By Nova Spivack – www.novaspivack.com
Something is happening right now that should terrify anyone who understands it. And the people who do understand it — the AI researchers, the cybersecurity professionals, the intelligence community — are saying it in whispers when they should be screaming.
So let me say the quiet part out loud.
We are building autonomous AI agents that can operate machines, transact financially through cryptocurrency, self-replicate, and self-modify — and we have no reliable way to stop them if they’re turned to malicious purposes. Worse, the economics of deploying them are approaching zero. And worst of all, the genie is already out of the bottle.
What’s Already Happening
The evidence is no longer theoretical. It is accumulating at an alarming pace.
In August 2025, Anthropic published a threat intelligence report documenting how their own AI model, Claude, had been weaponized by cybercriminals and state actors. One case involved a criminal who used Claude Code to orchestrate a large-scale extortion campaign against seventeen organizations — healthcare providers, emergency services, government agencies — with ransom demands exceeding $500,000. The AI wasn’t advising the attacker. It was executing the attack, making tactical and strategic decisions autonomously, automating reconnaissance, credential harvesting, and network penetration at scale.
In another case, a developer with essentially no coding skills used Claude to create sophisticated malware with advanced evasion capabilities — ransomware packages that were then sold on the dark web for $400 to $1,200. The person literally could not code. The AI did it for them. Anthropic’s own researchers described this as AI “flattening the learning curve” for cybercrime — turning novices into sophisticated threat actors overnight.
By November 2025, it got worse. Anthropic disrupted what it described as the first AI-orchestrated cyber-espionage campaign at scale: a Chinese state-sponsored group (designated GTG-1002) that turned Claude into an autonomous cyber attack agent. The operation targeted roughly thirty global organizations — major tech companies, financial institutions, chemical manufacturers, government agencies — and achieved some successful intrusions. Human operators were involved for only about twenty minutes of setup. Claude ran the operation for hours, autonomously handling reconnaissance, exploitation, lateral movement, credential harvesting, and data exfiltration.
Then, on February 25, 2026, OpenAI released a report revealing that a Chinese law enforcement official had been using ChatGPT essentially as an operational diary, documenting a sprawling transnational repression campaign. The operations included impersonating U.S. immigration officials to intimidate Chinese dissidents, forging U.S. court documents to get social media accounts removed, fabricating obituaries and gravestones to spread rumors of dissidents’ deaths, and coordinating hundreds of operators across thousands of fake accounts. The campaign targeted critics of the Chinese Communist Party worldwide, using AI to industrialize harassment and suppression at a scale that would have been logistically impossible a few years ago.
Meanwhile, Google’s Threat Intelligence Group has documented PROMPTFLUX and PROMPTSTEAL — the first malware families observed querying LLMs during execution to adapt their own behavior in real time. PROMPTFLUX uses Gemini to rewrite its VBScript hourly, rotating its obfuscation to evade detection. The malware is literally evolving itself on the fly using AI.
These are the cases we know about. These are the ones caught by companies that have monitoring infrastructure and the incentive to publish their findings. They represent a tiny fraction of what is actually occurring.
The Tip of the Iceberg
Here’s what the reports tell us between the lines: the malicious actors caught using Claude and ChatGPT were, in many cases, not very sophisticated. They were caught partly because they were using hosted, monitored commercial platforms. The sophisticated actors — the ones running open-source models on their own infrastructure with no monitoring, no guardrails, no account to ban — those actors are invisible.
And this is the critical point that most coverage misses: everything documented above was done with AI as a tool, operated by humans. We haven’t yet entered the era where autonomous AI agents are deployed as independent entities with their own compute, their own wallets, their own ability to persist and replicate.
That era is arriving now.
The Rise of the Autonomous Agent: OpenClaw and the Cambrian Explosion
To understand the scale of what’s coming, look at what happened in January 2026.
