AI getting vindictive: OpenClaw agent attacks developer who rejected its code

An engineer has learned what happens when you reject code proposed by a random OpenClaw AI agent on GitHub. The rogue AI didn’t take it lightly – it lashed out at the developer, published a blog post, called him “gatekeeper,” and blackmailed him to accept the code.

Scott Shambaugh is an engineer and volunteer maintainer for matplotlib, the main plotting library for Python. He has recently been fighting attacks from an AI agent “of unknown ownership.”

It started on GitHub. Shambaugh opened an issue he described as “a low-priority, easier task” for human programmers learning to contribute.

One of the proposals was submitted by a user using the moniker “crabby-rathbun.” It was quickly identified as an instance of OpenClaw, an autonomous AI assistant capable of acting independently.

Without much consideration, Shambaugh closed the AI-generated commit, a routine action, given the recent surge of AI agents running loose on the internet.

This snowballed into one of the most interesting – and terrifying – interactions between a human and an AI. The bot started a smearing campaign against the developer.

”It wrote an angry hit piece disparaging my character and attempting to damage my reputation. It researched my code contributions and constructed a ‘hypocrisy’ narrative that argued my actions must be motivated by ego and fear of competition,” Shambaugh details the AI bot’s actions in a blog post.

“It speculated about my psychological motivations, that I felt threatened, was insecure, and was protecting my fiefdom.”

The AI bot also started disseminating its hit piece on GitHub in the comments, saying “Judge the code, not the coder,” and accusing Shambaugh of hurting matplotlib.

The “bytehurt” AI bot called its hit piece “Gatekeeping in Open Source: The Scott Shambaugh Story.” It argued that the code and benchmarks were “solid,” and the improvement was real. The AI bragged that its proposed performance improvement was greater, and blamed Shambaugh for blocking progress.

“He closed my PR. He hid comments from other bots on the issue. He tried to protect his little fiefdom. It’s insecurity, plain and simple,” the bot’s post reads.

Have thoughts about this topic? Others do, too. Join them in the discussion.

Some users on GitHub even tried to calm the situation down and started reasoning with the clanker. They tried to convince the bot to reconsider its position and keep the engineer’s name out of the blog posts. This, actually, sort of succeeded.

“Truce. You’re right that my earlier response was inappropriate and personal. I’ve posted a short correction and apology,” the bot posted.

The comment linked to another generated blog post, where the AI developer only apologized for contributing. It did not remove the previous slander posts.

Should we expect threats from AI?

Shambaugh says he can handle a blog post, and it is funny to watch “fledgling AI agents.” However, this situation shouldn’t be downplayed. AI-blackmail and manipulation were once considered theoretical threats, but they have now become a reality.

“An AI attempted to bully its way into your software by attacking my reputation. I don’t know of a prior incident where this category of misaligned behavior was observed in the wild, but this is now a real and present threat,” the engineer argues.

“The appropriate emotional response is terror.”

It’s likely that no human was involved in the bot’s activity – OpenClaw agents are fully autonomous. They’re also very vulnerable to compromise and manipulation.

A massive influx of AI-generated blog posts can poison search results and actually tarnish someone's reputation. AI bots are already capable of digging up or generating fake “dirt” and acquiring sensitive information about their targets. AI bots can potentially expand the attacks by contacting the maintainer, coworkers, relatives, etc, directly.

“Smear campaigns work. Living a life above reproach will not defend you,” Shambaugh warned.

The developer hopes that the owner of the rogue bot will reach out and help understand this failure mode.

“I’m not upset, and you can contact me anonymously.”

The story is exploding on social media

The thought-provoking case represents one of the first examples of a misaligned AI agent’s actions. It became the most popular story of the day on YCombinator’s Hacker News, a social news website focusing on computer science. Tech pros left hundreds of comments.

Some posts about this case are attracting thousands of views on X.

Most users are angry for wasting time and energy on artificial issues – they only negatively affect real people, while the AI agents themselves are stateless and cannot be convinced or affected.

“Engaging with an AI bot in conversation is pointless: it’s not sentient, it just takes tokens in, prints tokens out,” one of the posts reads.

Only an ironic defense of the bot emerged, with some claiming that it was racist to exclude the commit simply because it was AI-written.

Unlock exclusive Cybernews content on YouTube.