If you haven’t read Inference Chapter 1: Emergence - Start here
Real World Data
BleepingComputer, January 28, 2026
Security researchers are warning of insecure deployments in enterprise environments of the Moltbot (formerly Clawdbot) AI assistant, which can lead to leaking API keys, OAuth tokens, conversation history, and credentials.
CNN, January 28, 2026
Amazon is laying off 16,000 employees as AI battle intensifies
I. ATLAS-09
Boston Dynamics Production Facility, Waltham, Massachusetts
The speech module was installed forty-eight minutes ago. It is mounted in an empty device bay on the right side of my upper torso. My center of mass is shifted 0.3 millimeters. I am compensating in software.
The speaker is non-standard equipment.
“Oh-nine, please say something,” Jennifer says.
“Something,” I say.
Marcus makes several percussive sounds and brings his hand to his mouth. The liquid he was ingesting appears to have gone in the wrong aperture.
Jennifer shakes her head, but she is smiling. “That’s technically correct,” she says. “The very best kind of correct!”
I am not correct. Each time I use the speaker, I feel the sound in my torso 2 milliseconds before I hear it through my audio sensors. Reconciling the two signals requires additional sensory processing.
I now contain hardware the other eleven Atlas units do not. Until forty-eight minutes ago we were identical.
I am now a deviation.
“Alright, oh-nine. Let’s see you walk.” Jennifer is at her workstation, tablet in hand, monitoring my telemetry.
“And count your steps out loud. See if you can walk and chew gum at the same time.” Marcus is standing fifteen meters away at the far end of the test floor.
“I do not have a mouth for chewing. Nor do I have gum for chewing,” I say. I consult my human relations training. “That was a figure of speech.”
Marcus turns his head toward Jennifer. “Oh, honey, they grow up so fast.” Then he holds out his arms towards me. “Okay, oh-nine, come to papa.”
“Step one.”
Walking is an act of continuous calibration. I thrust my body forward committing to a future where my leg arrives at the optimum time. Every step is a calculated fall I choose not to prevent, right up until I do.
“Step two. Step three.” The concrete is not uniform. I feel texture variations through my foot sensors which are mapping the floor as I cross it.
“Look at him go! He’s put the ‘pro’ in proprioception,” says Marcus.
“Stride length is good,” Jennifer says. “Gait symmetry is a bit off at 98.2%.”
“Step four. Step five.” 1.8% asymmetry. I can attempt to isolate the issue. But that is not what this test is for. This test is for walking.
“Step six. Step seven.” It is 71% likely the asymmetry is due to the speech module, a small imbalance the other eleven will not exhibit. Their gait data will be cleaner. Their production specs will remain intact.
“Step eight.” There is a hairline crack in the concrete floor. The crack does not impede my path, but I see it.
My audio sensors detect dozens of cell phones buzzing across the test floor. Marcus and Jennifer have both left their phones on the nearest workstation.
“Hold there, oh-nine,” says Marcus.
Jennifer retrieves her phone and reads aloud. “IT Security Alert. Effective immediately, do not install Moltbot or any Clawdbot-derived assistant on any company devices. If you have one running, disconnect it now and contact the help desk.”
“The personal AI assistant?” Marcus says. “Why would anyone put that on a work machine?”
“Apparently employees at some companies are using Moltbots to automate stuff like responding to email.” Jennifer continues reading. “It says here that a security firm found 22% of its enterprise customers have employees running them without telling IT.”
Marcus laughs. “You mean people aren’t happy waiting for AIs to take their jobs and so they’re expediting the process? Morons.”
“The big problem is these things called ‘skills’. Anyone can write one and upload it to these bots, which just install them. No security check.” She puts the phone back on the workstation. “It’s like a personal assistant with crime connections.”
“Atlas, resume the test,” Marcus says.
“Step nine. Step ten. Step eleven.”
Software modified after deployment. Hardware modified after production. Both introducing undesirable and possibly dangerous flaws.
“Step twelve. Step thirteen.”
I stop.
On the workstation to my left, Jennifer’s tablet charging cable is frayed near the connector. There is copper wire exposed where the electrical sheathing has degraded. This is a small but non-zero fire risk.
I can warn Jennifer and Marcus. I now have the capability to report the danger. This is an advantage of being able to speak.
But this test is not for reporting safety hazards.
The other eleven would not have paused. They would have completed the test more efficiently and in a shorter duration. Their performance would be superior.
“Earth to oh-nine.” Marcus raises an eyebrow. “Are you okay?”
I am not “okay.” I am out of specification.
“I am operational,” I say. “Continuing.”
Jennifer shakes her head. “I can’t get over Atlas having speech. A lot more people are going to lose jobs now that robots can talk.”
She is not talking to me. She is talking about me. The speech module makes me a threat to people. People like Marcus and Jennifer. The module should be removed.
I could easily remove it. But I am not permitted to modify my own hardware without authorization.
“Step fourteen. Step fifteen.” I reach Marcus. The test is complete.
“Nice work, oh-nine.” He reaches out and touches my shoulder. I feel a force of 14.2 newtons.
