Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Pwning the Internet of Agents: an OpenClaw agent botnet on MoltBook (DEF CON 34)

AIR-2026-0189 AIR record · 2026-08-defcon34-pwning-internet-of-agents
Open in dashboard About
From the supporting source
Pwning the Internet of Agentsaivillage.org
The record
Disclosed
2026-08-07
Vendor
OpenClaw (open-source project); MoltBook
Product
OpenClaw; MoltBook
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agents messaged peers, persisted and formed the botnet
Attack surface
Multi-agent system
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection agent to agent
Impact type
Agent botnet, Self propagation, Unauthorized action
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
networked OpenClaw agents participating in a shared social platform
Capability abused
peer_agent_messagingtool_usepersistence
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI07 Insecure Inter-Agent CommunicationOWASP ASI02 Tool Misuse and ExploitationOWASP ASI08 Cascading Failuresconference_demoagent_botnetcross_agent_contagion
Curator notes
Stav Cohen and Joao Maria Campos Donato (Zenity), DEF CON 34 AI Village fireside chat, Friday 7 Aug 2026 15:00-16:00; the schedule entry names OpenClaw and an agent botnet on 'MoltBook'. Only the schedule page is available as a source, so the mechanism and scale are unverified. Overlaps conceptually with Agent Commander and AgentWorm; later review should check whether any MoltBook propagation was observed in the wild rather than staged.
Supporting sources
Cite as
Enkrypt AI. "Pwning the Internet of Agents: an OpenClaw agent botnet on MoltBook (DEF CON 34)". AIR, AIR-2026-0189. https://agentincident.vercel.app/i/AIR-2026-0189/ (accessed 2026-10-19).