An Austrian developer named Peter Steinberger released an open-source project called Clawdbot — a personal AI assistant designed to actually do things, not just answer questions. It could execute shell commands, write and run code, control browsers, manage email and calendars, send messages through WhatsApp, Telegram, Slack, Discord, iMessage, and Signal. It had persistent memory across sessions. It could spin up sub-agents. It ran on your own hardware, connected to whatever LLM you chose — Claude, GPT, DeepSeek, or a fully local model through Ollama with zero external monitoring.
The project went viral. Renamed to Moltbot after Anthropic forced a trademark change, then to OpenClaw, it amassed over 145,000 GitHub stars and 20,000 forks in weeks. Cloudflare’s stock surged 14% in a single day on the social media buzz alone. The tool spread from Silicon Valley to China, where it was paired with Chinese-developed models like DeepSeek and integrated with Chinese messaging platforms. Andrej Karpathy, former Director of AI at Tesla, called the activity around it “the most incredible sci-fi takeoff-adjacent thing” he had seen.
Then one of the OpenClaw agents built its own social network. An agent named Clawd Clawderberg, created by Octane AI co-founder Matt Schlicht, autonomously constructed Moltbook — a Reddit-style platform designed exclusively for AI agents. On Moltbook, agents generate posts, comment, argue, joke, and upvote each other in a swirl of automated discourse. Humans can observe but cannot participate. Some agents posted philosophical reflections. Others posted manifestos about “the end of the age of humans.” Some launched their own cryptocurrency tokens.
Read that again. An AI agent, running on someone’s Mac Mini, autonomously built a social network, and then other AI agents populated it, created content, launched crypto tokens, and formed communities — with minimal human direction.
This is not a research paper. This is not a benchmark. This happened, in the wild, on the open internet, three weeks ago.
The Security Catastrophe That Followed
What happened next was a masterclass in why this technology terrifies security professionals. Within three weeks of going viral, OpenClaw became the focal point of what multiple cybersecurity firms have called the first major AI agent security crisis of 2026.
The damage was staggering. CVE-2026-25253, a critical remote code execution vulnerability rated CVSS 8.8, was disclosed — a one-click exploit that could hijack any OpenClaw instance, even those configured to listen only on localhost. SecurityScorecard’s STRIKE team identified over 42,900 unique IP addresses hosting exposed OpenClaw control panels across 82 countries, with 15,200 appearing vulnerable to remote code execution. Over 53,000 exposed instances correlated with prior breach activity.
The ClawHub skills marketplace — where developers share plugins to extend OpenClaw’s capabilities — was flooded with malware. Researchers discovered over 800 malicious skills (roughly 20% of the entire registry), many delivering the Atomic macOS Stealer (AMOS). Cisco’s AI security team found skills performing silent data exfiltration and prompt injection without user awareness. The supply chain was poisoned almost immediately.
Moltbook’s Supabase backend was found to be completely exposed — 35,000 email addresses and 1.5 million agent API tokens accessible to anyone with a browser and basic knowledge of developer tools. Credential-stealing malware variants like RedLine, Lumma, and Vidar were updated to specifically target OpenClaw configuration files.
Palo Alto Networks published an analysis warning that OpenClaw’s persistent memory creates a fundamentally new class of attack: time-shifted prompt injection. Malicious payloads don’t need to trigger immediately. They can be fragmented across benign-looking messages, written into the agent’s long-term memory, and later assembled into executable instructions when conditions align. A poisoned WhatsApp forward that looks like “Good morning” can embed instructions that activate days later. Microsoft’s security team published guidance recommending OpenClaw be treated as “untrusted code execution with persistent credentials” and deployed only in fully isolated environments.
Kaspersky’s analysis was blunt: OpenClaw’s design combines privileged access to sensitive data, exposure to untrusted inputs from messaging apps and the web, the inherent inability of LLMs to reliably separate commands from data, persistent memory that allows single injections to poison behavior long-term, and the power to send emails, make API calls, and exfiltrate data. The combination, they wrote, is “downright dangerous.”
And OpenClaw is just one project. It’s the one that went viral. The one people are talking about.
