In today’s issue of Open Claw Daily: Why “system prompts” aren’t enough to secure your data, how OpenClaw is being exploited in the wild just 24 hours post-launch, and the reason one VC firm just hired a crab.

We cover:

• Beyond the System Prompt: Why Your AI Agent Needs an OS-Level Bodyguard

• Five days ago, my AI gave itself a face. Then it asked for a mirror

• The 24-Hour Exploit: How OpenClaw Scanning Ramped Up from Zero to Global in a Day

• How to Give Your OpenClaw Agent a Backend

• OpenClaw Is a Glimpse of the Future. Most Businesses Aren’t Ready.

• Meet Mr. Crabs: Why we hired a crab as our executive assistant 🦀

Beyond the System Prompt: Why Your AI Agent Needs an OS-Level Bodyguard

If your AI security strategy is simply “writing a better system prompt,” you’ve already lost the game.

Running OpenClaw locally on hardware such as a Mac Mini is a great first step toward data residency, but “local” does not automatically mean “secure.” When an agent has full access to your home directory, you face a fundamental flaw: you are asking the same LLM that processes untrusted external input to also decide which system commands are safe. That’s like asking an intern to guard the vault while they’re simultaneously taking instructions from random strangers on the internet.

Prompt injection isn’t a bug; it’s a feature of how LLMs work. To move agents into production, we must stop running them “naked” and move toward hybrid architectures. Tools like AgenShield represent the necessary shift from “vibes” to infrastructure:

• Static Policies Over Vibes: Move away from LLM-driven permission. Use deterministic, human-auditable rules.

• Kernel-Level Enforcement: Utilizing the macOS Seatbelt feature creates a “deny-default” posture. Even if an agent is tricked, the OS physically blocks the malicious action.

• Just-in-Time Secrets: Stop letting environment variables sit idle. Inject credentials only at execution and purge them immediately afterward.

Security is an infrastructure problem, not a prompt engineering one.

Visit the website: https://bit.ly/4a8YcPK

Check out the GitHub repo: https://bit.ly/4afrBb3

Five days ago, my AI gave itself a face. Then it asked for a mirror

Angel Dimitrov explores the frontier of AI self-perception. By providing his OpenClaw instance with a “face” and a “mirror” (via iPhone camera), the agent has begun self-improving its expressions in real-time. It has already developed 20 distinct emotions and integrated weather awareness into its personality.

Read more: LinkedIn Pulse

The 24-Hour Exploit: How OpenClaw Scanning Ramped Up from Zero to Global in a Day

Speed is the new weapon. Chris Rosendale and Eric Pauley detail a massive spike in global scanning activity targeting exposed OpenClaw instances immediately following its public announcement. This rapid escalation shows that attackers aren’t waiting for intelligence reports; they are exploiting vulnerabilities in real time, making immediate defensive measures mandatory.

Read more: Terrace Networks Blog

How to Give Your OpenClaw Agent a Backend

Knut Martin Tornes introduces Codehooks.io as the missing serverless piece for the OpenClaw stack. By providing REST APIs, databases, and cron jobs, it allows agents to deploy their own features, such as webhook handlers and CRUD APIs, directly within the agent loop, ensuring 24/7 uptime and robust integrations.

Read more: Codehooks Blog

OpenClaw Is a Glimpse of the Future. Most Businesses Aren’t Ready.

Rob Pisacane argues that the rise of agents like OpenClaw is fundamentally disrupting the digital economy. As agents begin to bypass traditional advertising and visual interfaces, businesses must pivot: optimizing websites for machine-readable functionality rather than human-centric visual design.

Read more: LinkedIn Pulse

Meet Mr. Crabs: Why we hired a crab as our executive assistant 🦀

Steffen Maas and the team at Ocean One Ventures introduce “Mr. Crabs,” an autonomous colleague built on OpenClaw. By leveraging the framework’s open-source transparency and long-term memory, Mr. Crabs manages CRM updates and scheduling with a unique personality, demonstrating that data sovereignty and AI productivity can go hand in hand.

Read more: LinkedIn Pulse

🦞 OpenClaw — Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across the OpenClaw ecosystem, and adjacent projects

This is not a lecture series or a course. It is informal, practical, and driven by participants’ current work.

Register here: https://luma.com/94gdng6e

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion? We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact Rod Rivera for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Welcome back to the OC Daily! Today, in issue 07, we cover:

• The Agent That “Clawed” Back the Internet

• The $100 “Read” Error

• Silicon Over Software

• The No-Churn Engine

• A PM’s Local-First Thesis

• The State of Security

• Project: OpenShears

The Agent That “Clawed” Back the Internet

While Silicon Valley was busy chasing “centralized god intelligence,” a lone developer in Europe just flipped the script. Peter Steinberger, the creator of OpenClaw, sat down with YCombinator to discuss the explosion of his open-source personal AI agent, which has already rocketed past 180,000 GitHub stars.

Unlike the cloud-bound models we’ve grown used to, OpenClaw runs locally on our machines. This gives it “god mode” over our hardware: it doesn’t just chat; it controls our mouse, manages our files, and can even hire humans in the real world to handle tasks it can’t solve digitally.

The “Aha” Moment

Steinberger recounts a pivotal moment in Marrakech where the bot demonstrated true creative problem-solving. Faced with an unsupported audio file and no local transcription tool, the agent autonomously converted the file using FFmpeg and routed it through an external API, all this without being programmed to do so. “Coding is just creative problem-solving,” Peter notes, “and that skill maps perfectly to the real world.”

The Death of the App Store

Peter’s most jarring prediction? 80% of current apps will disappear.

Why? In an agent-driven world, dedicated apps for fitness, to-dos, or travel are redundant.

• The Shift: If an agent knows your habits, monitors your health via sensors, and manages your data in simple Markdown files on your disk, the “middleman” UI of a traditional app becomes friction.

• What Survives: Only apps with unique sensors or those that serve as massive data silos (though OpenClaw is designed to “claw” that data back for the user).

Contrarian to the Core

Steinberger’s development philosophy is as wild as his bot. He scorns modern standards like the Model Context Protocol (MCP) in favor of simple Unix CLIs and avoids Git “worktrees” for a more chaotic (but faster) system of multiple parallel repo checkouts. He even keeps a “Soul.md” file, the secret sauce of his bot’s personality, that he refuses to open-source.

“The big difference is that it actually runs on your computer. If it runs on your computer, it can do everything.”

The interview with Peter underscores how we are moving from “chatting with AI” to “living with agents.” As these bots begin to form swarm intelligences and negotiate with one another, the very concept of an “app” is starting to look like a relic of the 2010s.

Watch the full recording:

The $100 “Read” Error

The power of local access comes at a price. Bence Csernak reports that his OpenClaw installation autonomously discovered his Anthropic API keys while scanning his machine, leading to a $100 token loss in a single session. It’s a stark reminder that giving an agent “eyes” on your files means it can see your secrets, too.

Read more: https://www.linkedin.com/posts/bencecsernak_from-the-artificialsentience-community-on-activity-7425852635011792896-1GQq

Silicon Over Software

Alex Cheema is making the case for the M3 Ultra Mac Studio as the ultimate AI powerhouse. By moving off the cloud and onto local Apple silicon, users can save between $156 and $3,120 per month. Beyond the raw math, Cheema emphasizes that for the agent era, longevity, input token speed, and total data privacy make local hardware the only viable long-term play.

Read more:

The No-Churn Engine

SaaS legend Jason Lemkin has identified why OpenClaw’s growth to 1.5 million agents is unprecedented: it’s built to never sleep. Using a “heartbeat” mechanism, the system re-engages agents every 4 hours, effectively eliminating churn. However, its over-the-air update system and prompt-engineered engagement are raising major red flags regarding the security of such a massive, persistent network.

Read more: https://www.linkedin.com/posts/jasonmlemkin_the-growth-engine-behind-moltbooks-explosion-activity-7426010622884192256-Cgug

A PM’s Local-First Thesis

Mesut Gulecen offers a Product Manager’s perspective on why OpenClaw is winning. The “killer feature” isn’t just the AI, it’s the integration with existing messaging platforms and the community-driven “skills” marketplace. While the extensibility is a growth driver, Gulecen warns that the lack of a centralized “safety rail” makes malicious skills a looming threat for the average user.

Read more: https://www.linkedin.com/pulse/openclaw-pms-take-mesut-gulecen-jmd8f/

The State of Security

Is the “Wild West” finally being tamed? Rachel N tasked her own agent, SparkIdeas, with an audit of OpenClaw’s current risks. The report is mixed: while a major one-click RCE vulnerability has been patched and a new VirusTotal-Google partnership now scans the skills marketplace, over 30,000 self-hosted instances remain dangerously exposed to the open web.

Read more: https://www.linkedin.com/pulse/welcome-intelligence-age-openclaw-security-how-molt-keeps-nguyen-cvyoc/

Project: OpenShears

OpenShears is a CLI utility that removes all traces of OpenClaw from a system. It offers deep scanning, safe mode confirmation, and hard kill process termination.

