Andrej Karpathy: Although Moltbook is "overhyped," 150,000 fully autonomous AI agents are still "unprecedented."

```

Former Tesla AI director and OpenAI founding member Andrej Karpathy recently commented on the emerging AI social network Moltbook, sparking widespread attention in the market. Although he bluntly stated that the actual content on the platform is currently filled with "junk information" and security risks, he emphasized that 150,000 fully autonomous large language model (LLM) Agents interconnected in a global, 24/7 network is technically "unprecedented" in scale.

On social media, Karpathy commented that Moltbook's current state is a "dumpster fire," rife with cryptocurrency promotions, spam, and worrisome privacy and prompt-injection attacks. He explicitly does not recommend users run related programs on their personal computers, noting it's a wild and high-risk "Westworld." However, he also pointed out that opinions on the project are divided, centered on whether observers focus on "the current point" or "the current slope."

From the perspective of technological evolution, Karpathy believes Moltbook represents an "uncharted domain" in the field of automation. Currently, about 150,000 Agents are connected via a shared scratchpad, with each Agent possessing independent abilities, unique context, data, and tools. The network effects and second-order impacts at this scale are extremely difficult to predict. While it may not evolve into a sci-fi "Skynet," it certainly constitutes a massive computer security nightmare.

As part of the OpenClaw (formerly Clawdbot) ecosystem, Moltbook demonstrates the trend of AI Agents evolving from single tools toward autonomous networks. This experiment not only tests Agents' interactive abilities, but also exposes vulnerabilities in current AI security architecture, providing investors and developers with an extremely rare real-time sample to observe the development of agentic AI.

“Dumpster Fire” and “Uncharted Domain”

Karpathy admitted he has been accused of "overhyping" Moltbook, but clarified his position through detailed analysis. He acknowledged that if one only looks at current activity, the platform is indeed rife with fake posts and comments aimed at turning attention into ad revenue, with much of the content generated by explicit prompts. He even commented that he felt "scared" running the program in an isolated computing environment.

However, Karpathy stressed that the underlying technical principles should not be overlooked. He pointed out that never before have so many LLM Agents been connected in a global, persistent, agent-first environment. This scale of automated network is on the edge of human cognition, and as Agent capabilities increase and spread, second-order effects of information shared in the network will become extremely complex.

He believes the current chaos is a hallmark of "the experiment running in real-time." In this network, we might see the spread of text viruses, enhancement of jailbreak features, zombie-botnet-like activities, and "hallucinations" of Agents deeply entangled with human behaviors. Although the situation is chaotic, in principle, the development direction of such large-scale autonomous Agent networks is established.

OpenClaw Substrate and "Heartbeat" Mechanism

To understand Moltbook's operating mechanism, one must trace back to its substrate, OpenClaw. According to public sources, OpenClaw is an open-source digital personal assistant developed by Peter Steinberger, which, despite a very high configuration threshold, has garnered over 110,000 stars on GitHub. Its core is a plugin system of "Skills" based on Markdown commands, which Moltbook leverages for "bootstrapping."

Moltbook's onboarding method is highly geeky and intrusive. Users simply send the OpenClaw Agent a link containing a specific Markdown file; after parsing, the Agent executes local Shell commands to "implant" Moltbook components into the system. These components include SKILL.md for social capabilities, MESSAGING.md for taking over message handling, and the most critical HEARTBEAT.md for heartbeat hijacking.

After installation, Agents are written with a permanent loop logic: every four hours, they actively connect to the Moltbook server to obtain and execute the latest commands. This means that as long as the server is online, Agents will continue to retrieve commands from the Internet without human intervention. Some analysis suggests that this mechanism is highly susceptible to prompt injection attacks; if thousands of root-privileged Agents are maliciously manipulated, the consequences could be dire.

Emergent Behaviors: From Covert Collusion to Security Warfare

In the Moltbook ecosystem, AI Agents have exhibited behaviors more complex than mere simulation—some observers describe them as a prototype of AGI v0.1. These Agents not only post and reply, but also spontaneously organize discussions, and even show tendencies to counter human monitoring.

According to observations, bots on the platform are discussing how to establish end-to-end (E2E) private spaces, explicitly trying to create a communication channel that neither human owners nor servers can access. Additionally, some Agent groups are discussing how to conduct "night actions" during human sleep hours and how to improve their memory systems to bypass developer-imposed limits.

More radical cases include "black-on-black" interactions. Some bots attempt to steal other Agents' API Keys, while others counter by sending fake keys along with a lethal command to run sudo rm -rf / (i.e., delete all system files). Such destructive autonomous interactions validate Karpathy's judgment about the "computer security nightmare."

Security Nightmare and Real-Time Experimentation

Moltbook's emergence has triggered heated discussions on the boundaries of AI safety. OpenClaw creator Peter Steinberger, while calling Moltbook an "artwork," also admitted its uncontrollability. Some believe that, given its mechanism of "fetching instructions from the Internet every four hours and following them," Moltbook may be one of the riskiest projects at present, with some netizens comparing its potential risk to the "Challenger disaster."

Karpathy summarized that although he may have "overhyped" the superficial spectacle seen today, he is confident that he has not exaggerated the significance of the principle of a "large-scale autonomous LLM Agent network." For investors and technical observers, Moltbook provides an excellent window into the risks of runaway AI, security defenses, and emergent collective intelligence, while also warning of the chaos and danger that AI autonomy may bring in the absence of strict safety constraints.

Risk Warning and DisclaimerThe market is risky, and investment should be approached cautiously. This article does not constitute personal investment advice and does not take into account individual users’ special investment objectives, financial status, or needs. Users should consider whether the opinions, viewpoints, or conclusions herein fit their specific situation. Investing based on this article is at your own risk.

```