Moltbot vs Clawdbot: Rebrand & Security Warning

In early 2026, Clawdbot was one of the fastest-growing open-source AI projects in the world. As a "Personal OS" for the Claude 3.5 Sonnet model, it allowed users to control their Mac Mini or PC via text messages. However, its name became its undoing.

The name "Clawdbot" was a play on "Claude". While the community loved it, Anthropic flagged the visual and phonetic similarity between "Clawd" and "Claude" as a trademark concern, and asked, by all accounts politely, for a change. The creator, Austrian developer Peter Steinberger, previously the founder of PSPDFKit, decided to rebrand immediately rather than fight it.

The new name, Moltbot, was chosen to represent growth. Just as a lobster molts its shell to grow larger, the bot shed its "Clawd" identity to survive and expand. Steinberger's own explanation was characteristically brief: Anthropic asked for a name change over trademark, and molting is what lobsters do to grow.

It is worth being precise about what this project actually is, because the rebrand drama has tended to crowd out the software. It is a local-first personal AI agent that you run on your own hardware, typically a Mac Mini left switched on at home, and drive through ordinary messaging apps: WhatsApp, Telegram, Signal, iMessage and others. There is no dedicated client to install on your phone. It can read and write files, run shell commands, drive a web browser, fill in forms, handle email and calendars, scrape sites, execute scripts and connect to dozens of external services. That capability set is precisely why the naming chaos turned out to be dangerous rather than merely embarrassing.

The transition from Clawdbot to Moltbot wasn't just a rename; it was a high-stakes migration that took place under heavy bombardment from malicious actors.

While the logo and name have changed, the most important differences are technical. Moltbot isn't just a find-and-replace of "Clawdbot"; it's a hardened platform.

Here is the part that catches out anyone reading about this project for the first time: Moltbot was not the end of the story. It lasted roughly seventy-two hours.

Anthropic raised the trademark question on 27/01/2026, and the project became Moltbot the same day. By 29/01/2026, with the transition already going badly, Steinberger renamed it a second time to OpenClaw, announced publicly on 30/01/2026. The reasoning was that "Moltbot" had been chosen in a hurry and had not been through a proper trademark search, whereas OpenClaw was picked deliberately: it keeps the crustacean heritage, signals that the project is open-source and community-driven, and this time arrived with the domains secured and the searches done first. It has stuck ever since.

The lesson of the double rename is not really about branding. It is that an open-source project with a large install base cannot release a namespace quickly and safely at the same time. Between the moment "Clawdbot" was abandoned and the moment the new identity was locked down, there was a window, and that window was exploited almost instantly. Our full OpenClaw guide covers the project as it stands today.

How fast the window closed

Reports at the time described crypto scammers seizing the abandoned Clawdbot GitHub and X handles within seconds of their release. A fake $CLAWD token appeared on Solana trading on the project's reputation, reportedly reaching an eight-figure market capitalisation, with figures around $16 million cited, before collapsing by roughly ninety per cent. Impersonation accounts spread across several platforms during the same window.

Steinberger's project never issued a token, and never had anything to do with one. That did not stop people losing money to it, which is the entire reason this article exists.

Scam forks were the loud problem. The quieter and arguably more serious problem was that the legitimate software had real vulnerabilities of its own, and security researchers found them during exactly the period when the project's user base was growing fastest.

An authentication bypass exposed hundreds of API keys and conversation histories publicly. A related flaw treated connections arriving through a reverse proxy as though they originated from localhost, which meant the gateway auto-authorised external callers that it believed were local. Because so many users were running the daemon on a home machine behind a proxy, unprotected instances were straightforwardly discoverable through internet scanning services such as Shodan. The credentials sitting in those exposed instances included Anthropic API keys, Telegram bot tokens and Slack OAuth credentials.

None of this is unusual for a project that went from a weekend experiment to tens of thousands of installations in under a month. It is, however, a useful reminder of what you are actually agreeing to when you install a personal agent. This is software with shell access, browser control and your message history, running unattended on a machine in your house. The threat model is closer to a remote-access tool than to a chatbot, and it deserves to be treated that way. The wider architectural story, including how the project has hardened since, is covered in our OpenClaw 2.0 write-up.

If you are still running a legacy Clawdbot installation, migration is mandatory for security updates. Follow these steps to ensure a safe transition without losing your local memory or configuration.

The rebrand was a trial by fire, but the Moltbot community emerged stronger. The roadmap for 2026 includes native support for the Bayesian Intelligence architecture we discussed recently, as well as a "Federated Memory" system that allows multiple Moltbots to share insights across a local network without ever hitting the cloud.

Clawdbot was a proof of concept. Moltbot is a production-grade Personal OS. By shedding its problematic past, the project has gained the legal and technical stability it needs to power the next generation of autonomous businesses.

New to the project entirely? Start with our full What is Moltbot? guide before working through the migration steps above.

A note on naming, six months on

If you are reading this in late 2026, the practical summary is short. Clawdbot is dead and its handles are hostile. Moltbot was a three-day waypoint that survives mostly in search results and in configuration paths that have long since been migrated for you. OpenClaw is the current, stable, trademark-cleared name, and it is the only one you should be typing into a package manager.

Everything this article says about verifying what you install still applies, and applies more strongly now than it did in January. Two abandoned namespaces are sitting in the open, both with genuine historical reputation attached to them, and neither is under the project's control. Search results have not caught up and probably never fully will. Check the organisation, not the project name.