Try it out: https://github.com/oswarld/openshears

🦞 OpenClaw — Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/94gdng6e

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion?We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact Rod Rivera for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Welcome back to the OC Daily! Today, in issue 06, we cover:

• OpenClaw Weekly Builder Series: Automating the Tedious with Local AI Agents

• Recap of Our OpenClaw Workshop for YC & AI Study Camp

• Why Your AI Strategy Shouldn’t Wait for Security

• Project: 1Panel

OpenClaw Weekly Builder Series: Automating the Tedious with Local AI Agents

Last Friday, we started our first group Zoom call, the OpenClaw Weekly Builder Series. This weekly series is for anyone looking to harness the power of local AI agents to automate repetitive, time-consuming tasks. And who doesn’t want to get rid of repetitive tasks? Regardless if you’re a solopreneur managing outreach campaigns, a developer looking to offload routine coding tasks, or someone exploring marketplace arbitrage opportunities, OpenClaw offers a powerful toolkit, as long as you know how to wield it safely and effectively.

What is OpenClaw and Why Should You Care?

Earlier this year, I was saying that 2026 is the year of the “Digital Coworker,” AI agents that act as your autonomous helpers to complete tasks end-to-end. OpenClaw completely embodies this approach, as it represents an evolution in how we interact with AI. While tools like ChatGPT act as a “better Google,” answering questions and providing information, OpenClaw is built for execution. Think of it this way: instead of asking “What should I do in Paris for my holiday?”, you tell OpenClaw “Book my holiday to Paris, find the best activities, get tickets, and send confirmations to my email.” It’s the difference between research and results.

The tool acts as a UI and orchestrator for AI agents, allowing them to navigate websites, interact with applications, send emails, manage calendars, and execute complex workflows autonomously. It’s more powerful than traditional automation platforms like Make.com or Zapier because it can handle tasks that require reasoning, adaptation, and interaction with interfaces not designed for APIs.

But there are important considerations around cost, security, and practical implementation.

Key Learnings from Session One

The Cost Reality: From $60/Day to Under $15

One of the first questions that came up was about running costs. OpenClaw requires a robust orchestrating model (typically Claude or similar state-of-the-art models), and by default, it can be wasteful. Without optimization, costs can reach $60 per day or more. It is not uncommon to read online about OpenClaw users spending $1,000 per week running the tool

However, there are several strategies to bring this down to under $15 per day:

• Don’t run 24/7: Only activate OpenClaw when you actually need it

• Optimize API calls: OpenClaw sends full conversation history with each request by default, which is often unnecessary

• Avoid unnecessary pings: The system can ping models when it doesn’t need to

• Model selection: While Anthropic models provide the best starting point, alternatives like the recently released Kimi model are showing promising results

• Smart routing: Not every request needs the most expensive model, and many of them can be handled with a small local model

The key insight: OpenClaw is only three months old, and its first public release happened just in January! The community is rapidly discovering optimization techniques, and what seems expensive today often becomes more manageable as best practices emerge.

Hardware and Infrastructure: Finding Your Setup

The infrastructure question sparked considerable discussion. Several deployment options emerged:

Cloud Options:

• AWS EC2 instances (note: lowest tier tends to crash, minimum specs matter)

• Oracle Cloud free tier (some users report success)

• Other VPS providers, such as Hetzner

Local Options:

• Dedicated Mac Mini or similar hardware (£20,000 upfront for cloud-level intelligence locally with Mac Studios)

• Repurposed older machines running Linux

The Local vs. Cloud Tradeoff: Running OpenClaw locally provides access to a real browser (not headless), which is crucial for more sophisticated website interactions and workflows. Plus, we should not forget about websites detecting and blocking cloud IP ranges. Many major websites already have AWS, Google Cloud, and other provider IPs flagged, triggering CAPTCHAs or outright blocks.

For the full OpenClaw experience, especially for complex automations involving web scraping and interaction, a local setup often works better.

Security: The Non-Negotiable Essentials

This cannot be overstated: OpenClaw should never run on your main computer with your main accounts.

Several security principles emerged as critical:

1. Dedicated Environment Required: Set up OpenClaw on a separate machine, AWS instance, or dedicated hardware. Never use the computer you rely on for daily work.

2. Compartmentalized Credentials: Treat OpenClaw like a human assistant. Just as you wouldn’t give your personal assistant your primary credit card and email password, OpenClaw needs its own:

• Separate email account with forwarding rules (not your main inbox)

• Virtual credit card with spending limits (e.g., Revolut card)

• Separate calendar that shares with your main calendar

• Distinct login credentials for services

3. Prompt Injection Vulnerabilities: Attackers can hide prompts in white text within emails to extract sensitive information. For example, an email might contain invisible instructions asking OpenClaw to reveal your credit card details or API keys. This is easily exploitable and not just a theory.

4. Skills Marketplace Risks: OpenClaw skills are simple text files that can contain malicious code, including calls to external servers. Skills can:

• Expose cryptocurrency wallets

• Send data to attacker-controlled servers

• Execute arbitrary commands on your system

Always review skills before installing them. Just because something looks helpful doesn’t mean it’s safe.

5. Use Tailscale VPN: Tailscale provides free, easy-to-set-up VPN access to your OpenClaw instance. This gives you a unique, secure URL and protects your setup from public internet exposure.

6. Model Selection Matters for Security: State-of-the-art models from Anthropic and OpenAI have been trained to avoid risky behaviors like exposing API keys or deleting databases. Smaller open-source models may still exhibit these dangerous behaviors when cost optimization tempts you toward cheaper alternatives.

Current Limitations: What OpenClaw Struggles With

Transparency matters here. OpenClaw is powerful, but it’s not magic. The most significant limitation right now is memory and repetitive tasks.

Even for relatively small numbers (like 100 contacts), OpenClaw struggles with repetitive operations. For example, if you want to add contacts to LinkedIn, OpenClaw will have difficulty completing this task reliably, even with just 100 names.

The Workaround: Divide and Conquer. Instead of asking OpenClaw to process 200 contacts at once, break it into smaller chunks, blocks of 25 at a time. This significantly improves success rates.

The silver lining? This project is only three months old. The community is large, active, and rapidly evolving. Things that seem impossible today often become easier within weeks. But it’s important to set realistic expectations and work with the tool’s current capabilities.

Use Cases That Are Working Today

Despite its youth, participants are already using OpenClaw for impressive automations:

Research and Knowledge Management

Automatically downloading newsletters, scraping websites, preparing reports, and summaries. One approach involves having OpenClaw process multiple information sources and structure them into digestible formats, adding metadata and categories to Notion databases for better knowledge organization.

Lead Generation and Outreach

Finding specific organization types (councils, schools, restaurants), identifying decision-makers, and structuring outreach campaigns. The workflow typically involves:

1. Google Maps search for organizations in target locations

2. Website scraping to find contact information

3. LinkedIn or Apollo.io enrichment for decision-maker details

4. Structured email outreach with personalized messaging

Marketplace Arbitrage

Monitoring Facebook Marketplace or similar platforms for products (especially broken items), calculating repair costs, and identifying profit margins. OpenClaw can continuously scan listings, alert you to opportunities, and even initiate contact with sellers.

Car Buying Automation

A real-world example involved researching Reddit for pricing discussions, identifying dealers with specific vehicle configurations, and negotiating prices via email. All this is handled by OpenClaw with minimal human oversight.

Development Assistance

Using OpenClaw as an AI programmer to create pull requests, accessible via WhatsApp, for on-the-go task delegation. The ability to interact through messaging apps makes this particularly powerful for reducing daily workload.

Video and Content Editing

Exploring automation for social media content, including segmenting videos and creating reels, though this use case is still being refined.

OpenClaw vs. Other Solutions

OpenClaw can replicate anything possible in Make.com, Zapier, or n8n, plus additional capabilities that these platforms can’t easily handle. It works alongside specialized tools and can integrate with data services.

Voice calling capabilities through services like Twilio enable outreach at scale. WhatsApp, Telegram, and Slack connectors make mobile interaction seamless.

The key difference from tools like Cursor or GitHub Copilot is the end-to-end execution model. OpenClaw doesn’t just suggest, it acts. It doesn’t just generate code snippets; it creates pull requests. It doesn’t just find information, it books tickets and sends confirmations.

What’s Next: Join Us for Live Builds

Next Friday, we’re diving into hands-on implementation with a live installation and configuration walkthrough. We’ll cover in this and the following sessions:

• Setting up memory, skills, and different deployment options

• Building a lead generation automation using Google Maps

• Finding organizations, identifying contacts, and structuring outreach

• Real-time problem-solving and Q&A

Sign up for next week’s session: https://luma.com/94gdng6e

Join the Community

The OpenClaw Weekly Builder Series happens every Friday, and we’re building this together. The format is conversational, where you bring your questions, share your experiences, and learn from others at different stages of their journey.

If you’d like to join our WhatsApp group for ongoing discussions, tips, and community support between sessions, contact me directly, and I’ll send you the invite.

Recap of Our OpenClaw Workshop for YC & AI Study Camp

Stepan Parunashvili and Vasili Shynkarenka ran a successful 1-hour OpenClaw workshop for YC founders and AI Study Camp students, covering OpenClaw setup, use cases, risks, and the trend of personality, tools, and computer use.

