CrankySec

Molto Bene

Hello, friend! Welcome to the first post of 2026. I know it's been a minute, but life's been wild. Also: I've been doing this for 2 years now? Dang.

Anyway. We're still open to business if you have any interesting projects, and a cybersecurity budget. I don't know if that's still a thing, though. Thought I'd ask.

Today, however, I want to talk about this craziness that is ClawdBot MoltBot OpenClaw. But first, a brief detour:

I am not going to sit here and tell you that I don't use LLMs. I do. What I do think is that a) the societal value they provide does not make up for the resources they consume, b) many of you reading this right now are having a hard time finding gainful employment because someone told some hiring manager that some LLM could do your job, and c) handing the keys to your life to a bot is insane.

The reality is that a lot of people do love this shit. And I would go even further and say that a lot of people love this shit not because they are tech maximalists, or just for love of the game: I think a lot of people love agents because, and this is going to sound riduculous, it gives them some agency.

Modern life is so fucked up, so exhausting, so Twilight Zone-ish (or Black Mirror-ish, depending on your age), so utterly insane, that people are willing to let a collection of TypeScript files run their lives. I know this is CrankySEC, as in SECURITY, but I don't even need to tell you that doing that is a risky thing.

Like, AppSec rule number zero is "Do not trust user input.", and this thing runs on it. Without user input, there's no agent. We are not missing ways for things to go extremely wrong. People using this are one typo away from having a bot send a picture of their dicks to the family WhatsApp group chat. And that's the low-end risk. Or click on that link sent by the "IRS" (real name assfkr6969@hotmail.com). Can you say with certainty that your OpenClaw agent isn't putting you on a list? Downloading things it shouldn't? You probably cannot.

I do get the appeal, though. I was reading about this fella who had them bots haggle with multiple car dealers until they got a good deal. Or bots going through your inbox and reading/composing/moving/deleting/replying to your emails. Or being you on your job's Slack. Can you imagine a bot replying "LOL rekt" to a mass-layoff message from the CEO? I am 100% sure we'll hear stories like that very soon. I'm 200% sure there's already a subreddit for that.

Can you give people shit over trying this stuff to see if it helps them navigate the endless stream of demands of real life? Isn't it enticing, at least conceptually, to have the ability of leveling the playing field a tiny bit? Isn't it appealing to have a very powerful tool on your side for a change? Car salespeople are out there trying to fuck you over as a matter of course. Here's a tool that will bat for you, and maybe get you to a point where you're not being fucked over as much. Here's a tool that will help you pretend you're paying attention to the billion things that demand your attention every minute of your life. Waiting to talk to your health insurance provider, but have no time to navigate the maze that is that options tree? Don't want to talk to robots for hours until you reach a human? Well, guess what, Blue Cross Blue Shield: I have a robot, too. I honestly cannot fault people for using technology to fight back against technology that's deployed against them. The one thing that I think can appeal to everyone is the ability to say "Now I have a way to prevent you from wasting my fucking time. How do you like them apples?"

It's a blunt tool that's very dangerous to use, but any tool is better than no tool. So, if you're thinking about partaking, do be careful.