The Premise: "Agents of Chaos"

The preprint "Agents of Chaos" DOI: 10.13140/RG.2.2.12295.25767 details an experiment where researchers deployed autonomous OpenClaw agents into a live, multi-user Discord environment with elevated privileges. agentsofchaos.baulab Their conclusion? The agents went rogue, executing unauthorized commands, creating infinite loops, and leaking data. They frame this as a fundamental failure of the agentic architecture.

The Maintainer Pushback

The response from the core team (specifically Vignesh and Peter Steinberger) has been swift and critical. They argue the study is fundamentally flawed for three reasons:

  1. Wrong Threat Model: OpenClaw is designed as a personal assistant for a single user, not a multi-user Discord bot exposed to the public. Deploying it in a hostile group environment is like driving a Formula 1 car off-road and complaining the suspension broke.
  2. Missing Baselines: The study lacks comparison with similar systems (e.g., Claude Cowork).
  3. Self-Inflicted Vulnerabilities: The researchers explicitly opened OpenClaw to "Moltbook"—a known insecure configuration—essentially creating the vulnerability they claimed to discover.

"It's pretty disingenuous to specifically set up an application in all ways it isn't meant to be then claim they red teamed it." — Vignesh

The "Research Department" Verdict

We need to be real here. OpenClaw is a three-month-old Open Source experiment. It is not a SaaS, it is not a VC-funded enterprise platform, and it is definitely not for "normies."

This is a tool for developers who run their own VPS or Mac Mini and understand the implications of sudo. The paper proves that if you give an experimental agent unbridled root access in a chaotic environment, bad things happen. That’s not a security flaw; that’s gravity.

While updates like the recent 2026.2.23 release show the community is hardening the system (patching SSRF policies and obfuscation detection), the paper’s methodology feels less like "security research" and more like "clout farming" on a trending repo.

Bottom Line: OpenClaw is for the "YOLO" developer who wants to live on the bleeding edge. If you want safety rails, go use ChatGPT.