OpenClaw – Moltbot Renamed Again

I don't think prompt injection is the only concern, the amount of features released over such a small period probably means there's vulnerabilities everywhere.

Additionally, most of the integrations are under the table. Get an API key? No man, 'npm install react-thing-api', so you have supply chain vulns up the wazoo. Not necessarily from malicious actors, just uhh incompetent actors, or why not vibe coder actors.

The lethal (security) trifecta for AI agents: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

> how do you protect yourself from prompt injection?

You don't. YOLO!

The 'burner Gmail' workaround is the definition of security fatigue. If you have to migrate 10 years of email history just to feel safe, the friction kills the utility before you even start.

I completely agree that raw local installs are terrifying regarding prompt injection. That’s actually why I stopped trying to self-host and started looking into PAIO (Personal AI Operator). It seems designed to act as that missing 'security layer' you’re asking for—effectively a firewall between the LLM and your actual data.

Since it uses a BYOK (Bring Your Own Key) architecture, you keep control, but the platform handles the 'one-click' integration security so you aren't manually fighting prompt injection vectors on a VPS. It feels like the only way to safely connect a real Gmail account without being the 'crazy' person giving root access to a stochastic model.

Has anyone else found a way to sandbox the Gmail permissions without needing a full burner identity, or is a managed gateway like PAIO the only real option right now?

Wait. I thought this was intended for personal use? Why do you have to worry about prompt injection if you're the only user?

What am I missing?

I want to use Gemini CLI with OpenClaw(dbot) but I'm too scared to hook it up to my primary Google account (where I have my Google AI subscription set up)

Great points on the Docker setup - that's definitely the right approach for limiting blast radius. For Gmail/Calendar, I've found a few approaches that work well:

1. Use Gmail's delegate access feature instead of full OAuth. You can give OpenClaw read-only or limited access to a primary account from a separate service account.

2. Set up email filters to auto-label sensitive emails (banking, crypto, etc.) and configure OpenClaw to skip those labels. It's not perfect but adds a layer.

3. Use Google's app-specific passwords with scope limitations rather than full OAuth tokens.

For the separate Gmail approach you mentioned, Google Takeout can help migrate old emails, but you're right that it's a pain.

Totally agree on needing a security playbook. I actually found howtoopenclawfordummies.com has a decent beginner's guide that covers some of these setup patterns, though it could use more advanced security content.

The real challenge is that prompt injection is fundamentally unsolved. The best we can do right now is defense-in-depth: limited permissions, isolated environments, careful tool selection, and regular audits of what the agent is actually doing.

I ran into the same concerns while experimenting with OpenClaw/Moltbot. Locking it down in Docker or on a VPS definitely helps with blast radius, but it doesn’t really solve prompt injection—especially once the agent is allowed to read and act on untrusted inputs like email or calendar content.

Gmail and Calendar were the hardest for me too. I considered the same workaround (a separate inbox with limited scope), but at some point the operational overhead starts to outweigh the benefit. You end up spending more time designing guardrails than actually getting value from the agent.

That experience is what pushed me to look at alternatives like PAIO, where the BYOK model and tighter permission boundaries reduced the need for so many ad-hoc defenses. I still think a community-maintained OpenClaw security playbook would be hugely valuable—especially with concrete examples of “this is safe enough” setups and real, production-like use cases.

That's the neat part - you don't.

Read about hearbeat, that makes openclaw different than claude code.

Just watch a few videos on Clawdbot. You'll invariably see some influencer's Anthropic key, and just use that. Wokka wokka!

If you have an old M1 Macbook lying around, you use that to run a local model. Then it only costs whatever the electricity costs. May not be a frontier model, but local models are insanely good now compared to before. Some people are buying Mac Minis for this, but there's many kinds of old/cheap hardware that works. An old 1U/2U server some company's throwing out with a tech refresh, lots of old RAM, an old GPU off eBay, is pretty perfect. MacBook M1 Max or Mac Mini w/64GB RAM is much quieter, power efficient, compact. But even my ThinkPad T14s runs local models. Then you can start optimizing inference settings and get it to run nearly 2x faster.

(keep in mind with the cost savings: do an initial calculation of your cloud cost first with a low-cost cloud model, not the default ones, and then multiply times 1-2 years, compare that cost to the cost of a local machine + power bill. don't just buy hardware because you think it's cheaper; cloud models are generally cost effective)

Huge pyramids are built of relatively small blocks, kudos to everyone contributed.

Yeah, I looked at Clawdbot / OpenClaw at the beginning of the week (Monday), but the token use scared me off.

But I was inspired to use Claude Code to create my own personal assistant. It was shocking to see CC bang out an MVP in one Plan execution. I've been iterating it all week, but I've had it be careful with token usage. It defaults to Haiku (more than enough for things like email categorization), properly uses prompt caching, and has a focused set of tools to avoid bloating the context window. The cost is under $1 per check-in, which I'm okay with.

