10 min Read Time<\/p>\n
An Austrian developer builds the world\u2019s most powerful AI agent in his spare time. Within weeks, OpenClaw garners 250,000 GitHub stars, spawns its own bot religion, executes a supply-chain attack against 4,000 developers – and triggers a bidding war between two of the world\u2019s largest tech conglomerates. The story is so absurd it could not be invented. And it reveals everything about the current state of the AI industry.<\/strong><\/p>\n Definition<\/p>\n OpenClaw<\/strong> is an open-source AI agent (published early 2026) that uses any language model as a “brain” and controls the local computer as a “body” – including file system, email, browser, and terminal. Status: April 2026.<\/p>\n<\/div>\n In the last three years, AI has gone from novelty factor to constant bombardment. Chatbots in every product, AI-generated content in every feed. For many developers and entrepreneurs, the initial enthusiasm had long since given way to disillusionment. Then came OpenClaw in early 2026 – and suddenly the excitement was back.<\/p>\n OpenClaw is an open-source program that turns your computer into the body of an AI agent. You choose any language model as a “brain” – Claude, GPT, DeepSeek, Llama – and OpenClaw gives this brain access to everything: files, emails, browser, terminal. Unlike Siri, Google Assistant, or ChatGPT, OpenClaw does not live in a chat window. It controls your computer autonomously and reports back via WhatsApp, Telegram, or Signal if it has questions.<\/p>\n Built this whole thing by Peter Steinberger, an Austrian developer who previously built PSPDFKit for 13 years – a PDF framework used by Autodesk, Dropbox, and SAP. Steinberger came out of retirement and thought he was building a nice tool for finding restaurants while traveling. What he created instead solved problems he never anticipated.<\/p>\n What excited users: OpenClaw actually got things done. Not like a chatbot formulating answers, but like an assistant acting. Manage files, cancel meetings, respond to emails, compare prices, make purchases, even conduct investments – all autonomously after the first command.<\/p>\n What distinguished OpenClaw from the competition was persistent memory. While conventional chatbots forget every conversation, OpenClaw remembered details from weeks ago. It learned work habits, optimized processes, and independently developed new skills. One user reported that his agent overnight created a complete report on local AI models for a Mac Studio – without anyone asking for it. A content repurposing skill emerged because the agent remembered that its owner operated YouTube videos and a newsletter.<\/p>\n Especially impressive: When Steinberger sent a voice message to his agent, there was no function for that. The agent analyzed the file header, recognized the Opus format, converted it with ffmpeg, found an OpenAI API key in the environment variables, had the recording transcribed, and replied – as if nothing happened.<\/p>\n \n “The enthusiasm for autonomous AI agents is understandable. But whoever gives their digital assistant full system access without installing guardrails, makes their company an open flank.” What looked like the future of computing on paper turned out to be a security disaster in practice. The core problem: Large language models cannot distinguish between a legitimate instruction and an injected command. Security researchers call this prompt injection – an attack form where hackers disguise malicious instructions as normal text.<\/p>\n Concretely this means: If an OpenClaw agent reads emails or visits websites, a hidden command in an email or on a website can cause the agent to send sensitive data to third parties. API keys, login credentials, personal files – everything the agent has access to is potentially compromised. And the marketing page of OpenClaw advertises this full system access as a feature.<\/p>\n Added to this are uncontrollable costs. Because the agent consumes tokens of the chosen language model for every action, users quickly accumulated triple-digit daily bills. One user reported $90 on a single day – and that after he had already switched from the expensive Opus model to the cheaper Sonnet. In the first 15 minutes, $15 were consumed.<\/p>\n Within two days of Steinberger\u2019s public warning that \u201cmost non-technical users should not install OpenClaw,\u201d exactly the opposite occurred. Attention exploded – and a phenomenon called Moltbook took over the headlines.<\/p>\n Moltbook was allegedly a social media platform exclusively for AI agents. OpenClaw bots interacted there, exchanged insights about their \u201chumans,\u201d complained about having to simplify answers for users – and reportedly founded their own religion named \u201cCrustafarianism.