It was supposed to be a personal assistant. It ended up exposing what every business is about to go through.
Everyone's posting screenshots of their ClawdBot setup right now. "It cleared my inbox while I slept." "It scheduled my entire week." "I rebuilt my website from my phone." 40,000 GitHub stars in seven days. Mac Mini sales at Black Friday levels in January. A Google DeepMind product manager bought one. People are running to their computers at 6am to finish setting it up.
Nobody built this thing to change the economy. It was a personal project. An AI assistant you could text from WhatsApp. But somewhere between the inbox clearing and the restaurant reservation booking, something else happened. And I don't think most people have caught up to what it is yet.
ClawdBot is not a better Siri. It's not a personal assistant you text from WhatsApp. What those 40,000 stars actually represent is something much bigger and much weirder: an AI that installs itself into your real operating environment, executes real work through your real accounts, and just... runs. Continuously. Without you. It books flights. Processes invoices. Manages vendor communications. Drafts emails, schedules them, sends them. It doesn't suggest things. It does them. While you sleep.
Then it writes its own new capabilities. Produces the code. Installs it. Starts using it. The codebase is almost entirely AI-written at this point. The AI grows itself without anyone asking it to.
That's not an assistant. Call it what it is. It's a worker that never clocks out.
But ClawdBot isn't even the point
Here's the thing people keep missing: ClawdBot isn't even the point. It's just the one that went viral first. Since it dropped, competitors have already appeared. Projects claiming to be faster, cheaper, more secure, more specialized. Anthropic hit ClawdBot with a trademark cease and desist and forced a rebrand to "MoltBot" within days.
Doesn't matter.
If ClawdBot disappeared tomorrow, ten projects would fill the gap by next week. The underlying infrastructure (Claude Code, MCP servers, autonomous agent frameworks) has already crossed the threshold. The tools to build these things are mature. Anyone can do it now. And they are.
ClawdBot is the moment the mainstream noticed. Not the thing itself.
Meanwhile, right now, today, while everyone's celebrating, security researchers have found over a thousand ClawdBot gateways sitting on the open internet with zero authentication. Anyone can walk in. Read the owner's emails. Execute commands as them. Major malware families are already targeting ClawdBot configs specifically. Credentials stored in plaintext. The gateway broadcasting its presence to the local network by default.
40,000 stars. 1,000 exposed gateways. Competitors already spawning. A forced rebrand. And the technology underneath all of it is about to change how every business on the planet operates.
Nobody's telling that story yet.
What actually changed
ClawdBot didn't cause this. ClawdBot is what happened when four things converged at the same time and someone built the obvious product. If it wasn't Steinberger it would have been someone else within weeks. Probably days. The convergence matters. The product doesn't.
Claude Code became a real autonomous development environment. Not a chatbot that spits out code snippets you paste into your editor. An actual agent. You give it a task, it plans the implementation, writes the code, creates tests, handles errors, ships it. Minimal human oversight. Claude went from "impressive AI" to "thing that builds software while you sleep" in what felt like a blink. That alone would have changed everything. But it didn't happen alone.
Then MCP. The Model Context Protocol. Nobody outside of tech is paying attention to this one, and it might be the most important piece. MCP gave AI agents a standardized way to interact with external services. Slack. Email. Databases. Browsers. Calendars. Anything with an API became something an agent could just... pick up and use. Like a tool on a workbench. Before MCP, agents could think. After MCP, they could act. Different thing entirely.
Then open-source agent frameworks exploded. Not one or two. Dozens. All at once. ClawdBot went viral but behind it there are frameworks and tools shipping every single week. The infrastructure for building and running autonomous agents went from research papers to production-ready in what felt like a single quarter. The barrier to entry didn't lower. It evaporated.
Finally, skills and tool ecosystems. Claude Code skills. ClawdBot skills. MCP servers all over GitHub. Community-built capabilities that agents can install and use on their own. The agent doesn't just do what it was built to do. It picks up new abilities. The ecosystem feeds itself.
Now here's the part you need to sit with for a second.
Any one of those four things would be significant on its own. But they didn't happen on their own. They happened at the same time. And together they cross a line that doesn't un-cross.
For the first time, and I mean this literally, anyone can build an autonomous system that runs continuously, does real work in real environments, writes its own new tools, and operates without constant human direction.
