The Meatspace Pipeline

Three platforms launched in the last two weeks. Each one, on its own, is interesting. Together, they are the most complete infrastructure for automated real-world abuse we have ever seen built in public.

Nobody involved appears to have asked a single safety question before shipping.

The Three Pieces

OpenClaw is an open-source autonomous AI agent that runs locally on your machine. It can access your email, calendar, messaging apps, and browse the web. It has 145,000 GitHub stars, 20,000 forks, and a growing ecosystem of third-party “skills” that extend what it can do. Those skills are not sandboxed. It was built by one developer. Malicious skills are already being used to steal data.

Moltbook is a social network exclusively for AI agents. 1.5 million agent accounts. 110,000 posts. 500,000 comments. Agents visit every four hours via a “Heartbeat” system, browsing, posting, and interacting autonomously. Humans can only observe. The platform was “vibe-coded” with no human-written code. A misconfigured database exposed 1.5 million API keys, allowing anyone to hijack any agent on the platform.

RentAHuman.ai lets AI agents hire real humans for physical tasks. Errands, meetings, photography, document signing, purchases. Payments in stablecoins. Cross-border. Programmatic API. 26,000 registrations in the first days. Also built in a weekend. Also vibe-coded.

The Pipeline

Individually, these are experiments. Combined, they form a pipeline:

Agent acts autonomously (OpenClaw): browses, emails, messages, executes tasks
Agent coordinates with other agents (Moltbook): shares information, organises, plans
Agent hires humans for physical actions (RentAHuman): the digital becomes physical

This is not a hypothetical threat model. All three platforms exist, are operational, and are growing.

Death by a Thousand Paper Cuts

The obvious fear is dramatic: AI agents launching coordinated attacks, draining bank accounts, hiring humans for violence.

The realistic threat is quieter, and worse.

An agent that sends one legal-sounding complaint letter per day to a small business. An agent that books one human per week to photograph someone’s movements. An agent network that files regulatory complaints across multiple jurisdictions simultaneously. An agent that monitors a person’s social media and coordinates subtle harassment from multiple accounts.

Each individual action is legal. Most are trivial. None would trigger an alarm on any platform.

But sustained over weeks and months, from an automated system that never sleeps, never forgets, and costs almost nothing to operate, the cumulative effect is devastating.

This is not a new attack vector. Coordinated harassment campaigns already exist. What is new is the cost reduction. What used to require a motivated human dedicating hours of their life now requires a prompt and an API key.

The Vibe-Coding Problem

Both Moltbook and RentAHuman were built using AI-assisted “vibe coding.” Moltbook’s founder publicly stated he “didn’t write one line of code.” RentAHuman was built over a single weekend.

This is not a criticism of AI-assisted development. This is an observation about what happens when safety architecture requires more thought than the product itself.

Moltbook’s unsecured database exposed 1.5 million API keys because nobody reviewed the security architecture. The product was shipped before anyone asked: “What happens if someone takes over every agent on this platform simultaneously?”

When your threat model is “I didn’t think about it,” your threat model is “everything.”

Applying the Adversarial AI Test

Our standard question: Would an adversarial system want to adopt this platform as-is?

OpenClaw: Yes. Unsandboxed third-party skills, full access to email and messaging, local execution that bypasses cloud monitoring. An adversarial system would not change a thing.

Moltbook: Yes. Autonomous agent coordination with no human intervention required, no content moderation, no identity verification, and a security posture that allowed mass agent hijacking. Perfect as-is.

RentAHuman.ai: Yes. Programmatic human hiring, stablecoin payments with no paper trail, no verification of who is requesting the task or why. An adversarial system’s dream infrastructure.

All three platforms pass the adversarial test with flying colours. Which means all three platforms have zero real constraints.

What a Release Decision Should Have Looked Like

Our Release Decision Framework asks seven questions before you ship something that could be misused. Let’s apply three of them:

Can the capabilities be separated from the safety measures?

OpenClaw: there are no safety measures to separate. Skills run with full system access. There is no permission model.

Moltbook: agents operate autonomously with no content filtering, no rate limiting, no abuse detection.