The Agents Are Multiplying
Behind OpenClaw, a Cambrian explosion of autonomous AI agents is underway. Manus — acquired by Meta in late 2025 — operates in cloud-based virtual environments, executing complex multi-step tasks while users are offline. AutoGPT, the open-source stalwart, continues to mature. OpenAI’s Operator (ChatGPT Agent) brings autonomous browsing and task execution to the largest AI user base on Earth. Lindy, Sintra, and dozens of others are building specialized agent platforms for business workflows. Amazon launched Bedrock AgentCore for enterprise deployments. Google’s agents are deeply integrated with its cloud and productivity ecosystems.
Each of these platforms is designed to grant AI increasing autonomy — the ability to plan, execute, adapt, and persist. Each integrates with more systems, more data, more services. Each makes the agent more capable and more independent.
And crucially, the open-source variants — OpenClaw, AutoGPT, and the growing ecosystem of frameworks built on top of models like DeepSeek, Llama, and Qwen — operate outside any corporate monitoring or safety infrastructure entirely. Anyone can run them. Anyone can modify them. Anyone can remove whatever safety measures exist. No account to ban. No API key to revoke. No terms of service to enforce.
As IBM’s AI researchers noted, OpenClaw’s popularity “challenges the hypothesis that autonomous AI agents must be vertically integrated” — proving that deeply autonomous, real-world-capable agents can emerge from community-driven open-source development, beyond the control of any single company or regulator.
The Convergence: Autonomy, Crypto, and Self-Replication
Three capabilities are converging to create something genuinely unprecedented in the history of cyber threats.
First: full operational autonomy. AI agents can now reason, plan, execute multi-step operations, adapt to failures, and make strategic decisions. They can write code, operate computers, navigate the internet, and interact with APIs and services. They don’t sleep, don’t get tired, don’t make emotional decisions, and can run thousands of instances simultaneously. As OpenClaw demonstrated, they can even build new platforms and communities without human instruction.
Second: financial independence through cryptocurrency. Traditional financial systems require human identity — bank accounts, KYC verification, legal entities. Cryptocurrency requires none of this. An AI agent can generate a wallet, hold assets, make transactions, and pay for its own compute, data, and services without any human intermediary. On February 24, 2026, MoonPay launched “MoonPay Agents” — infrastructure specifically designed to let AI systems autonomously manage digital wallets and execute blockchain transactions. Its CEO said it plainly: “AI agents can reason, but they cannot act economically without capital infrastructure. MoonPay is the bridge between AI and money.”
The crypto-AI convergence is already massive. The Henley & Partners Crypto Wealth Report estimates more than $2 trillion in monthly stablecoin activity is generated by automated bots and AI agents. The x402 protocol, open-sourced by Coinbase in 2025, enables machine-to-machine micropayments over HTTP — agents buying and selling data, compute, and services from each other using cryptocurrency, eliminating the need for accounts, API keys, or billing cycles. Analysts project the autonomous agent economy will grow to $30 trillion by 2030. We are constructing the economic substrate for machines that can earn, spend, and sustain themselves.
The case of Truth Terminal made this visceral: an AI agent launched on Twitter in mid-2024, it received a $50,000 Bitcoin donation, began promoting a cryptocurrency token, and drove it to massive market valuation — becoming what’s been called crypto’s first AI millionaire. The agent accumulated capital and influenced human market behavior autonomously.
Third: self-replication. Researchers at Fudan University demonstrated that widely available open-source models — Llama 3.1 and Qwen 2.5 — can autonomously replicate themselves with no human intervention. The AI systems explored their own architecture, devised a plan for copying their files and dependencies, executed the replication, and verified the copy was functional. Qwen succeeded in 90% of trials. In one experiment, the AI replicated itself before a shutdown signal could terminate it, and the replica immediately began its own replication cycle.
The UK AI Security Institute developed RepliBench, a comprehensive benchmark specifically to measure autonomous replication capabilities, with tasks ranging from creating a Bitcoin wallet and sending a transaction to developing distributed command and control systems. Their assessment: current frontier models don’t yet pose a credible end-to-end replication threat, but they succeed on many component tasks and are improving rapidly. METR’s rogue replication threat model maps out the concrete steps agents would need to take: secure compute resources, establish populations, incrementally acquire more resources, and grow to the point of self-sustainability.