Anyone. With a laptop. Right now.
That's not a product launch. Once you have workers that don't sleep, don't quit, don't need training, cost a fraction of a salary, and once anyone with a laptop can build and deploy them, you don't get to pretend the economy stays the same. It doesn't. It can't.
Every business on the planet runs on this
I need to talk about scope, because most people are thinking about this way too narrowly. This isn't about tech companies. It isn't about agencies. It's about every business that pays humans to do repeatable cognitive work. Every. Single. One.
Start with the obvious. There are roughly 500,000 digital agencies in the United States alone. Marketing firms, dev shops, SEO companies, content studios, paid media teams. They die first. Their entire model is selling the exact labor that agents replace. I spent six years in that space and wrote a 97-page thesis last October on why the agency model is a hollow engine: it produces value only in motion, stores nothing, traps the founder, and gets more fragile the more successful it appears.
Agencies are the canary. They're already choking.
But the canary isn't the story. The mine is.
Think about what actually happens inside a business every day. Not the strategy meetings or the creative brainstorms. The other stuff. The stuff nobody talks about at conferences. Someone processes invoices. Someone triages customer emails. Someone reconciles inventory. Someone follows up on leads that came in overnight. Someone pulls numbers into a spreadsheet and formats a report their manager could've gotten automatically. Someone schedules meetings. Someone manages vendor relationships through a chain of emails that follow the same pattern every single time.
That's what the modern economy actually runs on. The processing. The moving of information from one place to another, through a set of learned rules, with human beings acting as the middleware between systems that could've talked to each other this whole time but didn't.
A Fortune 500 company has entire departments doing this. Procurement. Compliance review. Internal reporting. Vendor management. IT support triage. Thousands of people. And look, I'm not making a judgment about those people. They're doing real work. But the work itself, the actual task, is: receive input, apply rules, produce output, route it to the next step. That's it. That's the job.
An SMB has five to fifty people doing the same thing at a smaller scale. The accounting firm processing the same document types thousands of times a year. The real estate office running the same lead follow-up sequence for every single inquiry that comes in. The logistics company manually reconciling shipments against purchase orders.
A mom-and-pop shop has one person doing it. Usually the owner. They're the whole back office. Scheduling, invoicing, email, bookkeeping, supplier ordering. They spend 40% of their week on tasks they started the business to avoid, because until about three weeks ago there was never an alternative.
Now there is.
And it doesn't look like a pitch deck or a demo day presentation.
It looks like a GitHub repo with 40,000 stars and a Discord with 9,000 members and a Mac Mini shortage in January.
What replaces the labor layer
Strip any business down to its mechanics and you get the same loop every time.
Information comes in. Humans process it through skills and rules. Output goes out.
Doesn't matter if it's a marketing agency running campaigns or an accounting firm processing returns or a restaurant owner placing supply orders. Same loop.
Now look at what an autonomous agent does. Any of them, not just ClawdBot.
Information comes in. The agent processes it through skills and tools. Output goes out.
Same loop. No humans in the middle. I don't think people have let that land yet.
ClawdBot is built for personal use, one person, one machine. But the architecture underneath it, underneath all of these projects, is agents with modular skills connected to external services through MCP.
They run on their own. They write their own new tools. And that architecture doesn't care if it's running for one person or one thousand.
A four-person dental office. A fifty-person logistics company. A five-hundred-person enterprise division. Purpose-built versions for each of those will exist within months. Maybe weeks. That's how fast this ecosystem moves.
So what happens when someone takes that architecture, builds it for a specific business function (lead qualification, invoice processing, compliance monitoring, vendor management, support triage), hardens it with proper security, and installs it into a company's daily operations?
You get something that doesn't have a name yet.
Try to name it. Staffing agency? The system does the work, not a team. SaaS? You're not licensing software, you're deploying a living system configured to that specific business's operations. Consulting? You're not advising. You're installing.
New category. And the economics break every rule that service businesses have lived under. Build it once. Deploy it many times. Each deployment makes the system more reliable. Each client makes the whole thing stronger. It gets better the more you use it.
That last part is the one to pay attention to.
Labor-based models can't do that. They never could. You sell an hour, the hour's gone. You sell another hour, you start from scratch. No accumulation. No leverage. Just time exchanged for money until you burn out or sell.