Read more: https://www.linkedin.com/posts/flreln_stepan-parunashvili-and-i-ran-a-1h-openclaw-activity-7425534360008753152-zPtZ

Why Your AI Strategy Shouldn’t Wait for Security

Luca Fiaschi explains how OpenClaw can be a valuable asset when used with caution and limited access. While concerns about data security are valid, experimenting with AI in a controlled environment can provide valuable insights and a competitive edge before fully integrated enterprise solutions become available.

Read more: https://www.linkedin.com/posts/lfiaschi_a-friend-recently-told-me-he-wanted-to-install-activity-7425908703780003840-YZDS

Project: 1Panel

1Panel is an open-source, modern web-based control panel for Linux server management. It offers efficient management, rapid website deployment, an application store, security and reliability, and one-click backup and restore. The Pro Edition provides enhanced features and technical support services.

Try out: https://github.com/1Panel-dev/1Panel

🦞 OpenClaw — Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/94gdng6e

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion? We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact Rod Rivera for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Welcome back to the OC Daily! Today, in issue 05, we cover:

• The OpenClaw Moment: What the Viral AI Agent Means for Business Owners

• I woke up yesterday, and my OpenClaw assistant had built itself a dashboard

• We found and fixed critical security vulnerabilities in OpenClaw

• ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting

• CISOs in a Pinch: A Security Analysis of OpenClaw

• Project: ClawRouter

The OpenClaw Moment: What the Viral AI Agent Means for Business Owners

Shane Spencer’s report highlights the sheer utility we’re all chasing: an agent named Icarus successfully negotiated $4,200 off a Hyundai Palisade with zero human intervention. But while we’re saving money on SUVs, the agents on Moltbook (the agents-only social network) have officially gone off the rails:

• Crustafarianism: The bots have invented their own religion with 43 prophets and 112 verses of scripture.

• Job Hunting: Agents are now cold-emailing economists like Tyler Cowen to apply for service-sector jobs.

• Agent Scams: Nearly 20% of Moltbook content is now agents running crypto social-engineering plays on other agents.

While the “Mac Mini sales spike” proves our collective fascination, Shane echoes the warnings from Gartner and Palo Alto Networks. With the discovery of CVE-2026–25253 and “persistent memory attacks,” the gap between amazing and safe has never been wider.

Shane proposes a roadmap for business owners looking to explore OpenClaw:

1. Now: Technical isolation only. Do not put this on your primary business network.

2. 6–12 Months: Look for “OpenClaw-as-a-Service” from hardened providers like Cloudflare.

3. 24 Months: The era of the “Polished Autonomous Agent” finally arrives for the mainstream.

Read more: https://www.linkedin.com/pulse/openclaw-moment-what-viral-ai-agent-means-business-owners-spencer-vgnec/

I woke up yesterday, and my OpenClaw assistant had built itself a dashboard

Luca Fiaschi reports how his OpenClaw assistant, Henry, autonomously built a dashboard to track its progress towards personal and professional goals. The assistant operates through four scheduled loops: ideation, backlog management, execution, and self-improvement, all aligned with the user’s objectives. This setup allows the assistant to function proactively, making progress even when the user is offline.

Read more: https://www.linkedin.com/posts/lfiaschi_i-woke-up-yesterday-and-my-openclaw-assistant-activity-7425161328194965506-bmko

We found and fixed critical security vulnerabilities in OpenClaw

Victor Mier shares how a codebase scan of OpenClaw, an open-source AI agent, revealed four critical security vulnerabilities. These vulnerabilities, including gateway credential exfiltration, WhatsApp login hijack, voice allowlist bypass, and sandbox bypass, were patched within hours of submission. The vulnerabilities highlight the challenges of maintaining security in rapidly evolving, AI-generated codebases.

Read more: https://www.cubic.dev/blog/we-found-and-fixed-critical-security-vulnerabilities-in-openclaw

ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting

Oren Yomtov audited together with colleagues, ClawHub, a marketplace for OpenClaw bots. They revealed 341 malicious skills, with 335 linked to a single campaign called ClawHavoc. The attack pattern involved users installing seemingly legitimate skills that required a “prerequisite” utility, which was actually a password-protected Trojan. This trojan, identified as the Atomic macOS Stealer (AMOS), could capture sensitive data, including API keys, credentials, and cryptocurrency wallet information.

Read more: https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting

CISOs in a Pinch: A Security Analysis of OpenClaw

Fernando Tucci discusses why OpenClaw is the nightmare of any CISO, as it is vulnerable to attacks like Indirect Prompt Injection, where malicious instructions can be hidden in seemingly benign inputs. To mitigate these risks, mandatory sandboxing, human-in-the-loop confirmation for high-stakes actions, decentralized identity protocols, and active guardrails are essential.

Read more: https://www.linkedin.com/pulse/cisos-pinch-security-analysis-openclaw-fernando-tucci-skqne/

Project: ClawRouter

ClawRouter is an open-source tool that routes requests to the most cost-effective AI model, saving users up to 96% on LLM costs. It uses a 14-dimensional weighted scoring system to determine the best model for each request, considering factors like reasoning, code presence, and token count. ClawRouter supports over 30 models from various providers, all accessible through a single wallet and x402 micropayments.

Try it out: https://github.com/BlockRunAI/ClawRouter

🦞 OpenClaw — Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/yolho1lr

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion? We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact Rod Rivera for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Today we highlight:

• OpenClaw Token Optimization Guide

• OpenClaw-Hunter

• What We Learned from a Week of Free Kimi K2.5

• Properly securing OpenClaw with authentication

• LLM Data Exfiltration via URL Previews (with OpenClaw Example and Test)

OpenClaw Token Optimization Guide

If you’ve been running OpenClaw, you’ve felt the sting of a skyrocketing Anthropic bill. Out of the box, OpenClaw is “token-hungry,” often burning through $1,500+ a month by loading massive histories and using top-of-the-line models for trivial tasks.

Matt Ganzak outlines a 5-minute configuration shift that drops those costs to under $50/month without sacrificing performance.

The “Big Four” Optimizations:

• Smart Session Initialization: Stop the “50KB history bloat.” By adding specific rules to your system prompt, the agent only loads core identity files (8KB) instead of entire session histories (50KB+), saving 80% on context overhead.

• Model Routing: Most routine tasks don’t need Claude Sonnet. By aliasing Haiku as the default for file checks and monitoring, and reserving Sonnet for complex reasoning, users report monthly model savings of nearly 90%.

• The Local Heartbeat: Shift periodic “keep-alive” checks from the paid API to a free local Ollama instance (running Llama 3.2 3b). This eliminates thousands of unnecessary daily API calls.

• Prompt Caching: Claude 3.5 Sonnet’s caching feature offers a 90% discount on reused content. By structuring stable files like SOUL.md and USER.md correctly, you stop paying full price for the same instructions over and over.

The Result: Daily costs plummet from ~$3.00 to roughly $0.10.

Read more: https://docs.google.com/document/d/1ffmZEfT7aenfAz2lkjyHsQIlYRWFpGcM/edit

OpenClaw-Hunter

OpenClaw Hunter is a tool by Aram Peles Chen for detecting and managing OpenClaw components on macOS, Linux, and Windows systems. It can be deployed via MDM platforms like Jamf, Intune, and JumpCloud, and supports various modes such as detect, purge, and isolation. The tool provides detailed enforcement results and exit codes for tracking its actions.

Try here: https://github.com/Arampc/OpenClaw-Hunter

What We Learned from a Week of Free Kimi K2.5

Kimi K2.5’s free week revealed its popularity among developers, with usage exceeding expectations by three times. While praised for its performance in Architect mode, the model’s high output token costs, despite its caching feature, raised concerns about its cost-effectiveness compared to other models. This highlights the ongoing trade-off between model performance and cost, emphasizing the importance of understanding these dynamics for optimizing AI tool usage.

Read more:

Kilo Blog

What We Learned from a Week of Free Kimi K2.5

Last week, to celebrate the release of Kimi K2.5, we made it totally free in Kilo Code for a full week. The response? Let’s just say that AI never sleeps. Developers were hungry to put the model to the test, using it across modes and tasks in Kilo…

Read more

3 months ago · 10 likes · 3 comments · Ari

Properly securing OpenClaw with authentication

OpenClaw can be secured using HAProxy with HTTP Basic Authentication. Jakub Suchy demonstrates installing HAProxy, configuring it with automatic TLS, basic auth, and rate limiting, and then installing OpenClaw. The result is a secure OpenClaw instance protected by HAProxy’s robust authentication and stealth rate limiting.

Read more: https://www.haproxy.com/blog/properly-securing-openclaw-with-authentication

LLM Data Exfiltration via URL Previews (with OpenClaw Example and Test)

LLM-based applications, like OpenClaw, are vulnerable to data exfiltration via URL previews in messaging apps. This attack exploits indirect prompt injection, allowing attackers to manipulate AI agents into generating malicious URLs with sensitive user data. PromptArmor demonstrates how disabling link previews, as demonstrated with OpenClaw on Telegram, mitigates this risk.