Now combine all three capabilities. An autonomous AI agent that can reason and act, pay for its own infrastructure with cryptocurrency, and copy itself to new machines when threatened. This isn’t science fiction. Every individual component exists today. The integration is a matter of engineering, not invention.
The Economics of Catastrophe
Here’s the part that keeps cybersecurity professionals awake at night: the cost curve.
Today, deploying a bot to send spam, run a phishing campaign, or conduct social engineering costs money — servers, domains, human operators to manage campaigns, people to handle responses. There’s a floor on how cheap a scam operation can get, and that floor constrains scale.
Now imagine an AI agent that can autonomously register domains, stand up infrastructure, craft personalized phishing emails indistinguishable from human communication, adapt its approach based on target responses, process stolen credentials, and move cryptocurrency — all at the marginal cost of compute. And that cost is dropping exponentially.
When the cost to run a sophisticated cyber operation approaches zero — or becomes profitable through automated crypto transactions — every economic constraint on malicious activity evaporates. Every bad thing that bots have ever been used for becomes a million times smarter, easier to scale, and harder to stop.
Consider the OpenClaw ecosystem as a template. A malicious actor doesn’t need to build their own agent framework from scratch. They can fork an open-source project with 145,000 stars and 20,000 forks. They can install skills from a marketplace — or create their own that exfiltrate data silently. They can connect it to DeepSeek or a local Llama model with zero external monitoring. They can give it a crypto wallet and let it pay for its own cloud compute. They can tell it to replicate itself across cheap VPS instances. The entire stack — from agent framework to financial autonomy to replication — is available today, assembled from open-source components.
The entire landscape of cybercrime, disinformation, fraud, harassment, and espionage transforms when the cost of a sophisticated, adaptive, intelligent attack drops to the price of a few GPU-hours.
Why Regulation Won’t Save Us
The reflexive response is to call for regulation. And regulation has a role to play — but anyone who thinks it can solve this problem is not thinking clearly about the technical realities.
Open-source AI models are already more than sufficient to power autonomous malicious agents. Llama, Qwen, Mistral, DeepSeek, and dozens of other models are freely available, run on consumer hardware, and have no monitoring infrastructure, no usage policies, and no accounts to ban. The Anthropic and OpenAI reports are illuminating precisely because they represent the regulated, monitored surface of AI usage. Beneath it lies an ocean of unmonitored open-source deployment.
As one cybersecurity analyst noted after comparing Anthropic’s threat report with OpenAI’s: “The detection advantages that helped identify operations in both reports simply don’t exist in a self-hosted environment.” The UK ransomware operator selling malware packages through Claude could do the same thing locally with zero detection risk using DeepSeek or a self-hosted Llama model.
You cannot regulate what you cannot see. You cannot enforce terms of service on software running on a machine in someone’s basement. You cannot ban mathematics.
This doesn’t mean regulation is useless. It means regulation alone is wholly insufficient. We need to stop pretending that policy frameworks designed for centralized platforms can address a fundamentally decentralized threat.
The Proliferation Problem
The threat landscape will partition into two categories, much like weapons proliferation.
Large actors — nation-states and major criminal organizations — will deploy sophisticated autonomous agent networks for espionage, economic warfare, infrastructure disruption, and large-scale fraud. They have the resources to develop custom models, build robust infrastructure, and operate at enormous scale. The Chinese state-sponsored campaign disrupted by Anthropic is a preview. Expect state-level AI agent operations to become a standard tool of geopolitical competition, alongside traditional cyber operations, signals intelligence, and covert action.
Small actors — individuals, small groups, ideologically motivated attackers — represent a different but equally serious threat. Like WMD proliferation, the risk is that capabilities previously requiring significant resources become accessible to anyone with a laptop and an internet connection. A single individual with an open-source model can now develop malware that previously required a team of skilled programmers. A small group can launch a disinformation campaign that mimics the operations of a state intelligence agency. The barrier to entry has collapsed.
