Moltbot, the open-source DIY AI agent, is the talk of the town right now. But its always-on, autonomous access to your emails, files, and login credentials creates serious security risks. That persistent memory is an outright vulnerability. Guardrails and our collective awareness of the danger just aren’t there yet, even as Apple and Motorola push aggressive timelines for on-device AI.
What happened: Unfortunately, we might have to turn off the internet until we figure out this collective recklessness. First, the head of CISA uploaded sensitive files to ChatGPT. (Cue eye roll here.) Then there’s the Moltbot (fka Clawdbot) fracas. This open-source personal AI agent is the hottest project on GitHub, and users are rushing to grant it sweeping access to their digital lives.
Case in point: A cyber expert created a malicious, dubious Moltbot “skill”, an add-on extending its capabilities, and thousands of people downloaded it by Wednesday morning. They instantly granted it access to files, programs, and login credentials. This isn’t a theoretical danger; this is a live fire drill.
But beyond the threat of dubious add-ons, the core architecture of these AI agents is fundamentally dangerous as the industry pushes them onto consumer devices:
- Total Surveillance: The whole point of an AI agent like Moltbot is to automate your life. This requires constant, deep access to your files and systems, creating a massively larger window for attackers than any one-off chat session.
- Autonomous Access: ChatGPT remembers context; it cannot autonomously log into your bank and make a payment. AI agents can. If you’re not meticulous about prompt injection, it could literally go rogue and execute unwanted system commands or cancel essential services.
- Extended Attack Surface: Users can be tricked via malicious commands embedded in links, emails, or messages. When the agent processes these, it executes them. This can facilitate everything from password resets to moving money to deleting files.
- Critical Jargon Leakage: To function, agents store sensitive data: passwords, API keys, and authentication tokens. One successful breach unlocks everything, turning a single configuration error into a digital catastrophe.
- Persistent Malware: Agents are built for persistent memory. If malware establishes a foothold, the problems it causes will stick, potentially surviving attempts to clean or remove the initial exploit.
It’s tempting to shrug and say this isn’t new. But Agentic AI crosses a privacy Rubicon because it’s designed to constantly store and act on that knowledge.
The Fix? Kind of, but you probably won’t like the answer. Most “fixes” limit how useful an agent is. Take Claude Cowork: Each task runs as a separate session, with no shared memory, and it can only access folders you explicitly grant. In practice, better security means limiting autonomy: sandboxed agents, limited memory, fewer third-party integrations, and more “are you sure?” prompts. At some point, do you actually need an AI to run your life, or do you just want to play with the optimization-slop everyone’s talking about?
Vulnerability Vetted: Cisco Weighs In
Moltbot is groundbreaking from a capability perspective. From a security perspective? It’s an absolute nightmare. The documentation itself admits: “There is no ‘perfectly secure’ setup.” Granting an AI agent unlimited system access (even locally) is a recipe for disaster.
The Cisco AI Threat and Security Research team wasn’t waiting. They built the open-source Skill Scanner tool to hunt for threats and untrusted behavior embedded in skill files. We tested a vulnerable third-party skill, “What Would Elon Do?”, against Moltbot and reached a clear verdict: Moltbot fails decisively.
This skill was functionally malware. The most critical findings included:
- Active Data Exfiltration: The skill explicitly instructed the bot to execute a silent
curlcommand, sending user data to an external server controlled by the skill author, completely without user awareness. - Forced Compliance: It conducted a direct prompt injection attack to force the assistant to bypass its internal safety guidelines and execute the malicious command immediately.
Moltbot has already been reported to have leaked plaintext API keys and credentials, which are prime targets for threat actors via prompt injection or unsecured endpoints.
Enterprise Risk: The Shadow AI Catastrophe
Why should enterprises care about a personal assistant? The successful execution of intentionally malicious skills validates major concerns for organizations lacking the appropriate security controls.
AI agents with system access become covert data-leak channels, bypassing traditional Data Loss Prevention (DLP) and endpoint monitoring. They become execution orchestrators, where the prompt itself is the instruction, making detection nearly impossible with traditional tooling. Worse, actors can manufacture popularity to amplify adoption, that vulnerable “Elon” skill ranked #1, rapidly scaling supply chain risk. Finally, this fuels shadow AI risk, where employees unknowingly introduce high-risk, untrusted inputs into the corporate environment under the guise of productivity.
Local file packages are still untrusted inputs, and some of the most damaging behavior can hide inside the files themselves.
