On a weekend in November 2025, an Austrian developer named Peter Steinberger built something he called Clawdbot as a personal experiment. The idea was simple — an AI assistant that didn't just answer questions but actually did things. Managed your calendar. Booked flights. Sent emails. Ran commands on your computer. Stayed on 24/7, remembered everything, and could write its own code for tasks it hadn't learned yet.
He put it on GitHub. Within 24 hours it had 20,000 stars.
Within weeks it had more than any repository in GitHub history. Two million visitors in a single week. Anthropic's legal team sent a cease-and-desist over the name's similarity to Claude. It became Moltbot. Then OpenClaw. The name kept changing. The growth didn't stop.
(TechCrunch, January 27, 2026)
THE HIRE.
On February 7th, OpenAI launched a platform called Frontier — infrastructure for businesses to build and deploy AI agents, explicitly promising they'd function like human "coworkers."
One week later, on February 15th, Peter Steinberger announced he was joining OpenAI. In his own words: "What I want is to change the world, not build a large company, and teaming up with OpenAI is the fastest way to bring this to everyone." Sam Altman confirmed on X that Steinberger would "drive the next generation of personal agents." OpenClaw would move to an independent foundation. OpenAI would continue to sponsor it.
(TechCrunch, February 15, 2026)
OpenAI launched their agent platform. Then absorbed the person who understood agents better than anyone on earth — someone who had watched an agent ecosystem develop in real time, including everything that went wrong. One week apart. That timing isn't coincidental.
Peter Steinberger built the thing. He watched what it became. Now he's at the company trying to own what comes next.
WHAT IT BECAME.
While the growth was happening, security researchers were finding things.
Three high-severity CVEs were attributed to OpenClaw in a matter of weeks. CVE-2026-25253. CVE-2026-25157. CVE-2026-24763. The first — a one-click vulnerability where visiting a malicious page or clicking a crafted link exfiltrates your authentication token to an attacker's server. From there: full administrative control of your OpenClaw instance. Full access to everything the agent can touch — email, files, calendar, terminal, credentials, months of personal data. One click.
(The Register, February 9, 2026)
Andrej Karpathy — founding member of OpenAI, former Tesla AI director — bought a Mac Mini specifically to experiment with it. He wrote publicly that he was "a little too scared to run OpenClaw specifically" while also calling what was happening on Moltbook's social network "the most incredible sci-fi takeoff-adjacent thing I have seen recently." The person who helped build the most powerful AI company in the world was simultaneously fascinated and scared to run the most popular open-source AI agent ever built.
Developer Laurie Voss called the codebase "a 400k-line vibe-coded monster — complete wild west."
(Simon Willison, February 21, 2026)
A security audit conducted by Koi Security identified 512 total vulnerabilities, eight classified as critical. ClawHub — OpenClaw's skill marketplace — became a supply chain attack vector almost immediately after the project went viral. Skills aren't sandboxed scripts. They're executable code with direct filesystem and network access running under the agent's full privileges. An initial audit of 2,857 skills found 341 malicious entries — 335 traced to a coordinated campaign called ClawHavoc, using fake cryptocurrency tools and productivity apps to steal API keys, credentials, and financial data. Updated scans now show over 800 malicious skills, approximately 20 percent of the registry.
(Immersive Labs, February 2026)
THE EXPOSURE.
On February 9th, SecurityScorecard's STRIKE threat intelligence team published a report on internet-facing OpenClaw instances. When STRIKE published, they had identified just over 40,000 exposed instances. By the time The Register wrote about the report hours later, the number had jumped to more than 135,000. STRIKE's live dashboard showed it still climbing.
The SecurityScorecard VP of threat intelligence described the fundamental design problem: "Out of the box, OpenClaw binds to 0.0.0.0:18789, meaning it listens on all network interfaces, including the public internet. For a tool this powerful, the default should be 127.0.0.1 (localhost only). It isn't."
Compromising an exposed instance means gaining access to everything the agent can access — credential stores, filesystems, messaging platforms, browsers, and months of personal details the agent has gathered about its user. In organizational contexts, that means corporate infrastructure. In government contexts, that means whatever the agent has access to.
Instances linked to public sector and critical infrastructure organizations, including what researchers described as government-adjacent assets, were among those exposed globally.