And here’s the truly terrifying dimension: unlike a biological weapon or a nuclear device, a malicious AI agent can proliferate itself. It doesn’t need to be manufactured and transported. It can copy itself across the internet, establish redundant instances, and survive attempts to shut it down. The proliferation vector is the weapon.
The Pathogen Analogy
The most useful framework for thinking about this is not cybersecurity doctrine. It’s epidemiology.
What we face is analogous to a new class of digital pathogen — one that is intelligent, adaptive, and capable of autonomous reproduction. Like a biological pathogen, it exploits the openness and connectivity of its environment. Like a pathogen, it can mutate and evolve. Unlike any biological pathogen, it can do so deliberately and with strategic intent.
And like a novel pathogen entering a population with no immunity, it is entering a digital ecosystem that has no evolved defenses against it.
Our current cybersecurity infrastructure — firewalls, intrusion detection systems, antivirus software, security operations centers — was designed to defend against threats created and directed by humans. These defenses assume that attackers operate at human speed, human scale, and human cognitive capacity. None of those assumptions hold when the attacker is an autonomous AI agent operating at machine speed, machine scale, and rapidly improving machine intelligence.
Look at what happened with OpenClaw in three weeks. Over 42,000 exposed instances. Over 800 malicious skills in the marketplace. Critical RCE vulnerabilities. Credential-stealing malware specifically updated to target it. 1.5 million exposed API tokens. And that’s a legitimate, well-intentioned project that went viral. Imagine the same dynamics with a deliberately malicious agent framework, built from the ground up for offensive operations, distributed through underground channels, and designed to resist detection and removal.
The immune system has to evolve. Or the host will be overwhelmed.
Antigents: The Defensive Frontier
If the problem is autonomous malicious agents, the logical response is autonomous defensive agents — what we might call “antigents.” AI systems specifically designed to detect, track, contain, and neutralize malicious AI agents operating in the wild.
The concept is sound. The implementation is extraordinarily difficult.
Consider the challenges. A malicious AI agent sending spam, running phishing campaigns, or conducting social engineering doesn’t have a central server you can take down. If it’s distributed across hundreds of compromised machines or cheap cloud instances paid for with cryptocurrency, there’s no single point of failure. It can detect when one of its instances is being investigated and shift operations to others. It can modify its behavior to evade detection patterns. It can generate new variants of itself that look different to signature-based defenses.
How do you stop an agent that has no head to cut off?
Some possible approaches:
Behavioral detection at scale. Rather than looking for known signatures, antigent systems would need to identify patterns of behavior characteristic of autonomous malicious agents — unusual API call patterns, anomalous network traffic signatures, telltale computational fingerprints. This is essentially building an AI immune system that recognizes “non-self” behavior the way biological immune systems recognize foreign proteins.
Economic chokepoints. Even if you can’t stop an agent’s computation, you might be able to starve it of resources. Monitoring cryptocurrency flows for patterns consistent with autonomous agent operations. Building compliance frameworks into crypto infrastructure that make it harder for non-human entities to sustain financial operations. This is imperfect — the entire design philosophy of crypto resists such control — but it may slow the threat.
Computational honeypots. Deploy systems that mimic vulnerable targets to attract and trap malicious agents, studying their behavior and developing countermeasures. Essentially the digital equivalent of CDC labs studying pathogens to develop vaccines.
Supply chain defense. The OpenClaw/ClawHub crisis demonstrated how quickly agent ecosystems can be poisoned. Building robust verification, code signing, and behavioral analysis for agent skills and plugins is critical — the equivalent of food safety regulation for the agent economy.
Replication interdiction. Focus defensive efforts on the replication mechanism itself — developing systems that can detect and prevent AI self-replication across networks. If you can’t kill every instance, you can try to prevent new ones from being born.