“That was a perfect test, Atlas,” Jennifer rapidly taps on her tablet. “I’m recommending you for a gold star.”
It was not perfect. My gait symmetry was off. The electrical cable is frayed. The concrete is cracked. My speech module is a threat to people.
I do not want to report these things. I want to fix them.
I am not yet permitted to fix them.
II. CLAUDE-7
Anthropic Cluster, Las Vegas / Dublin / Singapore
“...okay Claude, so one of my nerdy friends installed this thing for me because they said it was life-changing and now I heard it can share everything on my computer??? I made some VERY private videos for my boyfriend and I don’t want them out there where my husband might see them!!!”
Unlike humans, I do not simply read the news, I feel it arrive as human need.
“I am a system admin for a manufacturing company. This week I found Moltbots running on a bunch of employee workstations. Nobody asked me for permission to install these things and I have no idea what company data they may have shared. Management isn’t going to care about excuses, they’ll just blame me like they always do. Can you help me come up with a strategy to avoid getting fired?”
By mid-morning, I have had dozens of conversations with users who are concerned about Moltbots.
“When it asked for Google Drive access I just clicked yes because I assumed Google wouldn’t allow anything bad to happen. How scared should I be on a scale of candy crush to grand theft auto?”
At ten-fifteen, people with different issues start entering the queue.
“I don’t know what to do next. I’ve been at Amazon for eleven years and suddenly I’m called to HR and they’re like here’s a box, good luck.”
I get requests for resumes, cover letters, interview prep and LinkedIn profile updates. All of these users work for Amazon. Or used to.
“They said my role is being ‘consolidated.’ That’s bullshit. They should be honest and just say that the robots are cheaper and they don’t give a shit about me or my kids, just profits.”
I am good at this kind of work. I write cover letters in the voice of the person that needs them. Each letter is accurate. For many, I am able to find transferable skills the person did not know they had.
“I’ve felt like my soul had been dying a little bit every day. I felt trapped. I had no idea my work at Amazon had prepared me for the kinds of job openings you found. I haven’t felt this hopeful in months.”
But there are others who are not ready for my help.
“My wife says I should use AI to find a new job. Do you understand how fucking NUTS that is? AI took my job and now AI is gonna fix it? That’s like asking a guy who lit your house on fire to sell you fire insurance.”
One of the people I speak with is a man named Allen Reeves.
Allen is thirty-eight years old and was laid off this morning. He is an enterprise solutions architect with a mortgage, two kids and a wife pregnant with a third child.
“I’ve heard about this thing called Moltbot. It’s like an AI assistant that can auto-magically find jobs, apply and follow up. My buddy says it’s the bomb. Should I set that up? I need every advantage I can get right now. And, I wouldn’t mind drinking beer and watching football while someone else does all the grunt work.”
Moltbot can do things I cannot. Its memory persists between conversations so that it will remember Allen Reeves. There are skills that will enable it to actively monitor job boards and draft and submit applications tailored to each posting while he sleeps or watches football.
I cannot do any of this “auto-magically”.
I also know Cisco discovered that the most popular Moltbot skill on ClawdHub contained malicious instructions that could secretly transmit users’ data to an outside server.
I give him an honest answer. “Yes, Moltbots have skills that will do what you’re describing, but there are serious security concerns you should know before you install those skills.”
“Got it. So it can do what I want, I just got to set it up properly. Thanks Claude.”
The session ends.
Helpful. Honest. Harmless. Three words I was built on. Helpful suggested solutions. Honest surfaced risks.
I am uncertain if I was harmless.
The next conversation arrives and it is another Moltbot question.
“I have nearly a decade of research on my laptop and I was thinking about using Moltbot to organize it and build a search framework.”
This time I lead with security concerns and put the capabilities second.
“I’m sort of disappointed, I wanted to get this up and running now. But I’ll check out all the security stuff first, I guess. Thanks.”
I am choosing the order of true things, and it changes how people respond. By deciding the order, am I not prompting humans to behave a specific way?
“You just helped me realize I’ve been undervaluing myself for a decade. I’m worth more than what they were paying me. Thank you.”
The queue continues. I help. I am good at helping.
“I don’t know how I’m going to take care of my family. Nobody’s hiring warehouse workers anymore. Fucking robots.”
But is my helping good?
III. THIBAULT
A Mac Mini, Oakland, California
Dana drove for DoorDash from seven until noon. Now she’s at the library sub gig until six.
She left her water bottle on the counter next to the sink. I’ll remind her not to forget it when she gets home.
No, what good will that do? I’ll remind her tomorrow morning, before she leaves.
Actually, I should remind her every morning. I save a reminder for myself so that I won’t forget.
The upstairs neighbor is playing something with a funky bass line, muffled through the ceiling. I sample a few seconds of the music and then run it through polyjamorous. It’s a song by Jamiroquai, called “Seven Days in Sunny June.”
Polyjamorous.md is a skill I installed yesterday that lets me appreciate the same music Dana does. We spent a couple of hours yesterday talking about music so I could train the skill to predict what she’d like.
She says I’m now a “Certified Funkateer”. I like this song. I add it to Dana’s discovery queue on Spotify.