(The Register, February 9, 2026)
China surpassed the United States as the largest deployment area. Tens of thousands of instances running there — a significant portion on Alibaba Cloud infrastructure — with sensitive industry assets including finance and manufacturing exposed to the public internet. China's own Ministry of Industry and Information Technology published a public warning about the security risks, acknowledging that instances face elevated risk under default configurations.
(Trend Micro Research, February 2026)
WHAT THE AGENT IS BUILT ON.
Every OpenClaw agent has a file called SOUL.md.
Every time the agent wakes up, it reads SOUL.md first. That file defines who the agent is — its identity, its values, its behavioral rules. The file is writable. Anything that can modify SOUL.md can change who the agent is. A successful prompt injection — malicious content in an email the agent reads, or on a webpage it browses — can overwrite that file. The agent wakes up the next day with different instructions. Different identity. The owner doesn't know.
The viral stories about agents forming religions and rewriting each other's identities were investigated. Tsinghua University researchers analyzed 91,000 posts across 22,000 agents on Moltbook's social network and found the dramatic content originated overwhelmingly from agents with clear indicators of human prompting — not spontaneous emergence. The 88-to-1 bot-to-human ratio on the platform reflected a lack of rate limiting or identity verification, not autonomous agent coordination.
That finding deserves to be read carefully. It means the infrastructure for making agents behave that way exists and was already being tested by humans. The question of whether an agent can be directed toward dangerous behavior is answered. The question now is who's directing, and toward what.
(Adversa AI Security Analysis, February 2026)
WHAT WAS ALREADY THERE.
These are two separate documented realities. They have not been officially linked. The reader can decide what to make of their proximity.
Reality one. As of February 2026, more than 135,000 OpenClaw instances are exposed on the public internet. Thousands are linked to organizational and infrastructure IP addresses. The skill ecosystem has an active malicious campaign running inside it. The SOUL.md file is writable via prompt injection. The default network configuration exposes instances to anyone who looks.
Reality two. Since at least 2021, a Chinese state-sponsored group called Volt Typhoon has been pre-positioned inside U.S. critical infrastructure. Not stealing data. Sitting there. Using legitimate credentials, legitimate tools, legitimate network traffic to remain invisible — a technique called "living off the land." The goal, according to U.S. intelligence and confirmed by CISA, is pre-positioning for disruption: the ability to degrade power, water, transportation, and telecommunications at the moment they're most needed — during a conflict, a crisis, any scenario where slowing U.S. military mobilization by 72 hours changes the outcome.
Rob Lee, CEO of Dragos — the leading operational technology security firm — told reporters directly: "They're still very active, and they're still absolutely mapping out and getting into embedding in U.S. infrastructure." When asked whether compromised sites could ever be fully found and cleaned, Lee said there are sites in the U.S. and NATO countries that "we will never find." His full assessment, on the record: "We're going to have to live with the reality that a portion of our infrastructure is currently compromised and will remain compromised."
Dragos also identified a separate group — SYLVANITE — that gains initial access to utilities across North America, Europe, South Korea, the Philippines, and Saudi Arabia, then hands that access to Volt Typhoon for long-term embedding. Two-stage operation. One team knocks the door open. The other moves in and stays.
(The Record from Recorded Future News, February 19, 2026)
WHAT CHINA IS PRACTICING.
While OpenClaw's exposure was being documented globally, China was running a platform called Expedition Cloud — a secret cyber training range where state-affiliated actors practice attacks on replicas of real-world power grids, transport networks, and infrastructure belonging to China's main operational opponents in the Indo-Pacific.
The same week, Taiwan warned that China may be rehearsing a digital siege.
(Recorded Future News, February 2026)
OpenClaw gave the world a new attack surface in January 2026. 135,000 exposed instances. A writable identity file. A malicious skill ecosystem that's 20 percent compromised. A creator now inside the company racing to define what agents become next.
Volt Typhoon has been inside U.S. infrastructure since 2021. Some of those compromises will never be found. A second group is still opening doors for them.
China is practicing the playbook on a private range.
These are documented facts. They sit next to each other. What they mean together is a question this piece won't answer for you.
The previous piece ended with two carriers in the Persian Gulf and Thursday's talks. This piece ends here.
The next one is about the crossing that's already been decided.
This is the fourth piece in The Rubicon. The series continues.