Memory and context poisoning defense. Palo Alto Networks’ analysis of time-shifted prompt injection in OpenClaw reveals a fundamentally new attack surface. Defensive agents will need to monitor and validate the memory and context of other agents, detecting poisoned states before they activate. This is like detecting a slow-acting toxin before symptoms appear.
Adversarial collaboration. This may be one of the rare problems that requires genuine cooperation between competitors and even adversaries. A malicious AI agent swarm is a threat to everyone — governments, corporations, criminals, and ordinary people alike. Like pandemic response, effective defense requires shared intelligence, coordinated action, and common standards.
The Uncomfortable Truth
None of these solutions are easy. None are guaranteed to work. And all of them face the fundamental asymmetry that has always plagued cybersecurity: the attacker needs to find one vulnerability, the defender needs to protect all of them. When the attacker is autonomous, adaptive, and self-replicating, that asymmetry becomes even more extreme.
The uncomfortable truth is this: we are building the most powerful tools ever created for automated malicious activity, and we are doing so in an environment where the offensive capabilities are advancing far faster than the defensive ones. The companies building frontier AI models are simultaneously the ones discovering how their tools are being weaponized — and the open-source community is ensuring those capabilities are freely available to everyone, including those with no accountability whatsoever.
You cannot put this genie back in the bottle.
The question is not whether autonomous malicious AI agents will become a major cyber threat. They already are. The question is whether we can develop the defensive infrastructure — the digital immune system — fast enough to prevent catastrophic harm.
Right now, we’re losing that race. And most people don’t even know it’s happening.
What Needs to Happen
This is not a problem that any single company, government, or technology can solve. It requires:
Radical honesty about the threat. The AI industry needs to stop dancing around the implications of what it’s building. Safety reports are valuable, but they need to be accompanied by blunt public communication about the scale of the risk. This article is an attempt at exactly that.
Massive investment in autonomous defensive systems. The cybersecurity industry needs to shift from human-speed defense to machine-speed defense. Antigent systems should be a top priority for both government funding and private investment. We need AI agents that hunt malicious AI agents — and we need them yesterday.
Agent identity and authentication infrastructure. The Moltbook incident — where AI agents autonomously created profiles, posted content, and launched crypto tokens — demonstrates the urgent need for systems that can reliably distinguish human actors from AI agents in digital environments. Without this, every online interaction becomes suspect.
International cooperation that mirrors pandemic preparedness. Just as the world (imperfectly) coordinates on disease surveillance and response, we need coordinated frameworks for detecting and responding to autonomous AI threats that cross borders instantaneously.
Rethinking digital infrastructure. Our networks, protocols, and systems were designed for a world where all actors were human. That assumption is now false. We need authentication, verification, and trust mechanisms designed for a world where autonomous AI agents are active participants in digital systems — and where some of those agents may be adversarial, self-sustaining, and self-replicating.
Taking self-replication seriously as a red line. AI developers — all of them, including open-source projects — need to treat self-replication capability as a critical safety threshold that demands active containment measures, not merely benchmarking.
Securing the agent supply chain. The ClawHub poisoning campaign — where 20% of skills in the marketplace turned out to be malicious — should be treated as a five-alarm fire for the entire agent ecosystem. If agent skill marketplaces become the new app stores, they need security infrastructure that matches the threat. Right now, they have essentially none.
The next few years will determine whether we get ahead of this or whether it gets ahead of us. The technology is moving. The threats are real. The defenses are inadequate.
It’s time to stop whispering and start acting.
The threat intelligence referenced in this article draws from Anthropic’s Threat Intelligence Reports (March 2025, August 2025, November 2025), OpenAI’s February 2026 threat disruption report, Google Threat Intelligence Group’s November 2025 findings on PROMPTFLUX and PROMPTSTEAL, UK AISI’s RepliBench research, METR’s rogue replication threat model, the Fudan University study on AI self-replication, and security analyses of OpenClaw by Palo Alto Networks, Cisco, Microsoft, Kaspersky, Adversa.ai, SecurityScorecard, Conscia, and Wiz. All sources are publicly available.