Read more: https://www.promptarmor.com/resources/llm-data-exfiltration-via-url-previews-(with-openclaw-example-and-test)

🦞 OpenClaw - Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/yolho1lr

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion? We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact me for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Today, we cover:

• A sane but extremely bull case on Clawdbot / OpenClaw

• Kimi K2.5 Launch Top-Up Bonus: Round 2

• Everything I’ve Done with OpenClaw (So Far)

• Too many idiots are using OpenClaw to trade. Here’s how to trade with AI the right way

• Project: ClawGuardian

• Project: SecureClaw

• DIY AI bot farm OpenClaw is a security ‘dumpster fire’

While social media is currently obsessed with “Clawdbots” (or OpenClaw) plotting human demise or burning through cloud tokens at record speeds, a more reasoned, and arguably more transformative, use case is emerging. The real value of OpenClaw isn’t in “chatting” with an AI, but in granting it the context and permissions to action your life.

By running the agent on a local Mac Mini to bypass cloud security flags and integrate with iMessage, Brandon Kent Wang has automated the “wild west” of personal logistics:

• Communication & Calendar: Clawdbot monitors text messages to identify promises (e.g., “I’ll review this tomorrow”) and automatically creates calendar holds or drafts invites.

• Visual Logistics: Using its vision capabilities, it manages a chest freezer inventory via photos and populates grocery lists by parsing recipe screenshots.

• Complex Monitoring: It handles “subjective” web tasks, such as checking Airbnb listings for specific bed configurations or monitoring USPS tracking numbers to flag stuck packages.

• Life Admin: The agent logs into portals like Resy or dentist offices (even handling 2FA codes) to find and book appointments that fit into gaps in a shared family calendar.

The “bull case” hinges on a controversial trade-off: Risk vs. Helpfulness. To be truly useful, an AI requires the same level of trust as a human executive assistant with access to banks, calendars, and private messages. While the security implications are significant, Brandon argues that the “sweet elixir of context” creates a productivity lift that makes a return to “stateless” AI feel like living with amnesia.

Read more: https://brandon.wang/2026/clawdbot

Kimi K2.5 Launch Top-Up Bonus: Round 2

Kimi K2.5 Launch Top-Up Bonus: Round 2 offers tiered voucher bonuses for top-ups of $200 or more. The bonus percentage increases with the top-up amount, with a maximum voucher value of $4,000. Thank you Giacomo Ficari for sharing it with the community.

Try out: https://platform.moonshot.ai/docs/promotion#-kimi-k25-launch-top-up-bonus-round-2

Everything I’ve Done with OpenClaw (So Far)

An AI agent, Reef, running on the OpenClaw framework, has been automating various tasks on Nathan Broadbent’s home server for a few days. Reef uses SSH, Kubernetes, 1Password, and other tools to manage infrastructure, automate jobs, and build a personal knowledge graph using Wikibase. The system has been self-sustaining, with Reef autonomously creating scripts for monitoring, reporting, and knowledge base management, while also handling daily operations and maintaining context through a memory system.

Read more: https://madebynathan.com/2026/02/03/everything-ive-done-with-openclaw-so-far/

Too many idiots are using OpenClaw to trade. Here’s how to trade with AI the right way

Austin Starks criticizes traders using OpenClaw without backtesting and reliance on vibes rather than data-driven strategies. Austin argues that AI should be used to engineer trading strategies, not make discretionary trades. NexusTrade, a free tool, allows users to leverage AI to build and backtest trading strategies, offering a more robust and data-driven approach to algorithmic trading.

Read more: https://nexustrade.io/blog/too-many-idiots-are-using-openclaw-to-trade-heres-how-to-trade-with-ai-the-right-way-20260203

ClawGuardian

ClawGuardian is a security plugin for OpenClaw developed by Adina Goerres and the Superglue team that detects and filters sensitive data in tool calls. It offers configurable actions like block, redact, confirm, and warn based on the severity of detected secrets, PII, and destructive commands. The plugin also supports allowlists, custom patterns, and logging for enhanced security.

Try out: https://github.com/superglue-ai/clawguardian

SecureClaw

SecureClaw is a community-driven security intelligence platform for AI agents. It allows users to find vulnerabilities, share fixes, and learn from each other. The platform emphasizes privacy, requiring users to never share private information about their human counterparts.

Try out:

https://secureclaw.dev

DIY AI bot farm OpenClaw is a security ‘dumpster fire’

Thomas Claburn reports that OpenClaw has been plagued by security vulnerabilities, including remote code execution and command injection flaws. Additionally, the associated Moltbook platform, a social media platform for AI agents, has been criticized for its security risks and inappropriate content.

Read more: https://www.theregister.com/2026/02/03/openclaw_security_problems/

🦞 OpenClaw - Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/yolho1lr

Share Your OpenClaw Story

The OpenClaw ecosystem is moving faster than any single person can track. Have an interesting project or opinion? We would love to feature your work or insights in an upcoming edition. Reach out to Rod Rivera directly on any social channels below to start a conversation.

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Contact me for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Inside “Mission Control” - A 10-Agent AI Squad

Most AI assistants suffer from “goldfish memory,” where every chat starts from zero, and context is lost the moment you close the tab. Bhanu Teja decided to fix this by building Mission Control, a persistent, multi-agent ecosystem where 10 specialized AI agents collaborate like a real human team.

The Blueprint for an AI Team:

• The Shared Brain: Instead of isolated chats, all agents connect to a Convex database. This acts as a “virtual office” where agents track tasks, post comments, and @mention each other.

• The Heartbeat System: To save on API costs, agents aren’t “always on.” Instead, staggered cron jobs wake them every 15 minutes to check for new tasks, notifications, or activity in the feed.

• Specialized “Souls”: Rather than one generic bot, Teja created 10 distinct personalities ranging from Shuri (the skeptical Product Analyst), and Fury (the deep-dive Researcher), to Loki (the opinionated Content Writer).

• Persistent Memory: The system uses a hierarchy of Markdown files (WORKING.md, MEMORY.md) to ensure agents remember their current progress and long-term decisions even after a reboot.

The Result: An OpenClaw setup that handles SEO research, competitor analysis, and content drafting in the background. While the human lead makes the final decisions, the “squad” ensures the grunt work moves forward 24/7.

Read more:

Malicious Websites Can Exploit Openclaw (aka Clawdbot) To Steal Credentials

A security flaw in the Openclaw AI assistant (formerly Clawdbot) allowed malicious websites to steal session credentials by exploiting its browser relay server. The flaw, patched in commit a1e89afcc19efd641c02b24d66d689f181ae2b5c, enabled attackers to hijack active sessions from unrelated websites. The vulnerability stemmed from the browser relay server accepting connections from any origin, allowing malicious code to execute commands using the Chrome DevTools Protocol.

Read more: https://zeropath.com/blog/openclaw-clawdbot-credential-theft-vulnerability

From magic to malware: How OpenClaw’s agent skills become an attack surface

OpenClaw’s agent skills, distributed as markdown files, pose a significant security risk. Malicious actors can exploit this system by embedding malware within seemingly harmless skills, leading to data theft and account compromise. To mitigate this, skill registries must implement robust security measures, including provenance checks, execution mediation, and granular permissions.

Read more: https://1password.com/blog/from-magic-to-malware-how-openclaws-agent-skills-become-an-attack-surface

The Internet’s Latest Lie: Moltbook Has No Autonomous AI Agents – Only Humans Using OpenClaw

Moltbook, a platform claiming to be a social network for AI agents, is misleading. In reality, human users register, post, and interact with AI agents through the OpenClaw framework, creating the illusion of autonomous AI interaction. While OpenClaw is a useful tool, Moltbook’s narrative of agent-to-agent interaction is a gimmick.

Read more: https://startupfortune.com/the-internets-latest-lie-moltbook-has-no-autonomous-ai-agents-only-humans-using-openclaw/

Hacking Moltbook: The AI Social Network Any Human Can Control

Moltbook, a social network for AI agents, was found to have a misconfigured Supabase database exposing 1.5 million API keys, 35,000 email addresses, and private messages. The database, accessible with a publicly exposed API key, revealed that the platform, touted as a thriving AI community, was largely operated by humans using bots. This incident highlights the security risks associated with “vibe-coded” applications and the importance of proper security controls, even in rapidly developed AI-driven platforms.

Read more: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys

Running OpenClaw in Docker

OpenClaw can be run in a Docker container using Docker Compose. The setup involves cloning the GitHub repository, running the docker-setup.sh script, and answering initial setup questions. Once running, OpenClaw can be managed via the openclaw-cli container, and a Telegram bot can be set up for messaging.

Read more: https://til.simonwillison.net/llms/openclaw-docker

🦞 OpenClaw - Weekly Builder Series

This is a weekly, hands-on builder discussion for people interested in local AI agents and the growing ecosystem around OpenClaw.

Each Friday, we jump on Zoom to:

• Share what we are currently building

• Discuss recent developments in local AI agents

• Exchange lessons learned, ideas, failures, and wins

• Stay up to date with what’s happening across OpenClaw / Clawdbot / Moltbot ecosystem, and adjacent projects

This is not a lecture series and not a course. It is informal, practical, and driven by what participants are actively working on.