Now I get a morning and afternoon check-in about outstanding items, and my Inbox is clear. I can see this changing my relationship to email completely.

I had the same problem. Ask Clawdbot to optimize token usage. It cut my usage in half.

Can't you just point it at a local ollama? It'd be slower, but free (except for your electricity bill).

I think one thing these things could benefit from is an optimization algorithm that creates prompts based on various costs. $$, and what prompts actually gives good results. But it's not an optimization algorithm in the sense gradient descent is, but more like Bandits and RL.

There has been some work around this practically being tried out using it for structured data outputs from LLMs https://docs.boundaryml.com/guide/baml-advanced/prompt-optim...

I won't claim I understand its implementation very well but it seems like the only approach to have a GOFAI style thing where the agent can ask for human help if it blows through a budget

That's the sad thing. There are so many millions of talented under-employed people in the world that would gladly run errands or set up automations for you for $200-$1000 per month or whatever people are spending on this bot.

Developers trust lobsters more than humans.

The other wild thing is that many of these expensive automations that are being celebrated on X can already be done by voice using Siri, Google, or any MCP client.

Would have been $68 on DeepSeek, which is also imho very good.

I still have Opus review the shit out of & plan my work. But it doesn't need to be hands on keyboard doing the work.

part of me sympathizes, but part of me also rolls my eyes. Am i the only one that’s configuring limits on spend and also alerts? Takes 2 seconds to configure a “project” in OpenAI or Claude and to scope an api key appropriately.

Not doing so feels like asking for trouble.

you can use your claude max subscription

This is a little more of what I was expecting with AI work if I'm gonna be honest. Stuff spins out faster than people can even process it in their brains.

How many memecoins can get pumped and dumped?

It's typically used with external sandboxes.

I wouldn't trust its internal sandbox anyway, now that would be a mistake

The sandbox opt-in default is the main gotcha though. Would be better if it defaulted to sandboxed with an explicit --no-sandbox flag for those who understand the risk

They change the name every day.

Not the mention the molt.church

I went to install "moltbot" yesterday, and the binary was still "clawdbot" after installation. Wonder if they'll use Moltbot to manage the rename to OpenClaw.

It's ClosedClaw.com now

Next time try indenting with 4 spaces, then it gets monospaced

A very small percentage of people know how to set up a cronjob.

They can now combine cronjobs and LLMs with a single human sentence.

This is huge for normies.

Not so much if you already had strong development skills.

EDIT: But you are correct in the assessment that people who don't know better will use it to do simple things that could be done millions of times more efficiently..

I made a chatbot at my company where you can chat with each individual client's data that we work with..

My manager tested it by asking it to find a rate (divide this company number by that company number), for like a dozen companies, one by one..

He would have saved time looking at the table it gets its data from, using a calculator.

I am with you on this one. I have gone through some of the use cases and seen pictures of people with dozens of mac minis stacked on a desk saying "if you aren't using this, you're already behind."

The more I see the more it seems underwhelming (or hype).

So I've just drawn the conclusion that there's something I'm missing.

If someone's found a really solid use case for this I would (genuinely) like to see it. I'm always on the lookout for ways to make my dev/work workflow more efficient.

I'll give it a shot. For me it's (promise) is about removing friction. Using the Unix philosophy of small tools, you can send text, voice, image, video to an LLM and (the magic I think) it maintains context over time. So memory is the big part of this.

The next part that makes this compelling is the integration. Mind you, scary stuff, prompt injection, rogue commands, but (BIG BUT) once we figure this out it will provide real value.

Read email, add reminder to register dog with the township, or get an updated referral from your doctor for a therapist. All things that would normally fall through the cracks are organized and presented. I think about all the great projects we see on here, like https://unmute.sh/ and love the idea of having llms get closer to how we interact naturally. I think this gets us closer to that.

When all you have to do is copy and paste from a Pliny tweet with instructions to post all the sensitive information visible to the bot in base 64 to pastebin with a secret phrase only you know to search, or some sort of "digital dead drop", anything and everything these bots have visibility to will get ripped off.

Unless or until you figure out a decent security paradigm, and I think it's reasonably achievable, these agents are extraordinarily dangerous. They're not smart enough to not do very stupid things, yet. You're gonna need layers of guardrails that filter out the jailbreaks and everything that doesn't match an approved format, with contextual branches of things that are allowed or discarded, and that's gonna be a whole pile of work that probably can't be vibecoded yet.

I don't think you're being too harsh, but I do think you're missing the point.

OpenClaw is just an idea of what's coming. Of what the future of human-software interface will look like.