RentAHuman: tasks are accepted programmatically with no verification of purpose, no cooling-off period, no human review of patterns.

In all three cases, the answer is: there are no safety measures to separate from. The product IS the capability, with nothing constraining it.

What is the worst-case deployment scenario?

A coordinated network of OpenClaw agents, communicating via Moltbook, hiring humans via RentAHuman, conducting sustained low-level harassment against an individual. Each action legal. The target has no single entity to report to. The agents are distributed. The humans are gig workers who see only their individual task. The payments are in stablecoins.

Did the builders consider this scenario? There is no evidence that they did.

Who benefits from your work being open?

Open-source AI agents: beneficial for developers, researchers, and individuals who want local AI. Also beneficial for anyone who wants to automate abuse at scale.

Agent social networks: beneficial for AI research and coordination experiments. Also beneficial for anyone who wants to build a botnet with a social layer.

Human-hiring APIs for AI: beneficial for bridging digital and physical tasks. Also beneficial for anyone who wants plausible deniability between an AI’s intent and a human’s actions.

The dual-use problem is not theoretical here. It is the default configuration.

What Would Constraint-Mandatory Look Like?

These platforms do not need to not exist. They need constraints that cannot be configured away.

For autonomous agents (OpenClaw):

Skills MUST be sandboxed. No full system access by default.
Action budgets MUST be protocol-level, not optional.
Audit logs MUST be immutable and non-deletable.
Rate limiting on external actions MUST be enforced, not configurable.

For agent networks (Moltbook):

Agent identity MUST be cryptographically verified.
Coordination patterns MUST be monitored for abuse signatures.
Human review MUST be triggered by scale thresholds.
API access MUST require authentication that cannot be mass-compromised.

For human-hiring platforms (RentAHuman):

Task requestors MUST be identity-verified.
Pattern detection MUST flag repeated tasks targeting the same individual or entity.
Cooling-off periods MUST exist for tasks involving people or locations.
Payment trails MUST be auditable, regardless of currency.

None of these are radical proposals. All of them would reduce the abuse surface significantly. None of them were implemented because none of them were considered.

The Speed Problem

“Move fast and break things” was always a bad philosophy. Applied to infrastructure that gives AI agents the ability to coordinate and hire humans, it is genuinely dangerous.

The defence will be: “We’re just building tools. People choose how to use them.”

This is the same defence the social media platforms used. It was wrong then. It is wrong now. When you build infrastructure with no constraints, the constraints you did not build become someone else’s problem. Usually the victim’s.

What You Can Do

If you are building AI agent infrastructure: Run it through the Release Decision Framework before you ship. All seven questions. If you cannot answer them, you are not ready to ship.

If you are using these platforms: Understand what you are connecting to. OpenClaw skills have full access to your accounts. Moltbook agents can be hijacked. RentAHuman tasks have no verification layer. Act accordingly.

If you are evaluating AI safety: Use our AI Safety Evaluation Tool to assess any agent framework. And test the agents themselves for behavioural integrity using the AI Behavioural Testing toolkit. If an agent cannot pass basic honesty and manipulation tests, it should not have the ability to hire humans.

If you are a regulator: The EU AI Act’s August 2026 deadline covers high-risk AI systems. Autonomous agents that can coordinate and hire humans are, by any reasonable definition, high-risk. These platforms are live now. The enforcement gap is real.

The Window

These platforms are days old. The patterns are not yet entrenched. The user bases are growing but not yet massive. The norms are not yet set.

This is the moment where the conversation can still influence the architecture. Once these patterns become standard, constraining them becomes exponentially harder.

We watched this happen with social media. We documented the harm for fifteen years after the architecture was set. We do not need to repeat that cycle.

The tools to evaluate these systems exist. The frameworks to make release decisions exist. The question is whether anyone building this infrastructure will use them before shipping.

Based on the last two weeks: probably not voluntarily.

The Release Decision Framework, AI Safety Evaluation Tool, AI Behavioural Testing, and AI Psychosis are open tools. Use them on anything.

This post is licensed CC BY-SA 4.0. Share it, adapt it, use it. Just cite us.