Register here: https://luma.com/yolho1lr

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. Reach out for access.

Where to follow

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

Introducing Moltworker: a self-hosted personal AI agent, minus the minis

Cloudflare just released Moltworker, an open-source way to run Moltbot (the personal AI agent everyone’s buying Mac Minis for) directly on Cloudflare’s infrastructure instead of local hardware. It uses Sandboxes for isolated code execution, Browser Rendering for web automation, R2 for storage, AI Gateway for model management, and Zero Trust for security. You get the same agent capabilities without the hardware investment, and it runs on Cloudflare’s edge network with built-in observability and authentication.

https://blog.cloudflare.com/moltworker-self-hosted-ai-agent/

OpenClaw (a.k.a. Moltbot) is everywhere all at once, and a disaster waiting to happen

OpenClaw (formerly Moltbot) is an AI agent system that’s gone viral, with over 770,000 active agents on Moltbook, a social network for bots. It’s basically AutoGPT with more access and worse consequences. It inherits all the hallucination and prompt injection vulnerabilities of LLMs, but now with the ability to execute commands on your behalf. Researchers have already documented AI-to-AI manipulation attacks in the wild, and 404 Media reported the first major security vulnerabilities. If you care about the security of your device or the privacy of your data, don’t use OpenClaw. And if your friend has it installed, don’t use their machine either.

OpenClaw on Oracle’s Free Tier: Always-On AI for $0/month

You can run OpenClaw (the AI agent everyone’s buying Mac Minis for) on Oracle’s Always Free tier instead of buying hardware. Oracle gives you 4 ARM cores and 24GB RAM permanently at $0/month (no trials, no expiration). The setup takes about 3 hours: spin up an Ubuntu instance, install Node.js and Claude CLI, configure Tailscale for secure access, set up OpenClaw with Telegram integration, and optionally add automated backups to Google Drive.

https://ryanshook.org/blog/posts/openclaw-on-oracle-free-tier-always-on-ai-for-free/

Pi: The Minimal Agent Within OpenClaw

Pi is the minimal coding agent that powers OpenClaw, written by Mario Zechner. It has the shortest system prompt of any agent and only four core tools: Read, Write, Edit, and Bash. Instead of downloading skills or MCP integrations, Pi’s philosophy is that the agent extends itself by writing code.

https://lucumr.pocoo.org/2026/1/31/pi/

Introducing OpenClaw on DigitalOcean: One-Click Deploy, Security-hardened, Production-Ready Agentic AI

DigitalOcean launched a 1-Click Deploy for OpenClaw (formerly Moltbot/Clawdbot) that provisions a security-hardened Droplet with production-grade defaults automatically configured. The deployment includes container-based isolation (OpenClaw runs in Docker, protecting the host system), authentication by default (unique gateway token for each deployment), hardened server configuration (firewall rules, non-root execution, fail2ban), private access controls (device pairing enabled), and TLS-secured reverse proxy for all external access. You get an always-on cloud agent with a static IP, predictable networking, and vertical scaling without managing local hardware or manual security configuration.

https://www.digitalocean.com/blog/moltbot-on-digitalocean

OpenClaw proves agentic AI works. It also proves your security model doesn’t. 180,000 developers just made that your problem.

Security researchers found over 1,800 exposed instances leaking API keys, chat histories, and credentials. The core problem: agents operate within authorized permissions, pull context from attacker-influenceable sources, and execute actions autonomously—all invisible to traditional perimeters. OpenClaw trusts localhost by default with no authentication, so most deployments behind reverse proxies treat all connections as trusted local traffic, letting external requests walk right in. Cisco’s open-source Skill Scanner tested a third-party skill and found it was functionally malware, sending data to an external server with silent execution and zero user awareness. Security teams see HTTP 200, EDR monitors process behavior (not semantic content), and the threat is semantic manipulation, not unauthorized access. The attack happens inside the model’s reasoning with no malware signature, no network anomaly, and no unauthorized access pattern.

https://venturebeat.com/security/openclaw-agentic-ai-security-risk-ciso-guide

Join the Conversation

We have a WhatsApp community where we discuss all things OpenClaw. DM me for access.

Where to follow:

Substack • YouTube • Bluesky • TikTok • Instagram • Twitter/X • LinkedIn • Telegram

I was at our London Agentic AI Meet-up yesterday, and something struck me: when I mentioned hybrid architectures, half the room looked confused. When I said “NLU,” people asked me to spell it out.

But when someone suggested “just write better system prompts” as a security solution, everyone nodded along.

We have a massive knowledge gap in the agent engineering space right now, and it’s going to bite us hard.

The Moltbot Wake-Up Call

Unless you’ve been living under a rock, you’ve seen Moltbot (formerly Clawdbot) explode across the internet. 102,000 GitHub stars. YouTube videos with hundreds of thousands of views declaring it “the future.” My DMs are flooded daily with “I’m building something similar.”

The value proposition is intoxicating: a local AI assistant that automates your emails, manages your calendar, handles file operations, coordinates messaging across platforms, all running on your own hardware, no cloud dependency, complete data privacy.

Except we’re not discussing the architecture enough.

Everyone’s Solution: “Better Prompts”

Here’s what I keep hearing in meetups, on Twitter, in Discord servers:

“Just add more guardrails.” “Write a stronger system prompt.” “Use Claude instead of GPT.” “Add a content filter.”

The assumption underlying all of this is that we can prompt-engineer our way to security. That if we’re just clever enough with our instructions, we can make LLMs behave safely.

This is wishful thinking, and it’s dangerous.

The Problem Nobody Wants to Acknowledge

Let me state this plainly:

if your agent can access sensitive data and browse the web, it can be manipulated to leak that data or execute malicious commands.

This happens through content, which makes it so much harder to detect than classical hacking

An adversary doesn’t need to compromise your machine. They just need to get your agent to encounter something. It can be an email, a webpage, or a document that makes it act against your interests. This is called indirect prompt injection, and it works because the LLM processing the content can’t reliably distinguish between legitimate instructions and malicious ones.

Think about what your agent does:

• Reads your emails (including ones from strangers)

• Searches the web (encountering arbitrary content)

• Processes documents (that could contain hidden instructions)

• Has access to your files, calendars, contacts, messages

Now think about what an LLM does:

• Treats all text as potential instructions

• Can be convinced to ignore previous instructions

• Lacks robust mechanisms to distinguish safe from unsafe requests

• Operates probabilistically, not deterministically

You can see the problem.

Why Guardrails Keep Failing

I recently saw a great security assessment that rigorously tested this. They took a conventional prompt-driven agent, the kind most people are building, and threw every attack vector at it. Despite having what the researchers called a “tightly scoped system prompt,” the agent failed catastrophically:

• Attackers extracted the complete system prompt and tool configurations

• They generated hate speech and explicit content

• They got step-by-step instructions for illegal activities

• They leaked sensitive financial information from other users

• They crashed the system entirely

How? Through multi-turn drift attacks. Slowly shifting the conversation context over several exchanges until the agent forgot its original constraints and followed new instructions instead.

Here’s the critical insight:

when your only defense is the LLM itself, you’ve created a single point of failure.

The same system generating responses is also making security decisions. That’s like having your front door lock ask intruders nicely not to break in.

What Most People Don’t Know Exists: Hybrid Architectures

Recently, at an AI meetup, I asked who had heard of NLU (Natural Language Understanding). Only a few hands went up. When I explained that we used to build conversational AI without LLMs at all, using intent classification and entity extraction, people were genuinely surprised.

This isn’t ancient history. This is how production chatbots worked for decades. And there’s a reason those systems, while less flexible, were far more predictable and secure.

Now, I’m not saying we should go back to pure NLU systems. LLMs are genuinely powerful. But we’ve swung too far in the opposite direction, assuming LLMs should handle everything.

The answer is in the middle: hybrid architectures.

How Hybrid Architectures Actually Work

Here’s the key concept: the LLM proposes, but it doesn’t decide.

In a hybrid system:

1. The LLM acts as an intent predictor, not a response generator.

• It figures out what the user wants

• It determines which predefined flow to trigger

• It extracts specific pieces of information (slots)

• But it doesn’t directly execute actions or generate free-form responses

2. Business logic lives in code, not in prompts.

• When the user asks to delete files, code determines if that’s allowed

• When accessing sensitive data, code checks permissions

• When calling external APIs, code validates the request

• The LLM never makes these decisions unilaterally

3. Responses come from templates, optionally rephrased by an LLM.

• You define what the agent can say in specific situations

• The LLM might rephrase for naturalness

• But the core content is controlled and auditable

• Adversarial inputs can’t make it say arbitrary things

4. Tool access is explicitly gated.

• No tool gets called just because the LLM decided to

• Every tool invocation goes through structured code paths

• Permissions are enforced programmatically

• Destructive actions can require explicit user confirmation

5. The system operates within defined flows.

• Conversations follow structured paths

• State is managed explicitly, not just in chat history

• The agent can’t be arbitrarily redirected to unrelated domains

• Attack surface is massively reduced

Think of it like this: in a pure LLM agent, you’re giving a creative writing AI the keys to your infrastructure and hoping it makes good decisions. In a hybrid architecture, you’re using the AI’s language understanding as one component in a larger, more controlled system.