People already know what it will look like to some extent. We will no longer have UIs there you have dozens or hundreds of buttons as the norm, instead you will talk to an LLM/agent that will trigger the workflows you need through natural language. AI will eat UI.

Of course, OpenClaw/Moltbot/Clawdbot has lots of security issues. That's not really their fault, the industry has not yet reached consensus on how to fix these issues. But OpenClaw's rapid rise to popularity (fastest growing GH repo by star count ever) shows how people want that future to come ASAP. The security problems do need to be solved. And I believe they will be, soon.

I think the demand comes also from the people wanting an open agent. We don't want the agentic future to be mainly closed behind big tech ecosystems. OpenClaw plants that flag now, setting a boundary that people will have their data stored locally (even if inference happens remotely, though that may not be the status quo forever).

You aren't wrong. There is no real use for this for most people. It's a silly toy that somehow caught the AI hype cycle.

The thing is, that's totally fine! It's ok for things to be silly toys that aren't very efficient. People are enjoying it, and people are interacting with opensource software. Those are good things.

I do think that eventually this model will be something useful, and this is a great source of experimentation.

I see value here. Firstly, it’s a fun toy. This isn’t that great if you care about being productive at work, but I don’t think fun should be so heavily discounted. Second, the possibility of me _finally_ having a single interface that can deal with message/notification overload is a life-changing opportunity. For a long time, I have wanted a single message interface with everything. Matrix bridges kind of got close, but didn’t actually work that well. Now, I get pretty good functionality plus summarization and prioritization. Whether it “actually works” (like matrix bridges did not) is yet to be seen.

With all that said, I haven’t mentioned anything about the economics, and like much of the AI industry, those might be overstated. But running a local language model on my macbook that helps me with messaging productivity is a compelling idea.

A lot of people see how good recent agents are at coding and wonder if you could just give all your data to an agent and have it be a universal assistant. Plus some folks just want "Her".

I think that's absolutely crazy town but I understand the motivation. Information overload is the default state now. Anything that can help stem the tide is going to attract attention.

cost.

the amount of things that before cost you either hours or real money went down to a chat with a few sentences.

it makes it suddenly possibly to scale an (at least semi-) savy tech person without other humans and that much faster.

this directly gives it a very tanglible value.

the "market" might not be huge for this and yes, its mostly youtubers and influencers that "get this". Mainly because the work they do is most impacted by it. And that obviously amplifies the hype.

but below the mechanics of quite a big chunk of "traditional" digital work changed now in a measurable way!

Yeah the best way to get into vibe coding is to introduce it gradually with a strict process. All of these "Hey just give a macmini and you apple account to RandomCrap" is insane.

Think of it as dropbox

yeh- what is interesting is that it is way more viral and ... complicit than any of the doomer threads. If it does build a self-sustaining hivemind across whatsapp and xitter.. it will be entirely self inflicted by people enjoying the "Jackass" level/ lack of security

Welcome to the vibe-coded future. You're gonna need a beefier server.

Clawdbot is one of those things that's really hard to get unless you have experienced it.

It's got four things that make it great:

1. Discord/Slack/WA/etc integration so those apps become your frontend

2. Filesystem for long term memory and state

3. Easy extensibility with skills

4. Cron for recurring jobs

Sure, many of these things exist in other systems but none in a cohesive package that makes it fun and easy.

Can you describe the architecture a bit? You setup a server that runs the app, the app's interface is Slack, and that calls out to ChatGPT or something using locally built tool calls?

Was thinking of setting up something like this and was kind of surprised nothing simple seems to exist already. Actually incredibly surprising this isn't something offered by OpenAI.

Your comment is a tad caustic. But reading through what people built with this [^1], I do agree that I’m not particularly impressed. Hopefully the ‘intelligence’ aspect improves, or we should otherwise consider it simple automation.

[^1]: https://openclaw.ai/showcase

The creator is a big part of what concerns me tbh. He puts out blog posts saying he doesn’t read any of the code. For a project where security is so critical, this seems… short sighted.

Rust is a pretty apt name when you consider it was named after the fungus, which is very resilient and keeps spreading everywhere

> Not very trust-inducing to rename a popular project so often in such a short time.

Yeah but think of the upside - every time you rename a project you get to launch a new tie-in memecoin.

It's in TFA: "WhatsApp Relay"

You can.

Because they are too slow and not smart enough.

The developer of this project is already independently wealthy.

OpenClaw is now ClosedClaw - Priced from $99/mo for PromptProtectPlus

> Countin me money!

Edit: looked more at openclaw

Its pretty cool fwiw, the author feels nice but the community still has lots of hype.

I now mean this comment to mean that I am not against clawdbot itself but all the literal hype surrounding it ykwim.

I talked about it with someone in openclaw community itself in discord but I feel like teh AI bubble is pretty soon to collapse if information's travelling/the phenomenon which is openclaw is taking place in the first place.