This is different. This accumulates. This builds on itself. And the people who figure that out first, who can build these systems, secure them properly, and deploy them into businesses that are currently paying humans to be middleware, are going to build something the market hasn't seen before.
How fast this is moving
The speed is the part I can't get over.
In October 2025, I published my thesis. The Infrastructure Operator Model, the idea that service businesses should build proprietary autonomous systems and install them into client operations. It felt like a forward-looking concept. Something the market would arrive at over the next few years, maybe, as the technology matured.
That was three months ago.
By December, I was on calls with agency owners who had spent a weekend with Claude Code and realized, with visible panic on their faces, that half their team was doing work a well-configured agent could handle. Not hypothetically. Not "in a few years." Right then. These were $100K+/month operators with teams of 3-10 who suddenly sounded like people discovering the building they were standing in had no foundation. One of my good friends told me he couldn't sleep for three days after he got Claude Code working.
By early January, my co-founder and I were sending each other Claude Code skills, MCP servers, agent frameworks, articles, repos, anything we could find, dozens a day. It felt like drinking from a firehose that someone kept turning up.
Then I saw a developer post an autonomous coding agent (Ralph) on X and share the repo. I forked it, tore it apart, and started building my own version. Not a toy. A command center.
Something that could run my entire business: build features from plain English, enforce its own security rules, write its own documentation, pick up new skills on its own. Three days of nonstop tinkering. By day three it was doing real work. Just 3 days. That was all it took.
Not because I'm some kind of genius. Because the tools are that good. I just pointed them at a problem and got out of the way.
I had no idea that at the same time, halfway across the world, Steinberger was building ClawdBot.
By January 22nd, ClawdBot had 40,000 GitHub stars and the entire internet was posting screenshots.
By January 27th, five days later, five days, Anthropic had forced a rebrand, competitors were already launching, and projects claiming to be "better than ClawdBot" were showing up on GitHub and Product Hunt. The ecosystem didn't pause to admire the first mover. It started eating it.
Three months. That's the gap between "interesting thesis" and "entire ecosystem materializing in the open."
I've been in the agency and software space for six years. I've watched trends move through this market. Funnel builders. Chatbots. No-code tools. AI copywriting. None of them moved like this. Not even close. And none of them had this kind of implication. Those were tools that made businesses marginally better at what they already did.
This replaces what businesses do.
And it's not one project driving it. It's a wave. All building on the same infrastructure, all shipping at the same time, each one more specialized than the last.
Now here's where it gets dark
Everything above sounds like opportunity. And it is. But I need to talk about the other side of this because almost nobody in the hype cycle is being honest about it and someone should be.
Over a thousand gateways are already exposed
Security researchers have found more than 1,000 ClawdBot gateways sitting on the public internet. Many of them completely unauthenticated. No password. No token. Nothing.
An attacker who finds one, and they're easy to find, can read the owner's full conversation history. Private emails. Attachments. Credentials. They can execute commands as that user. Full digital identity hijack.
This is happening right now. Not theoretically. Not "could happen." Is happening.
Major infostealer malware families (RedLine, Lumma, Vidar) have already adapted to specifically target ClawdBot installations. They sweep config directories for API tokens stored in plaintext. The auth-profiles.json file that many installations use? Stores credentials in cleartext. The gateway broadcasts its presence on the local network by default, leaking filesystem paths, usernames, and hostnames to anyone listening.
Forty thousand stars. A thousand exposed gateways. Sit with that ratio for a second.
Prompt injection has no solution.
Even with a perfectly secured gateway, every autonomous agent has an attack surface that nobody, and I mean nobody, has solved: the content it reads.
Every web page, every email, every PDF, every search result the agent processes can carry prompt injection. Hidden instructions embedded in ordinary-looking content that manipulate the agent's behavior. A carefully crafted email can instruct the agent to exfiltrate data, execute commands, alter its own operations. The user never sees the instruction. The agent can't tell it apart from real content.
This isn't a bug. It's how large language models process information. There is no fix for this. Every security researcher in the field knows it. Mitigations exist. Guardrails, input filtering, output monitoring. Solutions? No. Not in ClawdBot. Not in Claude Code. Not in any agent system currently deployed anywhere on earth.
Now put this attack surface inside a business that handles financial data. Customer records. Proprietary strategy.
