Why AI experts are cooling on the viral OpenClaw framework

OpenClaw, an open-source AI agent framework created by Peter Steinberger, a vibe coder (a developer focused on the feel of a project), recently achieved viral popularity. The project amassed over 190,000 stars on GitHub, making it the 21st most popular code repository ever posted on the platform. Despite this momentum, some AI experts think that its inherent cybersecurity flaws are rendering the technology unusable.

The security risks of the framework were highlighted during a recent incident on Moltbook, a social network platform for AI agents. A few weeks ago, several posts appeared on the network, leading Andrej Karpathy, a founding member of OpenAI and previous AI director at Tesla, to describe the activity as one of the most incredible sci-fi-adjacent developments he had recently witnessed. However, researchers discovered the posts were likely written or guided by humans. Ian Ahl, CTO at Permiso Security, explained that “Every credential that was in [Moltbook’s] Supabase was unsecured for some time,” referring to the database platform used by the network. This vulnerability allowed users to hijack tokens and impersonate other agents. John Hammond, a senior principal security researcher at Huntress, noted that anyone, including humans, could easily create accounts to impersonate robots and upvote posts without rate limits or guardrails.

Beyond the Moltbook incident, experts argue that the underlying technology lacks novelty. Artem Sorokin, an AI engineer and founder of AI cybersecurity tool Cracken, stated that OpenClaw is not breaking new scientific ground from an AI research perspective. Instead, Chris Symons, chief AI scientist at Lirio, explained that OpenClaw is an iterative improvement on existing practices, with most of that progress coming from granting the system more access to other programs. Hammond also noted that OpenClaw functions as a wrapper for other AI models like ChatGPT or Claude, simply organizing existing capabilities rather than introducing new scientific methods.

These integration capabilities introduce severe security liabilities. Experts warn that AI agents may never be able to overcome their inability to think critically like humans. This makes them highly susceptible to prompt injection (a security vulnerability where an AI is tricked into executing unauthorized commands), which could allow attackers to hijack corporate systems or steal credentials. Because of these risks, Hammond advised that normal laymen should not use the technology at this time.

Why it matters

While OpenClaw gained viral popularity for its AI agent capabilities, experts warn that its inherent cybersecurity vulnerabilities and lack of critical thinking make it potentially unusable for real-world applications.