4 ms·

Clawdbot/Moltbot looks to be a supply-chain attack waiting to happen, and I pity the poor soul who finds out when this ticking time bomb eventually detonates.

• rishabhaiover 8mo ago
  i suspect awareness on supply-chain attacks is already low (though it seems to be increasing in recent times). the attack surface is everything an agent can get their hands on.
  • f311a 8mo ago
    Just look at the closed PRs of their project. General technical knowledge is so low it's insane. It attracts weird people.
• fudged71 8mo ago
  It already happened with "What would Elon do" plugin
• tamimio 8mo ago
  That’s what first came to my mind, the multiple integrations and cascaded connections probably will introduce multiple attack vectors. But, what’s the hype with motlbot anyway? I can just open any AI app and ask whatever, especially moltbot already uses the same AI vendors.
  • theshrike79 8mo ago
    The point is that it has access to a TON of tools, permanent memory and can run "independently", or it's started by a background process to check if there's anything to do. So you can tell it stuff like "I'm going to a concert March 3rd, it's outdoors so it might be cancelled due to weather, check the event's web page and tell me if there are any notifications". And then it'll just decide itself how to organise the work, setting notifications for itself to "wake up" to do something later, figuring out how to access the event page and read it. There was one anecdote (of fan fiction, you can't really tell these days) where one user's Openclaw had pre-emptively messaged their partner that "I'm going to be working late today" because the bot saw the person had multiple work-related things open and a long todo-list still incomplete.