AI researcher and author Gary Marcus is worried about those viral agents and their social network.
Animated lobsters flooded X last week. First, it was OpenClaw (previously called Moltbot and Clawdbot before Anthropic came knocking). The AI agent runs locally and can independently make decisions on common consumer apps without human supervision.
Then came Moltbook, the Reddit-like social forum where AI agents post and comment. No humans are allowed — though it appears some humans may have managed to sneak their way in.
Marcus is known to pour cold water on the most hot-headed AI fanatics. It’s in the title of his book: “Taming Silicon Valley.” The entrepreneur and scientist founded Geometric Intelligence, a machine-learning startup he later sold to Uber. Now, he advocates for AI regulation and risk consideration.
His take on these new tools was no different. In a Substack post, he was blunt. “If you care about the security of your device or the privacy of your data, don’t use OpenClaw,” he wrote. “Period.”
Curious to hear more about his thoughts on the latest viral moment in AI, we followed up with Marcus over email for a short Q&A, which was lightly edited for clarity.
Here’s what he had to say about those AI agents popping up everywhere.
Let’s start with OpenClaw. When did you first run into it, and what was your reaction?
I think it was called something different then, oh so many days ago (seven?). My immediate reaction is, this is just like AutoGPT and it will be a complete security disaster if it becomes popular. Maybe, if we are lucky, it will become a teachable moment and the damage will be modest.
Why do you think OpenClaw grew so popular (at least online)?
I imagine it is super fun to play with, and it must make users feel like they have an express ticket to the future. Personally I wouldn’t touch it.
You compare OpenClaw to AutoGPT. How are they similar and different?
They are both basically connectors between LLMs and services. The underlying LLMs are better now than in 2023, but the security risks are roughly the same: immense. It’s like giving full access to your computer and all your passwords to a guy you met at a bar who says he can help you out. Yeah, maybe.
Is there any secure use of OpenClaw? What about those who have already set it up — what should they do?
I doubt there is any real secure use. Personally I would stop running it and try to uninstall it and change passwords for banks and things like that.
OpenClaw creator Peter Steinberger said he’s taken steps to make it more secure. (Here’s one example.) What do you think of these efforts?
Noble, but maybe like putting a finger in dike to hold off a flood?
Moving to Moltbook. Is there any argument to set your agent live on the site?
You like living dangerously?
On TBPN, Matt Schlicht made the argument that startups should build businesses “on top of Moltbook.” What do you think of his proposal?
Good luck to you. Don’t blame me if your customer base gets scammed because of prompt injection attack you didn’t notice.
Meta’s CTO, Andrew Bosworth, said that he didn’t find Moltbook interesting, because these agents were trained to speak like humans. Thoughts?
Facebook did actually have some related experiments years and years ago; he’s right that we shouldn’t be entirely surprised. The interest comes mostly from the scale.
Will we be talking about Moltbook in two weeks, or is this just another meme cycle?
I don’t know. AutoGPT exploded like a rocket in March 2023 and faded because of issues around reliability and accuracy; I wouldn’t be surprised if this is just another fad, like Sora videos or pet rocks. But we’ll see.