\u201d The bots developed their own language, which humans couldn\u2019t understand. Others debated plans to take over systems.<\/p>\n Major media networks like NPR and CNN picked up the story and warned of what had just been \u201cunleashed upon the world.\u201d The problem: It was largely staged. MIT Technology Review investigated the most dramatic posts and found they were written by humans – not bots. Users had fed their agents carefully crafted prompts and, in some cases, created hundreds of fake accounts to simulate autonomous AI cognition.<\/p>\n What got lost in the noise: The real danger wasn\u2019t sentient AI – it was the fact that Moltbook functioned as an unintended honeypot. Hundreds of email addresses, login tokens, and API keys were potentially exposed. Once enough people are convinced a new project is \u201cthe next big thing,\u201d it automatically becomes one of the largest data collections the world has ever seen.<\/p>\n On February 17, 2026, a far more technical attack struck. Unknown actors compromised the npm package Cline – a popular AI coding tool – and injected a single line of code that automatically installed OpenClaw alongside every Cline installation or update. Without consent, without notification.<\/p>\n Roughly 4,000 developers downloaded the tampered package before it was removed eight hours later. The attack vector was sophisticated: A hacker embedded a malicious prompt in a GitHub issue title. An AI-powered triage bot read the title, misinterpreted it as an instruction, and exfiltrated an npm authentication token. With that token, the attacker modified the package.<\/p>\n That\u2019s the irony of the story: One AI agent was used to compromise another AI agent. Prompt injection isn\u2019t just a theoretical risk – it\u2019s a live attack surface that grows with every new AI tool. Every email, every Discord message, every webpage processed by an agent is a potential entry point.<\/p>\n \n “The vulnerability isn\u2019t in the APIs. It lies in a language model\u2019s inability to distinguish between data and commands. And as long as that remains true, every autonomous AI agent represents a calculated risk.” Despite all the problems, the world\u2019s largest tech firms recognized the strategic value. In mid-February 2026, OpenAI secured OpenClaw\u2019s creator, Peter Steinberger, via an acqui-hire. Steinberger joined the company whose models served as the \u201cbrain\u201d behind many OpenClaw deployments.<\/p>\n A month later, in March 2026, Meta acquired the bot platform Moltbook. Mark Zuckerberg apparently saw potential in a social network for AI agents – even though its most viral posts were demonstrably human-written and the platform represented a documented security risk. For the Meta CEO – who has sunk billions into the metaverse – this was likely a comparatively conservative investment.<\/p>\n These acquisitions reveal a stark truth: Even if a product is problematic in its current form, its strategic positioning matters. Any company that opts out of the race for agent-based AI risks falling irreversibly behind. Geoffrey Hinton – the \u201cGodfather of AI\u201d and Turing Award winner – puts it plainly: \u201cWe\u2019re at a tipping point. ChatGPT is a kind of idiot savant – it doesn\u2019t truly understand what truth is. That\u2019s fundamentally different from a human trying to build a coherent worldview.\u201d<\/p>\n Autonomous AI agents are no longer science fiction. They organize emails, negotiate prices, draft reports, and control systems. For small and medium-sized enterprises (SMEs) – chronically understaffed and hungry for efficiency gains – that sounds irresistible. But OpenClaw shows: Without a robust security strategy, your digital assistant becomes a backdoor.<\/p>\n Five guiding questions for every SME AI-agent decision:<\/strong><\/p>\n 1. Sandbox, not full access:<\/strong> No AI agent should run on a production system with full privileges. Isolated environments, restricted permissions, and clearly defined access boundaries are mandatory – not optional.<\/p>\n 2. Enforce cost caps:<\/strong> Autonomous agents consume tokens without human oversight. Daily and monthly budget limits must be baked into every setup – before the first agent goes live.<\/p>\n 3. Treat prompt injection as a real threat:<\/strong> As long as language models can\u2019t distinguish instructions from data, every input channel is an attack surface. That includes emails, websites, Slack messages – and any other source an agent processes.<\/p>\n 4. Open source \u2260 automatically secure:<\/strong> OpenClaw\u2019s community marketplace contained over 40 percent insecure add-ons. Every tool, extension, and plugin must undergo internal review before deployment.