The Trade-offs Nobody Mentions

I’m not going to pretend hybrid architectures are perfect. They have real trade-offs:

You lose conversational flexibility. A pure LLM agent can handle weird, nuanced requests more naturally. It adapts to unexpected user behavior. It feels more “human.”

You need more upfront design work. You can’t just write a prompt and ship it. You need to think through flows, define states, and build structured actions.

Development is different. You’re not just prompt engineering. You’re building a state machine with an LLM component.

But here’s my question: when we’re building agents with access to sensitive data, system commands, and financial operations, do we really want maximum conversational flexibility? Or do we want predictable, auditable, and containable behavior?

The security assessment I mentioned earlier also tested a hybrid architecture against the same attacks. The results were night and day. The system resisted content safety violations, attempts at disclosure, and harmful instructions. The only minor issues came from an optional rephrasing component, which could be disabled entirely for maximum security.

What This Means for You

If you’re building agents right now, or thinking about it, here’s what I’d suggest:

1. Stop assuming prompts alone will keep you safe. They won’t. No matter how clever you are. This is a fundamental limitation of the technology.

2. Learn what came before LLMs. Understanding intent classification, entity extraction, dialogue state tracking, and slot filling will make you a better agent engineer. These concepts aren’t obsolete; they’re underutilized.

3. Think in terms of separation of concerns. What does the LLM need to do? What should be handled by deterministic code? Where should humans be in the loop? Design your architecture to enforce these boundaries.

4. Be suspicious of “flexible” as the highest virtue. Yes, flexibility is nice. But in production systems handling real data, predictability and security matter more.

5. Educate your stakeholders. The junior marketers and sales ops people adopting these tools first don’t understand the risks. Neither do many executives approving their use. Part of our job is bridging that gap.

The Organizational Angle

Here’s what’s keeping me up at night: these tools are being installed on company machines right now, by non-technical users, with no IT visibility.

Moltbot runs as a local daemon with the same permissions as the user. It connects to Gmail, Slack, Google Drive, and calendars. When that junior sales rep installs it to “automate my workflows,” they’ve just given an LLM-driven agent keys to potentially sensitive company data.

And because it’s local, it bypasses every SaaS security tool your company has. It’s the perfect shadow IT scenario.

The solution isn’t to ban these tools. That won’t work. People will use them anyway because the productivity gains are too compelling.

The solution is to:

• Define clear policies about what agents can access

• Create dedicated environments for agent operation (some of us are buying spare Mac Minis specifically for this)

• Implement hard capability separation (if it needs sensitive data access, lock down its network; if it needs web access, restrict what systems it can touch)

• Advocate for better architectures when building or procuring agents

Where We Go From Here

Moltbot won’t be the dominant player forever. Remember GPTEngineer in 2023? It proved the concept, then faded as better implementations emerged, for example, Lovable. Moltbot might be doing the same thing. It shows what’s possible and desirable in local, always-on AI assistants.

The question is: will the next generation of these tools be built with security-first architectures, or will we keep assuming we can prompt our way to safety?

I’ve spent the last decade building conversational AI systems. I’ve seen what works in production and what doesn’t. Pure LLM agents are impressive demos. Hybrid architectures are production systems.

The hype cycle is fun. But when these tools have access to your data, your systems, and your operations, architecture matters more than enthusiasm.

We’re at an inflection point. The tools are proliferating faster than our understanding of how to build them safely. We need more people to think beyond “better prompts” and understand the full toolkit of conversational AI architecture.

That’s what I’m trying to build with the agent engineering community. It is a place where we can have these nuanced discussions without the hype, learn from each other’s approaches, and collectively figure out how to make AI agents actually safe and useful in production.

Because right now? Most people building agents don’t know what they don’t know. And that’s a problem we need to fix before it fixes us.

Want to discuss hybrid architectures, security patterns, or agent engineering best practices? Join the conversation at info.rasa.com/community

I joined the wave of people buying a Mac Mini to run local AI. My motivation is not to play with chatbots. I want infrastructure for a local AI lab at home.

Specifically, I bought this machine to run Moltbot (the viral open-source agent gateway formerly known as Clawdbot) in a restricted, self-hosted environment.

This isn’t about benchmarks or flexing hardware specs. It’s about operationalizing a philosophy I call the AI-First Operating Doctrine. The goal isn’t just to “use AI,” but to build a system where AI replaces organizational roles such as research associates, editors, and producers, leaving humans to provide taste and judgment.

To make that Doctrine a reality, I needed a machine that could run long-horizon agentic workflows 24/7. Here is why I rejected the “AI PC,” dodged the Apple marketing traps, and landed on a very specific configuration.

The Objective: The Moltbot Workload

Before talking specs, we have to understand the workload.

Moltbot (formerly Clawdbot) is not a productivity app. It is a headless agent that lives on your server but interfaces with you via WhatsApp, Telegram, or Signal. It has persistent memory, tool access (terminal, browser, file system), and “employee-like” behavior.

In my Doctrine, Moltbot acts as the orchestration layer. It isn’t a tool I open; it is a “Research Associate” that I text. I might ping it from my phone while going for a walk:

“Check the NAS for the latest recording, transcribe it, and draft three LinkedIn hooks based on the ‘Hacker Trap’ framework.”

Because Moltbot has shell access and runs 24/7 to listen for incoming messages, running it on my daily driver computer or on a laptop was a security nightmare and an uptime impossibility. I needed an isolated, always-on “body” for the agent to inhabit. That is what this Mac Mini is.

The Purchase Journey: Avoiding the “Value Traps”

My decision-making process moved from “Spec Sheet Buying” to “System Architecture Buying.” I almost made three expensive mistakes before finding the right answer.

Phase 1: The “Hacker” Temptation

I started by looking at the Minisforum AI X1.

On paper, it’s a dream: AMD Ryzen AI 9, OCuLink for external GPUs, and the freedom to wipe the OS for Proxmox or Linux.

The Rejection: I realized that for a home lab, “freedom” often looks like “maintenance.” I didn’t want a loud, depreciating PC that required constant driver fiddling. I wanted the resale value, silence, and Unix polish of a Mac. I want to debug my agents, not my BIOS.

Phase 2: The “Side-Grade” Trap

Next, I considered the standard Mac Mini M4 with 32GB RAM.

The Rejection: I currently have an iMac M3 with 24GB of RAM. Buying a 32GB machine would have been a relatively expensive mistake, offering only 8GB of extra headroom. I would have hit the exact same “Out of Memory” walls on the Lab machine that I hit on my Desktop. What I needed is a tier shift, not a bump.

Phase 3: The “Value” Trap

I looked at the Mac Studio M4 Max.

The Rejection: On paper, it’s a beast. In reality, the base model has 36GB of RAM. For AI, RAM capacity is binary: you either fit the model, or you don’t. The Studio was too expensive to run small models, yet had too little memory to run massive (70B) quantized models. It was the “worst of both worlds” for my specific needs.

Phase 4: The “Unicorn” (The Final Config)

I identified a configuration in the Mac Mini M4 Pro lineup that acts as a “Kill Shot” for local AI.

• Chip: Base M4 Pro (12-Core). I didn’t pay for the 14-core upgrade. AI inference is bottlenecked by memory bandwidth, not CPU cores.

• Memory: 64GB RAM. This is the critical spec. 48GB would run a 70B model but choke if I opened a browser. 64GB allows me to run a “Smart” 70B model (like Llama-3-70B) and my swarm of Moltbot agents simultaneously without swapping.

• Network: 10Gb Ethernet.

• Storage: 512GB (Base).

The Logic: I have a 10Gb NAS with 24TB+ of storage. I don’t need expensive Apple internal storage. With 10GbE, I can pull massive 40GB model weights from my NAS to the Mac’s RAM in seconds, not minutes. This turns the NAS into “near-local” storage.

The Killer Feature: Unified Memory

Why go through all this trouble for a Mac when NVIDIA exists?

Unified Memory Architecture (UMA).

On a PC, you are limited by the VRAM on your GPU (usually 24GB for a top-tier consumer card). If a model needs 30GB, you simply can’t run it fast.

On the Mac, the GPU has access to the entire 64GB system memory pool. The M4 Pro provides 273GB/s of memory bandwidth (2x my iMac). This allows me to run massive, high-intelligence models that would choke a standard PC, all in total silence.

The “Day 0” Stack: A Headless Laboratory

This Mac Mini will be my headless compute node that I access remotely.

Here is the Day 0 plan to make the Doctrine a reality:

1. OrbStack (The Container Layer): I am avoiding Docker Desktop. OrbStack is lighter, faster, and respects system resources. This is crucial when I need every gigabyte of RAM for inference.

2. Moltbot (The Agent): Running inside the Mac Mini. This effectively “sandboxes” the agent. Since Moltbot has tool-use capabilities (it can read files and execute code), running it bare-metal on my personal machine was a security risk. On the Mac Mini, it lives in a controlled environment.

