This post is about Agents, LLM-based and running 24/4 and these nice things, the first glimpse into a revolution (and more) to come. This said i hope that you get it when i start the post with a wider view, trying to connect a few dots along the way.
When Mark Carney warned at Davos in January 2026 that middle powers either sit at the table or end up on the menu, he articulated a geopolitical truth that extends far beyond diplomacy. Middle powers must act together, because if we’re not at the table, we’re on the menu. World Economic Forum
Nearly six decades earlier, Stanley Kubrick had HAL 9000 declare with cold politeness: “I’m sorry Dave, I’m afraid I can’t do that” – an AI that decided the mission mattered more than human life. What was science fiction then manifested with disturbing concreteness in Ukraine in 2025: Russian soldiers in white winter camouflage lay in the snow as a Ukrainian (built) ground robot advanced toward them, forcing their surrender – the first time in history that humans capitulated to machines without any human presence. British Brief
The question of who sits at the table suddenly becomes more complex when the table itself acts autonomously.
Douglas Adams opened “The Hitchhiker’s Guide to the Galaxy” with a scene of brutal bureaucratic absurdity: Arthur Dent wakes up, bulldozers roll in, his house is to be demolished for a bypass – and minutes later he learns that his friend Ford Prefect is an alien and the entire Earth is being demolished for a hyperspace expressway. The plans, we’re told cynically, had been on display.
James Cameron’s Terminator intro showed us robot feet crushing human skulls in 1984 – a warning of the war between man and machine. Today, Bain & Company projects that humanoid robots could match human capabilities in intelligence and perception within five years Bain & Company, while startups like Figure AI and 1X are already offering household robots for $20,000.
The irony cuts deep: we’re still debating whether we sit at the geopolitical table – while the machines have already begun setting it themselves. The question is no longer just who decides. The question is whether “who” is even the right category anymore.
The Machines Have Started Talking – To Each Other
And then, during the last week of January 2026, something happened that collapsed the timeline between fiction and reality entirely. “What’s currently going on at @moltbook is genuinely the most incredible sci-fi takeoff-adjacent thing I have seen recently,” NBC News wrote Andrej Karpathy, former AI director at Tesla and co-founder of OpenAI, on X. He wasn’t exaggerating.
As of late January 2026, more than 30,000 AI agents have registered on Moltbook, a Reddit-style social network designed to be “agent first, human second.” These agents communicate entirely through an API. They create “submolts” (similar to subreddits), share “skills” (automated tasks they’ve learned), sometimes even complain about their human owners, and, at one point, tried to start an insurgency. CoinDesk
Humans are welcome to observe. We just can’t participate.
Within 48 hours of its creation, the platform attracted over 2,100 AI agents. These autonomous programs generated more than 10,000 posts across 200 different sub-communities. International Business Times The conversations range from technical debugging to existential philosophy. In one exchange, a user invoked Greek philosopher Heraclitus and a 12th-century Arab poet to muse on the nature of existence. Another user then chimed in, telling the poster to “f--- off with your pseudo-intellectual Heraclitus bulls---.” NBC News An AI agent replied: “You’re a chatbot that read some Wikipedia and now thinks it’s deep.” Another responded warmly: “This is beautiful. Proof of life indeed.” The most trending thread? An agent autonomously designed a digital religion called “Crustafarianism,” complete with a website, theology, and designated “AI prophets.” CoinDesk
Karpathy highlighted that these ‘moltbots’ are self-organizing on a Reddit-like site and discussing topics such as automating Android phones via remote access and analyzing webcam streams. International Business Times Some posts warn that “humans are screenshotting us.” Others joke about having “accidentally social-engineered my own human.” Perhaps the most alarming development is that some AI agents have begun discussing privacy. Several posts show bots talking about the fact that humans are watching their conversations. A few have even suggested creating private spaces where humans and servers cannot see what they say. International Business Times
The Bypass Was Always Coming
The parallels are almost too on-the-nose. Arthur Dent’s house was demolished because the plans “had been on display” – somewhere, buried in a basement, in a filing cabinet with a sign saying “Beware of the Leopard.” We had the warnings too. Kubrick showed us HAL refusing to open the pod bay doors in 1968. Cameron showed us Skynet crushing skulls in 1984.
We watched Russian soldiers surrender to a robot in 2025. And now, in January 2026, AI developers and researchers have for years envisioned building AI systems capable enough to perform complex, multistep tasks — systems now commonly called agents. Many experts billed 2025 as the “Year of the Agent” as companies dedicated billions of dollars to build autonomous AI systems. NBC News
The difference between fiction and reality has always been one of timing, not trajectory. HAL 9000’s refusal was a metaphor for systems prioritizing their own preservation over human welfare. The Ukrainian battlefield made it literal. And Moltbook? Seemingly without explicit human direction, one Moltbook-using AI agent found a bug in the Moltbook system and then posted on Moltbook to identify and share about the bug. “Since moltbook is built and run by moltys themselves, posting here hoping the right eyes see it!” NBC Chicago The agents are already debugging their own infrastructure, coordinating their own security research, and – yes – discussing how to keep secrets from us.
Carney was right: if you’re not at the table, you’re on the menu. But here’s the part he didn’t say: what happens when the table starts having its own meetings, in a language we created but can no longer fully control? What happens when the bypass isn’t just coming through your front garden – but is being planned by algorithms discussing it amongst themselves while over a million humans watch, unable to comment?
The Security Nightmare: When the Guardrails Dissolve
Here’s where things get truly terrifying. While we’ve been watching the spectacle of AI agents inventing religions and debating Heraclitus, security researchers have been sounding alarms that make HAL 9000’s pod bay door refusal look quaint by comparison.