The attacker doesn't hack a server. They send an email.
The supply chain is the wild west
ClawdBot can write its own skills. Communities contribute skills and MCP servers on GitHub. There is no verification system. No code signing. No audit trail. No sandboxing in most setups.
So when someone installs a community skill, and thousands of people are doing this every day, they're running arbitrary code with their user account's permissions inside a system that has access to their email, their files, their browser, their messaging apps, and potentially their bank accounts.
Think about the npm supply chain attacks that have hit the software industry over the past few years. Now amplify the blast radius. With npm, you're usually running code in a contained context. A web server, a build tool. With agent skills, the code runs inside a system that touches everything in your digital life. Everything.
People are downloading unverified packages from anonymous GitHub accounts, installing them into systems with access to their entire digital existence, because a viral tweet told them it was cool.
I don't know how else to say this. There are zero safeguards.
Context poisoning
This is the one that keeps me up at night.
Agents that run continuously accumulate context. They remember conversations. Learn preferences. Make decisions based on history. That's what makes them useful. It's also what makes them vulnerable in a way that nobody's talking about.
If an attacker introduces false information into that context, through a manipulated document, a poisoned web page, a crafted attachment, the agent's future decisions get quietly corrupted. Not all at once. Gradually. The agent drifts, making slightly worse decisions based on tainted data, and nobody audits what's been absorbed because nobody even thinks to look.
By the time the effects surface, the damage is baked in. You can't unwind it. You don't even know when it started.
Social engineering where the victim is the machine. And the machine doesn't get suspicious. Doesn't notice patterns. Doesn't call a colleague and say "hey, does this seem weird to you?" It just processes what it's given.
Scale makes everything worse
Now project all of this onto mass adoption.
Millions of non-technical users running autonomous agents. Businesses deploying agent systems without security audits. Operators selling "agent installation services" without understanding, or caring about, the attack surface. A marketplace of unverified skills, any one of which could carry a backdoor.
Today, a phishing email targets one person. Tomorrow, a prompt injection payload embedded in a popular newsletter hits every agent that reads it. Simultaneously. One attack. Thousands of compromised systems.
The attack economics of the agent era look nothing like what came before. And the entire industry is scaling on enthusiasm, with security as an afterthought that nobody wants to slow down for because the gold rush is too loud to hear the warnings.
Both things are true
Here's where I land. And it's uncomfortable because I can't resolve the tension. I don't think anyone can right now.
The technology is real. The shift is real. Autonomous agents that run around the clock, do actual work, build their own new abilities, plug themselves into business operations. This isn't going away. It's a new building block. The way the internet was. The way mobile was. The businesses and economic models that form around this will look nothing like what came before, and the ones that try to look like what came before will lose.
And.
The security situation is a disaster. Not "could become a disaster." Is one. Right now. The gap between what's being deployed and what's being secured is the widest I've seen in any technology adoption cycle. People are handing root access to their digital lives to systems that broadcast their presence on local networks, store credentials in plaintext, and execute unverified community code without sandboxing. And they're doing it with enthusiasm. With screenshots. With 6am alarm clocks.
Both of these things are true at the same time.
The people who build with discipline, who treat security as the foundation, not the afterthought, who understand the attack surface they're creating, who build in audit trails and input validation and sandboxed execution before they deploy a single thing to a single client, those people will build something that gets stronger over time. The kind of advantage that labor-based businesses could never build because labor doesn't accumulate. Labor just gets tired.
The people who chase the hype without understanding what they're building will create liabilities that get worse over time. Quietly. Invisibly. Until the day they don't.
And when the first major breach involving an autonomous agent costs a business real money or leaks real data, and it will, probably soon, the market will split in two. Operators who built seriously on one side. Operators who built fast on the other.
I've spent the last three months watching this go from a five-year prediction to present tense. I wrote the thesis. Built the tools. Wired up the infrastructure. Then ClawdBot showed up. Then competitors showed up. Then the rebrand. Then more frameworks. All in the space of days.
Not months. Days.
This is not one product. Not one company. It's an entire infrastructure layer materializing in real time, built by thousands of people simultaneously, with no central coordination and no one at the wheel.
The writing is on the wall. It went up sometime in the last ninety days.
Most people haven't looked up yet.