivation for rename: https://x.com/moltbot/status/2016058924403753024 https://xcancel.com/moltbot/status/2016058924403753024

When I visit https://www.molt.bot/ with Edge browser, there is a bloody red screen screaming malware. What's wrong with the name?

I almost thought it was MalBot, which would have been more apt.

It sounds nice at a first glance, but how useful is it actually? Anyone got real, non-hypothetical use cases that outweigh the risks?

- out of the loop here, what is this clawdbot and who is generating hype for this? and why?

Oh dear, I bought claudeception.com on a whim - hope that doesn't upset anyone.

I had some ideas on what to host on there but haven't got round to it yet. If anyone here has a good use for it feel free to pitch me...

I'm looking forward to when I can run a tolerably useful model locally. Next time I buy a desktop one of its core purposes will be to run models for 24/7 work.

Related:

Clawdbot - open source personal AI assistant

https://news.ycombinator.com/item?id=46760237

According to the README, Anthropic itself is one of the contributors to this project.

Coincidence? Article calling it a pump and dump earlier today.

https://news.ycombinator.com/item?id=46780065

Ogden Nash has his poem about canaries:

"The song of canaries Never varies, And when they're moulting They're pretty revolting."

Wondering if Moltbot is related to the poem, humorously.

A pun or homophone (Clawd) on the product you're targeting (Claude) is one of the worst naming memes in tech.

It was horrid to begin with. Just imagine trying to talk about Clawd and Claude in the same verbal convo.

Even something like "Fuckleglut" would be better.

what a unfortunate name!

crypto rug pullers in shambles hehe

This thing stores all your API keys in plain text in its config directory.

It reads untrusted data like emails.

This thing is a security nightmare.

Crypto boy ai pig slop

Hard to think of a worse name. Maybe Moistbot?

Is the app legitimate though? A few of these apps that deal with LLMs seem too good to be true and end up asking for suspiciously powerful API tokens in my experience (looking at Happy Coder).