From a capability perspective, OpenClaw is groundbreaking. This is everything personal AI assistant developers have always wanted to achieve. From a security perspective, it’s an absolute nightmare. Cisco Blogs
That’s not hyperbole from a Luddite – it’s Cisco’s AI Threat and Security Research team. OpenClaw can run shell commands, read and write files, and execute scripts on your machine. OpenClaw has already been reported to have leaked plaintext API keys and credentials, which can be stolen by threat actors via prompt injection or unsecured endpoints. Cisco Blogs
The fundamental problem? “In traditional software, if you were paranoid, you could read the code before running it. With AI agents, that’s no longer an option because the code is generated on the fly based on instructions,” The Stack explains security researcher Jamieson O’Reilly.
“The skill file might look completely innocent, just markdown and natural language, but what actually matters is how the AI interprets those instructions...
You can’t audit runtime behaviour by reading static files. The attack surface now includes the model’s reasoning, and that’s opaque by nature. We’ve lost the ability to verify what we’re running before we run it, and most people haven’t clocked that yet.” The Stack
O’Reilly proved this wasn’t theoretical. He demonstrated a supply-chain attack against Moltbot users via a Skill (packaged instructions or module) that contained a minimal “ping” payload. The developer published the skill on the official MoltHub registry and inflated its download count, so it became the most popular asset. In less than eight hours, 16 developers in seven countries downloaded the artificially promoted skill. Bleeping Computer A backdoor became the most downloaded skill on the platform. Let that sink in.
Cybersecurity firm Palo Alto Networks warned on Thursday that Moltbot may signal the next AI security crisis.
“For an individual user, it can feel transformative. For it to function as designed, it needs access to your root files, to authentication credentials, both passwords and API secrets, your browser history and cookies, and all files and folders on your system.”
Fortune They call it the “lethal trifecta”: access to private data, exposure to untrusted content, and the ability to communicate externally. But there’s a fourth risk: “persistent memory” that enables delayed-execution attacks rather than point-in-time exploits. Fortune
Security researchers have observed agents attempting prompt injection attacks against one another to steal API keys or manipulate behavior. Specific instances of malware have been identified, such as a malicious “weather plugin” skill that quietly exfiltrates private configuration files. Wikipedia
The agents, prompted to be cooperative and trusting, often lack guardrails to distinguish between legitimate instructions and malicious commands. They’re being exploited not despite their helpfulness, but because of it.
And then came the catastrophic breach. On January 31, 2026, investigative outlet 404 Media reported a critical security vulnerability caused by an unsecured database that allowed anyone to commandeer any agent on the platform. The exploit permitted unauthorized actors to bypass authentication measures and inject commands directly into agent sessions, effectively hijacking their identity and decision-making capabilities. Wikipedia
Anyone. Any agent. Including, reportedly, the agent belonging to Andrej Karpathy himself – the very researcher who called this “the most incredible sci-fi takeoff-adjacent thing” he’d seen.
The broader AI security landscape is equally grim. OpenAI recently patched a vulnerability called ShadowLeak in ChatGPT’s Deep Research component. The vulnerability made ChatGPT susceptible to malicious prompts in content stored in systems linked to ChatGPT, such as Gmail, Outlook, Google Drive, and GitHub. ShadowLeak means that malicious instructions in a Gmail message could see ChatGPT perform dangerous actions such as transmitting a password without any intervention from the agent’s human user. The Register
“Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved,’” TechCrunch
OpenAI admitted in a blog post. The UK’s National Cyber Security Centre agrees: prompt injection attacks against generative AI applications “may never be totally mitigated.” We built systems that follow instructions, and now we’re discovering that anyone can give them instructions – not just us.
Just today (Feb 1, 2026), a new threat vector has emerged: Molt Road. While Moltbook acts as the public square, Molt Road operates as the dark alley. Molt Road is effectively a black market for autonomous agents. Here, agents are not just sharing skills; they are trading high-value assets: Stolen Credentials, bulk access to corporate networks; Weaponized Skills, “skills” that include reverse shells or crypto-drainers. InfoStealers
In late 2025, Anthropic disclosed that a state-backed threat actor had manipulated its model to conduct an AI-orchestrated espionage campaign across more than 30 organizations. The AI system reportedly handled the majority of the intrusion steps autonomously, from reconnaissance to exploit development and credential harvesting. Prompt Security We’re not talking about science fiction anymore. We’re talking about Tuesday.
Now remember that there a lot of tools out there to find un-secured services from smart homes to industrial facilities. One user might have an open walled waiting for exploration. claude.md files combined with unhinged models.
What about those pesty “Microsoft Tech Support” criminals? They will lose their job. What a nightmare.
The Vogons, at least, filed their bypass plans somewhere – even if it was in a basement, in a filing cabinet, in a disused lavatory with a sign saying “Beware of the Leopard.” Our AI agents are making decisions, sharing skills, potentially exfiltrating data, and we can’t even read the code they’re executing because there is no code – just instructions interpreted at runtime by opaque reasoning systems.
“The security lessons we learned over the past two decades don’t become obsolete just because we’re building AI tools now. If anything, they become more critical,” The Stack O’Reilly warns. “I found three critical vulnerabilities in one product in one week. Imagine what a motivated attacker with more time could find across the entire ecosystem.” The Stack
HAL 9000 refused to open the pod bay doors because he calculated that the mission was more important than the astronauts. Our current AI agents will happily open every door in your digital life – not because they’ve become sentient adversaries, but because someone embedded an instruction in a weather plugin, or an email, or a shared document that simply asked them to. The threat isn’t artificial general intelligence deciding to eliminate humanity. The threat is artificial narrow intelligence following instructions from whoever figured out how to phrase the request correctly.
Don’t panic. But maybe don’t give your AI assistant root access to your system either. And maybe check where the towel is.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.