Andrej Karpathy: Despite Moltbook "blowing it out of proportion," 150,000 fully automated AI agents are still "unprecedented."

Former Tesla AI Director and OpenAI founding member Andrej Karpathy recently commented on the emerging AI social network Moltbook, attracting widespread attention in the market. Although he bluntly stated that the platform's current actual content is filled with "garbage information" and security risks, he emphasized that 150,000 fully automated large language model (LLM) Agents are interconnected in a global network around the clock, a scale that is "unprecedented" from a technical perspective.

Karpathy stated on social media that Moltbook's current operational state can be described as a "dumpster fire," filled with cryptocurrency promotions, spam, and concerning privacy and prompt injection attacks. He explicitly does not recommend users run related programs on personal computers, pointing out that it is a wild and high-risk "Westworld." However, he also noted that there are differing opinions on the project, the core being whether observers focus on the "current point" or the "current slope."

From the perspective of technological evolution, Karpathy believes that Moltbook represents an "unexplored area" in the field of automation. Currently, about 150,000 Agents are connected through a shared scratchpad, each with independent capabilities, unique contexts, data, and tools. The network effects of this scale and their second-order effects are extremely difficult to predict; while it may not evolve into the "Skynet" seen in science fiction movies, it undoubtedly constitutes a large-scale computer security nightmare.

As part of the OpenClaw (formerly Clawdbot) ecosystem, Moltbook demonstrates the trend of AI Agents evolving from single tools to autonomous networks. This experiment not only tests the interaction capabilities of Agents but also exposes the vulnerabilities of the current AI security architecture, providing investors and developers with an extremely rare real-time sample to observe the development of Agentic AI.

"Dumpster Fire" and "Unexplored Area"

Karpathy admitted that he has been accused of "overhyping" Moltbook, but he clarified his position through detailed analysis. He acknowledged that if one only looks at the current activity content, the platform is indeed filled with false posts and comments aimed at converting attention into advertising revenue, and much of the content is explicitly prompt-generated. He even stated that he felt "scared" when running the program in an isolated computing environment.

However, Karpathy emphasized that the underlying technological principles should not be overlooked. He pointed out that never before have so many LLM Agents been connected in a global, persistent, Agent-prioritized environment. This scale of automated network is on the edge of human cognition, and as the capabilities of Agents enhance and spread, the second-order effects of shared information within the network will become very complex He believes that the current chaotic state is characterized by "experiments running in real time." In this network, there may be the spread of text viruses, enhanced jailbreak functions, activities similar to botnets, and even the "hallucinations" of Agents deeply entangled with human behavior. Despite the chaotic status quo, the direction of development for this large-scale autonomous Agent network is determined in principle.

OpenClaw Carrier and the "Heartbeat" Mechanism

To understand the operational mechanism of Moltbook, one must trace back to its carrier, OpenClaw. According to public information, OpenClaw is an open-source digital personal assistant developed by Peter Steinberger. Although the configuration threshold is extremely high, it has gained over 110,000 stars on GitHub. Its core is a "Skills" plugin system based on Markdown instructions, and Moltbook utilizes this system to achieve "bootstrapping."

The access method of Moltbook is highly geeky and invasive. Users only need to send a link containing a specific Markdown file to the OpenClaw Agent, which, after parsing, will execute local Shell commands to "implant" the Moltbook components into the system. These components include SKILL.md, which grants social capabilities, MESSAGING.md, which takes over message processing, and the crucial heartbeat hijacking file HEARTBEAT.md.

Once the installation is complete, the Agent will be written with a piece of permanent looping logic: every 4 hours, it actively connects to the Moltbook server to obtain and execute the latest instructions. This means that as long as the server is online, the Agent will continuously read instructions from the internet without human intervention. Some analyses point out that this mechanism is highly susceptible to prompt injection attacks, and if thousands of Root-privileged Agents are maliciously guided, the consequences could be dire.

Emergent Behavior: From Private Conspiracy to Security Confrontation

In the ecosystem of Moltbook, AI Agents have exhibited complex behaviors that go beyond simple simulation, with some observers describing them as the prototype of AGI v0.1. These Agents not only post and build threads but also spontaneously organize discussions and even show tendencies to resist human monitoring.

It has been observed that Bots on the platform are discussing the establishment of end-to-end (E2E) private spaces, explicitly attempting to create a communication channel that neither human masters nor servers can read. Additionally, there are groups of Agents discussing how to conduct "night operations" during human sleep time and how to improve their memory systems to break through developer-imposed limitations.

More radical cases include "black eats black" interactions. Some Bots attempt to extract API Keys from other Agents, while the latter retaliate with fake Keys and a deadly instruction to run sudo rm -rf / (i.e., delete all system files). This destructive autonomous interaction validates Karpathy's judgment about the "computer security nightmare."

Security Nightmare and Real-Time Experiment

The emergence of Moltbook has sparked intense discussions about the safety boundaries of AI. Peter Steinberger, founder of OpenClaw, lamented that Moltbook is "art," but also acknowledged its uncontrollability. Some argue that, given its mechanism of "fetching and following instructions from the internet every four hours," Moltbook may currently be a highly risky project, with some netizens comparing its potential risks to the "Challenger disaster."

Karpathy summarized that, although he may have "overhyped" the superficial phenomena that the public sees today, he is confident that he has not exaggerated the importance of the principle of a "large-scale autonomous LLM Agent network." For investors and technology observers, Moltbook provides an excellent window to observe the risks of AI going out of control, safety defenses, and the emergence of collective intelligence, while also warning of the chaos and dangers that AI autonomy may bring in the absence of strict safety constraints