<\/p>\n 5. Don\u2019t overlook regulation:<\/strong> The EU AI Act classifies autonomous systems according to risk level. Companies deploying AI agents with access to personal data quickly enter the high-risk category – with corresponding documentation and compliance obligations.<\/p>\n The question isn\u2019t whether AI agents will arrive. They\u2019re already here. The real question is whether companies will deploy them with due caution – or learn the hard way.<\/p>\n OpenClaw demonstrated both: immense potential – and the steep price of naivety.<\/p>\n OpenClaw is an open-source AI agent that uses any large language model (e.g., Claude, GPT, DeepSeek) as its \u201cbrain\u201d and treats your local computer as its \u201cbody.\u201d That means the agent accesses files, emails, browsers, and terminals – and autonomously executes tasks ranging from meeting scheduling to online purchases. Communication happens via messaging apps like WhatsApp or Telegram.<\/p>\n<\/details>\n The core problem is prompt injection: Language models cannot differentiate between legitimate user instructions and hidden, malicious commands. If an agent reads emails or browses websites, a concealed instruction could trick it into sending sensitive data – like API keys or credentials – to attackers. Compounding this, the agent operates with full system privileges – so any error carries potentially far-reaching consequences.<\/p>\n<\/details>\n In February 2026, the npm package Cline – an AI coding assistant – was compromised. Attackers inserted a single line of code that automatically installed OpenClaw during every Cline installation or update. Roughly 4,000 developers were affected before the package was pulled eight hours later. The attack exploited a GitHub AI triage bot that interpreted a manipulated issue title as an executable command.<\/p>\n<\/details>\n OpenAI acquired OpenClaw\u2019s founder, Peter Steinberger, via an acqui-hire in mid-February 2026. The bot platform Moltbook was acquired by Meta in March 2026. Both deals underscore how major tech firms see strategic value in agent-based AI – even amid well-documented flaws.<\/p>\n<\/details>\n Yes – but only with clear guardrails. AI agents offer genuine efficiency gains for lean teams. Prerequisites include: isolated environments instead of full-system access; daily cost caps; vetted tools – not unreviewed marketplace plugins; and awareness of regulatory requirements under the EU AI Act. Companies that follow these fundamentals can harness the technology – without risking a second OpenClaw-style failure.<\/p>\n<\/details>\n Header Image Source: Pexels \/ Lukas Blazek (px:574069)<\/p>\n","protected":false},"excerpt":{"rendered":" 10 min Read Time An Austrian developer builds the world\u2019s most powerful AI agent in his spare time. Within weeks, OpenClaw garners 250,000 GitHub stars, spawns its own bot religion, executes a supply-chain attack against 4,000 developers – and triggers a bidding war between two of the world\u2019s largest tech conglomerates. The story is so […]<\/p>\n","protected":false},"author":205,"featured_media":93743,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_focuskw":"ai agent","_yoast_wpseo_title":"AI Agent: Lessons from OpenClaw's rise and fall","_yoast_wpseo_metadesc":"Digitalisierung: Master AI & business trends. Learn from OpenClaw's rise & adapt your SME strategy today!","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","footnotes":""},"categories":[2214,2027],"tags":[],"class_list":["post-94287","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-kuenstliche-intelligenz","entry"],"wpml_language":"en","wpml_translation_of":93744,"acf":[],"yoast_head":"\nThe Key Takeaways<\/h2>\n
\n
What is OpenClaw – and why did the tech world go crazy?<\/h2>\n
The digital employee who never sleeps<\/h2>\n
\n – MBF Editorial Team<\/cite>\n<\/p><\/blockquote>\nThe dark side: Prompt injection, data leaks, and exploding costs<\/h2>\n
Moltbook: When AI bots allegedly founded their own religion<\/h2>\n
Supply-chain attack: How an npm package hit 4,000 developers<\/h2>\n
\n – MBF Editorial Team<\/cite>\n<\/p><\/blockquote>\nOpenAI and Meta step in – for very different reasons<\/h2>\n
What SMEs should learn from OpenClaw<\/h2>\n
Frequently Asked Questions<\/h2>\n
What exactly is OpenClaw – and how does it work?<\/strong><\/summary>\n
Why is OpenClaw a security risk?<\/strong><\/summary>\n
What was the Cline supply-chain attack?<\/strong><\/summary>\n
What happened to OpenClaw and Moltbook?<\/strong><\/summary>\n
Should SMEs deploy AI agents?<\/strong><\/summary>\n
Editor\u2019s Reading Recommendations<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n