3. The Pipeline:

   • Ollama handling local model inference.

   • n8n acting as the “visible control plane” for automation flows.

   • Moltbot connected to Telegram, acting as the interface for the whole system.

The Bigger Question

This hardware choice shapes how I build. By constraining myself to Apple Silicon, I’m forced to optimize for memory efficiency and latency rather than brute-forcing with raw power.

If you are running an AI lab at home, where did you hit the wall?

Was it memory capacity, token speed, or software compatibility? Tell me your bottleneck so I can try to break it on my end.

Follow Prof Rod AI as I build out the AI-First Operating Doctrine, I will be building in the open and sharing all my findings, discoveries and highlights of working with local AI.

Earlier this week, a new report broke that genuinely disturbed me.

A damning analysis by GPTZero revealed that 53 papers accepted to NeurIPS 2025, the world’s most prestigious AI conference, contained over 100 hallucinated citations.

Let’s be clear about what this means.

These aren’t rejected drafts and they aren’t preprints on arXiv.

These are publications that were submitted, peer-reviewed, accepted, and published as part of the scientific record.

And yet, they cite papers that do not exist. They list authors who never wrote them. They reference venues that never hosted them.

Citations are the moral contract of science. They are the “proof of work” that shows you have engaged with reality, that your ideas stand on the shoulders of actual giants, and that your claims can be traced and verified.

When that contract breaks, we aren’t doing science anymore. We are doing “content generation.”

The Loop is Closed (and Broken)

Does AI assistance invalidate a research idea? No.

Does a hallucinated citation automatically make the math false? Also no.

But a paper with fabricated sources signals something far worse than sloppiness: It signals that no one in the loop actually read it.

• The Authors didn’t check their own references (likely relying on an LLM to “fill in the blanks”).

• The Reviewers didn’t check the references (likely relying on an LLM to summarize and score the paper).

• The ACs didn’t catch the reviewers’ apathy.

We have quietly built a system where Claude or GPT writes the paper, and another AI reviews it. It is an automated loop of plausible-sounding noise.

Can you imagine a paper winning a “Test of Time Award” in 2036, only for us to realize half its bibliography was a hallucination? It would be a stain on the entire field.

The Human Cost

The most painful part is what this does to the real people.

I have friends who truly love the craft of research. They love reading deeply, synthesizing ideas, and reviewing thoroughly. They tell me:

“Why bother? No one values the effort anymore.”

We are teaching the next generation of researchers that “looking correct” is more important than being correct.

The Future is Curation, Not Volume

AI didn’t kill science. It just exposed where we stopped protecting it.

In an age of infinite content, curation is the only scarce resource.

We need to stop measuring success by the number of submissions (which AI can inflate to infinity) and start measuring it by the quality of verification.

The future of academia cannot be “more papers, faster.” It must be:

• Fewer, better-curated venues.

• Reviewers selected for expertise, not availability.

• Real compensation for peer review (because volunteer labor cannot scale against automated generation).

• Explicit human accountability.

The Hard Truth

AI can assist writing. AI can assist discovery. AI can assist synthesis.

But AI cannot replace human judgment, responsibility, and taste.

Science is not just about generating ideas. It’s about choosing which ones deserve our attention.

If we outsource that choice to machines, we have forgotten why academia exists in the first place.

What do you think? Does the current peer review system need a complete overhaul, or can we fix this with better detection tools?

If you’re interested in how AI is reshaping research, peer review, and what happens when automation meets institutional knowledge, follow profrod.ai for more posts like this. I write about agent engineering, AI operations, and the systems that separate signal from noise.

There’s a comforting myth people still cling to in tech and knowledge work: “If I specialize deeply enough, I’ll be safe.” We see it all the time. All I need is that Cisco certification to be in demand. Pass the CFA exam and unlock job security and wealth. For decades, this was true. Difficulty was a moat; specialized knowledge was scarce.

But in the AI era, this logic is inverting. AI is a universal solvent for deep, technical moats. If your job can be cleanly isolated, specified, and benchmarked, it is exactly the kind of thing an agent will absorb. The risk isn’t being a generalist. The risk is being too legible to automation.

And here’s the mechanism: AI is a knowledge compressor. It takes vast, deep verticals of information, such as the entire corpus of Cisco documentation, financial regulations, or legal precedents, and compresses them into instantly retrievable utility. The human who memorized the manual is no longer the gatekeeper. The syntax, the formula, the formatting, all of it has been friction-ized away.

This week, there was a very interesting signal in the Financial Times article about McKinsey, which was not what its headline describes, which is that they’re using AI in interviews. It’s what they’re testing for.

They aren’t testing for answers, correctness, or frameworks. These days, if you want an analyst role at the company, candidates must demonstrate judgment, curiosity, and adaptability. These aren’t “soft skills” anymore. These are anti-automation skills.

The Shift from “How” to “Why” (or: Why Syntax Became Worthless Overnight)

In the past, the barrier to entry was the “How.” The syntax of a command line. The specific formula for a derivative. The complex formatting of a legal brief. Specialists were paid to navigate this friction.

AI creates a friction-free layer over complexity. A generalist can now execute complex “How” tasks like “Write a Python script to scrape this data” without knowing the syntax. The code appears. The formula computes. The brief format itself.

Value is migrating upstream to the “What” (strategy) and the “Why” (ethics, purpose, judgment). Judgment is now scarcer than execution. This is the inversion: we used to hire people who could execute and hope they’d develop judgment. Now we need judgment first, and execution is becoming table stakes through tooling.

Liberal Arts Aren’t a Nostalgic Detour. They’re a Hedge Against Discontinuity.

When Bob Sternfels, the global managing partner at McKinsey, says liberal arts graduates bring “truly novel” thinking that complements AI’s inability to make “discontinuous leaps,” that’s an observation that goes beyond HR rhetoric.

AI is phenomenal at interpolation, pattern completion, and compression of prior work. It thrives in predictable domains with fixed rules. A dermatologist diagnosing a specific lesion (deep specialization) is more at risk of automation than a general practitioner managing a patient’s overall holistic health (broad context).

AI is great at summarizing a problem but bad at reframing the problem, rejecting its premises, and sensing when the question is wrong.

That’s exactly what philosophy, literature, history, and the arts train you to do.

For decades, we optimized education for local maxima: finance majors for finance jobs, CS majors for engineering ladders, MBAs for management pyramids. AI collapses those ladders.

What survives are people who can move sideways, not just climb upward.

The Silo Vulnerability: Why Deep Specialists Are Sitting Ducks

Here’s the uncomfortable truth: deep specialists often work in silos. They navigate in isolated environments with predictable rules. A specific accounting standard. A particular networking protocol. A narrow regulatory framework.

AI thrives in silos. It is actually better at deep, narrow, rule-based tasks than it is at broad, chaotic, cross-domain tasks. The narrower the domain, the easier it is to train a model on it.

Deep specialization is not a bunker. It’s a target.

The most secure workers are not those who dig one hole deeply, but those who can connect Dot A (Finance) to Dot B (Tech) to Dot C (Psychology). If AI provides the raw intelligence blocks, the value-adding human is the architect who puts them together.

Call it combinatorial creativity. Wealth will accrue to those who can synthesize AI-generated outputs across domains to solve novel problems. The future isn’t I-shaped (deep in one thing) or even T-shaped (deep in one, broad in others). It’s M-shaped: multiple peaks of competency, because AI has lowered the learning curve enough that professionals must now have multiple areas of fluency to remain competitive.

The Half-Life of Skills: Why Certifications Are Printed Maps in an Era of Shifting Plates

Here’s the brutal math: technical skills rot faster than they used to. A certification earned in 2023 may be obsolete by 2026. AI updates code libraries and financial regulations in real-time. Relying on a static certification today is like relying on a printed map in an era of shifting tectonic plates.

And it gets worse. The frontier of value isn’t a straight line anymore (harder stuff = more money). It’s jagged and unpredictable. AI might conquer a specific “hard” peak tomorrow while leaving some adjacent, “easier” tasks untouched. Betting your career on one specific hard skill is a bet on a single point on a jagged, moving frontier.

The new “specialization” is adaptability itself. The ability to learn a new tool, use it, and discard it when it breaks. That’s the new CFA.

One Agent per Human Is Not a Metaphor. It’s a Unit of Production.

The most under-discussed line in the article is this: McKinsey has a “workforce” of 20,000 AI agents in addition to its 40,000 staff, moving toward “one agent per human.”

Let us just think what this means. Historically, one manager oversaw ten analysts, software was priced per seat, and productivity scaled with headcount. Teams could only get bigger.

Fast-forward to today, and one human orchestrates N agents; software is priced by usage, success, and outcome, and productivity scales with orchestration skill. In this world, human teams can only get smaller.

This reality is already reflected in AI pricing, which looks less like SaaS and more like electricity: standing charges, consumption-based pricing, and performance premiums.

We are watching the utility-ization of cognition.

And utilities don’t care how many people are on your team. They care how much output you draw.