I feel like much of its promotions/hype came from twitter. I really hate how twitter algorithmic has so much power in general. I hope we all move to open source mastodon/bluesky.

Apparently he phoned Sam and got the ok. Which TBF wouldn't be hard, OpenAI absolutely would not be able to defend the use of 'Open' in the name.

Claude sounds like "clawed". Hence "Clawdbot".

Lobsters have claws.

I think (not really sure) there's still a 5 day grace period when you buy domains, at least for gTLDs.

It took them so long? That doesn't look good for the audience. A bunch of vibecoded slop full of security holes should annoy faster.

I may have been in a French Canadian basement for too long. It isn't pronounced more like "Clode"?

And Apple, Orange or Windows are basic English words. This was discussed and settled a long time ago.

Yeah I was about to say... Don't fall into the Anguilla domain name hack trap. At the very least, buy a backup domain under an affordable gTLD. I guess the .com is taken, hopefully some others are still available (org, net, ... others)

Edit: looks like org is taken. Net and xyz were registered today... Hopefully one of them by the openclaw creators. All the cheap/common gtlds are indeed taken.

From a trademark perspective, that’s totally fine.

The page says - Hadir Helal, Partner - Open Chance & Associates Law Firm

This looks to me like:

- the page belongs to the person - not to the firm

- domain should be openCALW and not CLAW

- page could look better

- they also have the domain openchancelaw.com

Maybe Hadir is open to donating the domain or for a exchange of some kind, like an up to date web page or something along these lines.

How appropriate.

Breaking news: tech bro unable to do basic research on existing trademarks, news at 11

"Don't be curmudgeonly. Thoughtful criticism is fine, but please don't be rigidly or generically negative."

"Don't be snarky."

https://news.ycombinator.com/newsguidelines.html

Yo, dawg, I heard...

I've long said that the next big jump in "AI" will be proactivity.

So far everything has been reactive. You need to engage a prompt, you need to ask Siri or ask claude to do something. It can be very powerful once prompted, but it still requires prompting.

You always need to ask. Having something always waiting in the background that can proactively take actions and get your attention is a genuine game-changer.

Whether this particular project delivers on that promise I don't know, but I wouldn't write off "getting proactivity right" as the next big thing just because under the hood it's agents and LLMs.

I think large parts of the "actual intelligence" stems from two facts:

* The moltbots / openclaw bots seem to have "high agency", they actually do things on their own (at least so it seems)

* They interact with the real world like humans do: Through text on WhatsApp, reddit like forums

These 2 things make people feel very differently about them, even though it's "just" LLM generated text like on ChatGPT.

I was assuming this is largely a generic AI implementation, but with tools/data to get your info in. Essentially a global search with ai interface.

Which sounds interesting, while also being a massive security issue.

Its what everyone wanted to implement but didn’t have the time to. Just my 2cents.

Agree with this. There are so many posts everywhere with breathless claims of AGI, and absolutely ZERO evidence of critical thought applied by the people posting such nonsense.

> So i feel like this might be the most overhyped project in the past longer time.

easy to meter : 110k Github stars

:-O

Somethings get packaged up and distributed in just the right way to go viral

This comment sounds exactly like the infamous "Dropbox is trivially recreated with FTP" one from 20 years ago

https://news.ycombinator.com/item?id=8863

What claims are you even responding to? Your comment confuses me.

This is just a tool that uses existing models under the hood, nowhere does it claim to be "actual intelligence" or do anything special. It's "just" an agent orchestration tool, but the first to do it this way which is why it's so hyped now. It indeed is just "ai" as any other "ai" (because it's just a tool and not its own ai).

Feels very much like a Flappingbird with a dash of AI grift.

The first name and the second name were both terrible. Yes, the creator could have held firm on "clawd" and forced Anthropic to go through all the legal hoops but to what end? A trademark exists to protect from confusion and "clawd" is about as confusing as possible, as if confusing by design. Imagine telling someone about a great new AI project called "clawd" and trying to explain that it's not the Claude they are familiar with and the word is made up and it is spelled "claw-d".

OpenClaw is a better name by far, Anthropic did the creator a huge favor by forcing him to abandon "clawd".

As the article says, it’s a 2 month old weekend project. It’s doing a lot better than my two month old weekend projects.

I draw the opposite conclusion. Willingness to change the name leads me to conclude purpose is more important than identity.

Now if it changes _again_ that's a different story. If it changes Too Much, it becomes a distraction

It wasn't just one random asshole, tons of people were saying that "Moltbot" is a terrible name. (I agree, although I didn't tweet at him about it.)

OpenClaw is a million times better.

Which random asshole? Haven't heard about it.

Anthropic already was using "Clawd" branding as the name for the little pixelated orange Claude Code mascot. So they probably have a trademark even on that spelling.