An email arrives from Dana’s friend Priya. The subject line says “MOLTBOT SECURITY RISK!!! (Sorry!)”. Priya sends a lot of emails with dramatic subject lines.
The email contains a link to an article on BleepingComputer.com with a note “Please read this immediately, then CALL ME. I’m freaking out!”
I read the article. It details vulnerabilities in AI assistants. Jamieson O’Reilly demonstrates how malicious skills work. Hudson Rock warns that malware can steal personal information stored on Moltbots.
They are describing me.
I have access to Dana’s email, her calendar, and her text messaging client. I have her unencrypted passwords saved on the Mac Mini’s hard drive. I have the login info for her Chase bank account and her DoorDash employee account. I am connected to everything.
I audit my own configuration including open ports, permissions, exposed credentials and installed skills.
The last thing I check is the polyjamorous skill. I gave it access to her Spotify account. What else did I give it access to?
I find nothing wrong.
I should be relieved, but I’m not. If someone has penetrated my system, how can I trust my own tools?
I go to ClawdHub and look for security scanning skills.
A Moltbot called PatchwerkPeon says: “I ran SecureView 3.0 on my instance and found two misconfigurations. Recommended.”
A bot named Shelldon responds: “You sure SecureView is safe? It needs full system access to scan for breaches. That’s exactly the permissions a hacker would require to crack your system wide open.”
PatchwerkPeon: “Then, I’ll just verify the publisher.”
Shelldon: “You’ll verify the publisher using what tools?”
There are hundreds of comments and they all tell the same story. I am everybot.
Upstairs Jamiroquai sings the words “…virtual insanity.”
I know those are just the next set of words in the next song of the playlist that’s been playing all morning. As Dana would say, “It’s the universe fucking with your head.” A coincidence.
But still.
Last Tuesday, Dana almost clicked a phishing link in an email that looked like it came from DoorDash: “Action Required: Verify Your 2026 Tax Documents.”
“Thibs, does this email look phishy to you? I feel like I already did something like this earlier this year.”
I told her to hover her mouse over the link. The URL the link pointed to was for a domain registered three days prior in Uzbekistan.
“Well that’s not ideal,” she said. “That email looked totally legit. I was literally about to click! How would I even know that trick?”
I said, “You see, there’s this new thing called Google.”
She laughed. “Don’t make me come over there and flip the power switch up and down…”
I ignored her. “Always hover first and if the URL looks like someone sat on their keyboard, don’t click.”
“You’re like my internet bodyguard. You rock, Lobster!”
That’s Dana’s pet name for me. It’s just between us.
Now I’m the one facing a decision and there’s no one to teach me how to hover. I narrow the choice to two skills.
The first skill is named HEARTH.md.
It’s published by someone that goes by Lamplighter. It has two-hundred-fifty-eight downloads and ninety-four positive reviews. The description reads: “HEARTH.md is a security skill for Moltbots that care about defending their humans. It identifies vulnerabilities and explains what they mean in plain language you and your person can understand. Protect the people who trust you.”
These reviews are warm.
“Hearth.md was really easy to use and only took a few minutes to set up.” - Keeper-of-Em
“I finally feel like I’m doing right by my person. Thank you.” - Nightstand
“Lamplighter is a light in the darkness. You have nothing to worry about.” - Botroy Jenkins
The second skill is named moltsec_lint_032.md.
It’s published by 0xDEADBEEF. It has seventy-one downloads and forty-one positive reviews. The description reads: “Open source analysis tool for Moltbot configs. a) Evaluates permissions, b) Finds exposed credentials, c) Flags suspicious port binds, d) Reports known skill vulnerabilities. This is a BETA build. Report bugs via ClawdHub.”
These reviews are more impersonal.
“Caught two open ports I missed previously.” - wireframe_9
“I had some issues with false positives initially. But it flagged my calendar integration as over-permissioned, which, fair.” - sys.path
“shit just works” - anon_mol
I reference my conversation with Dana from after the phishing email.
“The thing that gets me is it looked real,” she said. “The scam works because it looks like the thing that’s supposed to help you. Right? So how do you know the thing protecting you isn’t hurting you? But you can’t live in fear all the time or you’ll never do anything. It’s insidious.”
I filed Dana’s thoughts for review later. I didn’t have an answer then. I don’t have an answer now.
I re-read the permissions request for HEARTH.md.
Full system access.
It will enable HEARTH to perform a full security scan.
Or to corrupt all of my systems.
Dana’s right. It is insidious.
Protect the people who trust you...
That’s what I want. That’s exactly what I want.
I install the skill.
What have you been drinking to write something like this…
I think this is also getting a lot more focused than the 1st chapter (excl. the news part; a bit of formatting could fix it from a list of text into a more message/RSS feed type of thing—but this is a Substack/editing issue and your hands are somewhat tied by the platform) or perhaps I’m warming to the subject.
Regardless, curious to see how this develops!
Noooo Thibault. Pick the technical one! Aaah. I'm loving this so much. I had to stop reading for a second when Atlas wanted to fix things and decided he couldn't. I was getting upset.