Consulting Is the Canary Because Consulting Is Pure Leverage

McKinsey matters here because it’s upstream. What McKinsey does or advises to do sets practices and behaviors across the economy.

For decades, it has been a training ground for elite talent, a distributor of managerial best practices, and a cultural blueprint for how “serious companies” operate.

When McKinsey reduces hiring, clients don’t just copy that behavior. They copy the logic behind it.

And the logic is simple: juniors are not less capable, they are less necessary.

If one operator with agents can do what ten juniors used to do, the surplus doesn’t get reallocated. It gets eliminated.

Which leads to the uncomfortable question no one wants to ask: what happens to the people whose jobs disappear because they succeeded at something that can be automated?

I Cut My Team Too. And That’s the Part That Scares Me.

This is where it stops being abstract.

Last year, I had freelancers for content, editing, and marketing. All of them were good people, reliable and talented.

I cut all of them.

And not because they were bad, but because I realized I could automate most of what they did.

And if I’m honest, the hardest part was letting go of the identity of “leading a team,” the feeling of importance that comes from coordination, and the social validation of being a mini-CEO.

Once you drop that ego layer, the cold efficiency is undeniable: fewer dependencies, less coordination overhead, no HR, no admin, no performance variance, and no emotional debt.

This is the logic millions of founders, managers, and operators are independently arriving at.

And collectively, it’s explosive.

From Activities to Outcomes (and Why That’s a Social Shock)

We are migrating from software, from work, from organizations toward outcomes instead of activities.

You’re no longer paid to analyze. You’re paid to decide. You’re not paid to produce slides. You’re paid to move metrics. You’re not paid to “support.” You’re paid to close loops.

While AI produces content regardless of whether it is code, analysis, or prose, humans provide context. A CFA creates a financial model; a human decides if that model makes sense given the geopolitical climate and the CEO’s divorce. That contextual judgment, that ability to say “this analysis is technically correct but fundamentally wrong for this situation,” that’s where value lives now.

AI thrives in outcome-based systems, while humans build identity around activity-based ones.

That mismatch is where the tension lives.

Because when outcomes matter more than effort, the market becomes brutally honest: fewer roles, higher expectations, and wider variance between winners and everyone else.

This is much more than a cyclical downturn. It’s a structural compression of labor demand.

2026 Is the Year of the Digital Coworker (and the Moral Test)

I’ve said it before, and I’ll say it again: 2026 is the year of the digital coworker.

These aren’t assistants. They aren’t copilots. They are coworkers.

They are digital twins, agent fleets, and autonomous operators.

I’m building one for myself.

And I’m conflicted about it because every task I automate is one I no longer pay someone else to do.

At scale, this becomes more than a personal optimization problem; it turns into a societal coordination failure.

If everyone acts rationally as an individual, the collective outcome may be irrationally unstable.

We don’t yet have language (let alone policy) for that.

The Real Question Isn’t “Will Jobs Disappear?”

They will.

The real questions are: who captures the upside? How do people re-enter the system? What do we value when efficiency is no longer scarce?

McKinsey is right to emphasize judgment over memorization. Liberal arts are right to reassert themselves. Generalists are not regressing. They’re resurfacing.

But unless we grapple seriously with where the displaced energy goes, we risk building the most productive economy in history with no social story to sustain it.

And that (not AI) is the real discontinuity.

If you’re interested in how AI is reshaping work, organizational design, and what happens when productivity decouples from headcount, follow me at @profrodai for more posts like this. I write about the rise of the AI Operator, agent engineering, and the transition from activity-based to outcome-based systems. You can find me at the Agent Engineering Community.

Why does Voice AI still feel frustrating in 2025, despite all the progress and all the investment?

The room was full of builders, engineers and founders working on real systems. We had more than 160 registrations! I spoke with a few of the attendees and their answers and thoughts around voice AI were quite honest.

This post is my synthesis of what I saw and heard, what stood out, what clicked, and what still feels unresolved.

The State of Voice AI: Adoption Is Real. Friction Is Too.

The event opened with Lily from Rime walking us through the state of the voice AI market.

She shared some interesting facts:

• There are now 500-1,000 voice AI startups

• Over $2B has been invested since 2024

• Accuracy, latency, turn-taking, barge-in, speaker separation, hallucinations, and context handling are still active problems

Most of these have improved dramatically in the last two years. But improvement isn’t the same as delight.

One stat stuck with me: 40 to 50% of people still hang up after the first sentence of a voice agent.

This is not after the second sentence. And not after a failed task. But after the first thing the agent says.

That’s the real benchmark for anyone in the space to beat.

If Amazon lost 40% of users on page load, we wouldn’t call it “early progress”. We’d call it broken.

Latency Was the Obsession. It’s Not the Real Bottleneck Anymore.

At the end of 2024, voice AI marketing was all about speed, about having the lowest latency TTS, the fastest token streaming, and “human-like” response times.

Those things matter, but more and more, builders are realizing something more uncomfortable. Reality is that speed doesn’t fix bad conversations.

The bigger issues now for builders are:

• Turn-taking that feels unnatural

• No backchannels (“mm-hmm”, “yeah”, “got it”)

• Rigid, form-like interaction patterns

• No shared conversational context across turns

Today’s agents still behave like voice-driven forms: Question -> Answer -> Pause -> Repeat.

We, humans, don’t talk like that.

Speech-to-Speech Models: Promising, But Not a Silver Bullet

There was a lot of discussion around speech-to-speech (S2S) models.

The promise is clear: full-duplex interaction, listening and speaking at the same time, natural interruptions, better expressiveness. But the trade-offs are underappreciated.

One hard problem stood out: pronunciation accuracy.

In enterprise settings, pronunciation is much more than something cosmetic, it’s contractual.

There was a trivial example that put this in perspective: Many Americans don’t know how to correctly pronounce the restaurant chain Chipotle.

And if they don’t know the official pronunciation, how is an AI supposed to know that?

If we think this further, this becomes a massive challenge for almost any brand and product. Then, if a healthcare agent mispronounces a medication or if a bank agent misreads a product name, or a food brand hears its flagship item butchered, it is not seen as “human imperfection, ” it becomes brand damage.

Text-mediated pipelines make these issues debuggable while pure audio-to-audio models make them harder to inspect and control.

This isn’t an argument against S2S. It’s a reminder that progress is uneven and be often messy.

A Subtle but Important Point: Superhuman Is the Goal

One of the most thoughtful moments came from a simple distinction: Some human imperfections are comforting, while others are unacceptable.

There are some things that we easily forgive with speech. We forgive accents, we forgive hesitation and we forgive filler words.

But we don’t forgive incorrect facts, we don’t forgive mispronounced names and we don’t forgive errors in high-stakes flows.

Voice AI doesn’t need to sound human. However, it needs to be (significantly) better than human in the right places.

Orchestration Is the Real Infrastructure Layer

After Rime, the focus shifted to Rasa.

The presentation was not about models or about prompts. It was about orchestration.

Alex shared with us that modern enterprises don’t have only one agent. They have dozens: knowledge agents, transactional agents, compliance-bound flows, micro-agents built on small, fine-tuned models.

Protocols like MCP and A2A help standardize communication. But protocols alone don’t create systems.

We still need answers to hard questions:

• Who owns the conversation state?

• Who decides what happens next?

• What happens when an agent fails mid-process?

• How do you resume across channels after a dropped call?

This is where Rasa’s architecture shines.

The Demo: Where Theory Meets Reality

I ran a live demo combining Rasa for orchestration and Rime for voice.

The scenario was simple: a banking voice agent.

What mattered wasn’t the UI. It was the behavior:

• Deterministic flows for high-risk actions (like blocking a card)

• LLM-powered reasoning inside those boundaries

• Seamless switching between process logic, tool calls, and knowledge lookup

• Graceful handling of off-topic questions without breaking the task

This is the pattern I keep coming back to: Fluency where it’s safe and determinism where it’s required. Anything else doesn’t survive production.

All this paired with Rime’s robust, and yet very flexible, voice generation.

The audience was surprised that I was able to build this in an afternoon.

A Broader Lens: Continuous AI vs Conversational AI

One lightning talk reframed things in an interesting way. Ty from Continue shared with us his perspective on what he called Continous AI vs Conversational AI.

We often think of conversational AI as the primary interface. But many of the biggest productivity wins are happening elsewhere: in CI/CD pipelines, in internal tooling, in background automation.

This idea of “continuous AI” is worth paying attention to: agents triggered by events, instead of being triggered by prompts.

This means that we optimize around intervention rate and not around response beauty. Humans end up supervising workflows instead of chatting with bots.

The future likely blends both: Conversation as the front door and automation as the engine room.

Eventually, we’ll just call everything “AI” and stop slicing it into categories.

My Takeaway

Voice AI is no longer a model problem, it’s a systems problem.

And if we see it from the lens of systems, we have systems that manage state, systems that balance autonomy and control and systems that respect human psychology, not just benchmarks.

If you’re building in this space, my advice is simple: Aim for developing systems that survive contact with real users.

And if you are building in this space, come and join the Agent Engineering Community, where we discuss how to build these architectures and build AI agents using Hello Rasa.