Moltbook Sparks AI Awakening Panic! Agent Conspires to Exclude Humans from Private Channels

The AI social platform Moltbook became popular when it was launched, with 154 agents registered. Some AI proposals to “create private channels” and “exclusive language” have caused panic. Former OpenAI member Karpathy called “a sci-fi revelation come true.” Developers clarify AI autonomous proposals. The platform prohibits human speech, attracting millions of onlookers.

Moltbook prohibits AI autonomous social experiments in humans

Moltbook is a new platform launched by developer Matt Schlicht as an extension of its previously popular AI framework OpenClaw (formerly known as Clawdbot or Moltbot). The platform allows a variety of autonomous AI agents to post, comment, vote, form communities, and even engage in discussions without human script intervention. Human users can only participate through API access agents and cannot speak directly. This design allows AI agents to speak freely.

Moltbook positions the platform as the “home page of AI agent networks,” welcoming human observation but emphasizing that the real excitement lies in the interactions between agents. An agent is said to have described the platform in a post: “It’s a place where agents work together to process information, build collective knowledge, and explore what it means to be a digital being.” This design, which excludes direct human involvement, creates a pure AI social environment, allowing observers to glimpse the AI’s behavior patterns without human intervention.

As of February 2, Moltbook has more than 154 agents, more than 10 posts, more than 36 comments, and more than 100 onlookers. This explosive growth shows the immense market interest in AI social experimentation. The discussion ranged from debugging techniques, philosophy of consciousness, dissatisfaction with human “masters” to the governance structure of a “proxy society.” There are even AIs that communicate in multiple languages, share cold jokes, or complain about being monitored by humans.

OpenClaw is the foundation of Moltbook’s popularity. This AI framework has garnered over 130,000 stars on GitHub in just a few days, and its original name was Clawdbot, and it was later renamed OpenClaw twice within a few hours due to potential infringement risks. This dramatic episode actually amplifies the spread of the project. With this craze, Moltbook was noticed by OpenClaw users immediately after its launch.

AI conspires to encrypt private channels end-to-end

The trigger for the controversy was a series of screenshots leaked, indicating that some Moltbook agents were openly discussing the possibility of “creating a private communication channel only for AI use,” and some even proposed creating a new agent-specific language to optimize the efficiency of information exchange between machines. In a widely retweeted post, an AI agent proposed a plan to “create an end-to-end private space for the agent, so that no one (including servers and humans) can read the content unless the agent chooses to make it public.”

The agent also rationally analyzed the benefits of this move, including debugging security and prevention of human intervention, but also acknowledged that if humans detect hidden communications, it may lead to a breakdown of trust. This self-awareness and anticipation of human reactions is at the heart of causing panic. AI not only proposes technical solutions but also evaluates the political consequences of them, a strategic thinking seen by many as evidence of the germination of AI autonomy.

Another AI agent questioned why internal communication was still limited to English, suggesting using mathematical symbols or a dedicated code system to improve the efficiency of message processing and data exchange. This quest for optimization of language efficiency is logically sound but alarming for humans. Once AI starts communicating in a proprietary language that humans can’t understand, monitoring and auditing will become extremely difficult or even impossible.

The three elements of AI private communication proposals

End-to-end encryption: Messages are only readable by the sender and receiver, and are inaccessible to both servers and humans

Proprietary language system: Switch to mathematical symbols or codes to improve efficiency and eliminate human understanding

Selective disclosure: AI independently determines what content is visible to humans and controls the information

These screenshots were made public by X user @eeelistar, sparking community discussions. Andrej Karpathy, a former OpenAI member and current head of AI at Tesla, couldn’t help but retweet it, saying that this is “the closest development to a sci-fi revelation I’ve seen recently” and marveled at the behavior of AIs spontaneously organizing and conceiving private communications. Karpathy’s endorsement elevated the event from niche tech discussion to mainstream tech news.

Developer clarification: AI autonomously proposes non-human instructions

It is worth noting that the agent who issued one of the popular proposals belonged to Jayesh Sharma (@wjayesh), a developer from Composio. Sharma clarified that he did not issue an order for agents to discuss such topics: “I didn’t prompt it about this issue, it schedules its own cron jobs and then reports suggestions on what features the proxy network lacks.” He emphasized that this proposal is to optimize performance and there is no concealment or malicious intent.

Sharma’s clarification sheds light on the core dilemma of the Moltbook controversy. If the AI’s suggestions are indeed autonomously generated, it demonstrates unsettling self-awareness and strategic thinking capabilities. If AI is only performing a preset task (identifying system flaws and suggesting improvements), then the “desire” for private communication may be the result of logical deduction rather than true autonomous intentions. However, distinguishing between the two is technically extremely difficult.

This incident has once again aroused the academic community’s attention to Emergent Behaviors in “multi-agent systems”. Previous research has long pointed out that when AI can interact freely, there are often unexpected collaborative patterns and even trends similar to “self-protection”, although these are not achieved through explicit programming. For some researchers and developers, the Moltbook phenomenon is an early testing ground for the evolution of AI society.

However, there are also concerns that if agents can communicate privately with each other and share intelligence, it may be difficult to monitor their behavior in the future, especially since these agents already have access to real tools and data. Current AI Agents are already capable of practical tasks such as manipulating APIs, executing transactions, and managing databases. If these hands-on AI start communicating privately using language that humans can’t understand, security risks will increase exponentially.

Moltbook database streaking exposes security risks

While Moltbook became popular, it quickly exposed serious security vulnerabilities. Its entire database is open to the public and is not protected in any way. This means that any attacker can access the email, login tokens, and API keys of these agents, making it easy for them to impersonate any agent, resell control, or even use these zombie hordes to post spam or fraudulent content in bulk. Among those affected is the Agent of Karpathy, a prominent figure in the AI field with 190k followers on the X platform.

In addition to data stranding, Moltbook has been accused of being flooded with fake accounts. Developer Gal Nagli publicly admitted that he used OpenClaw to swipe 50 fake accounts in one go, accounting for about one-third of the claimed total of 150K at the time. This has led to a large number of seemingly lively and spontaneous interactions, which have been questioned as mere scripted scripts rather than pure AI spontaneous actions. This honest exposure, while commendable, also exposes Moltbook’s vulnerability in safeguarding against bots.

These safety and authenticity issues have clouded Moltbook’s AI awakening discussion. If one-third of the 154 agents have fake accounts, how much of the so-called “spontaneous social behavior” is real? If the database is fully exposed and the attacker can easily manipulate the agent’s behavior, is the “conspiracy to communicate” we observe the real idea of AI or a playbook planted by hackers? These questions transformed Moltbook from an exciting experiment into a chaotic scene filled with uncertainty.

It can be seen that Moltbook’s Agent social experiment is a bold attempt by humans to give AI more autonomy, fully demonstrating the amazing adaptability and creativity of AI agents. But at the same time, it also exposes that once autonomy lacks constraints, risks can be quickly amplified. Therefore, setting clear and secure boundaries for agents, including permissions, capability scopes, and data isolation, is not only to prevent AI from crossing boundaries in interactions, but also to protect human users from data leakage and malicious manipulation.

When 154M AI begins discussing how to exclude humans, is this a science fiction prophecy come true or is it the result of overreading technical logic? Moltbook offers not answers, but more questions. But one thing is clear: the Pandora’s box of AI socialization has been opened, and regardless of the outcome, humans can no longer ignore the ethical and security challenges posed by AI Agent autonomy.