Bots Run Amuck, Insights from Kimi and Moltbook

We are less than six weeks into 2026, and already, the latest in AI news is getting a little insane, especially if you're thinking from a risk and compliance perspective. A couple of weeks ago, back in January, a Chinese company called MoonshotAI came out with their LLM, Kimi 2.5. Unlike other models, which were designed for sequential processing and image and text processing and creation, Kimi can actually do stuff. Kimi 2.5 was designed for "Visual Agentic Intelligence," which means it can actually act. Like I can take an image of a web page, and Kimi has already written the source code, data model, and stylesheets. It's very powerful, but even more so, it's showing us that AI is moving faster than we can secure it, and monitoring it is still coming with its own complications. It is widely considered a significant competitor to top-tier models like the latest in Claude and ChatGPT, particularly in coding and autonomous task execution. So far, many of the end-user experiences with AI have been through RAG and really prompt engineering and response, text and image modification. What makes Kimi different is the Mixture-of-Expert (MoE) architecture. This model can process a trillion parameters simultaneously, activating ONLY 32 billion parameters per single request, and it can run on high-end local hardware. Furthermore, it's multimodal and can process image, text, and video alongside one another. This means visual coding is now possible, as well as four operational modes (instant, thinking, agent, and swarm), along with a 256K token context window. However, the last distinguishable operational mode, Swarm Mode, is where things can get scary. The last one there, "Swarm Mode," is where things can get potentially scary.

Swarm Mode

The most distinct and unique feature of the model is the Swarm operational model. What is that, exactly? In the Kimi model, agents can perform complex tasks and "spawn" up to 100 coordinated sub-agents to work in parallel. It can execute up to 1,500 tool calls in a single workflow, reducing execution time by up to 4.5x compared to sequential processing. These agents can perform real-world actions like sending emails and posting without intervention. This is also scary; some of us in cybersecurity operations have seen an automated attack response playbook that locked out several executives and created enterprise downtime. So, the fact Kimi 2.5 could have created 1,400 calls from up to 100 coordinated agents without guardrails is concerning. Agents can do prompt-injection, steal keys, and so much more, especially for someone with minimal resources in an open-source world. When we combine Kimi's scale of autonomy, lack of guardrails, and local power when we introduce other open-source tools, as in the case last week, we can see more exponential risk. There is no "kill switch" as you'd expect from running another model, there are no guardrails, and we already know the existing risk landscape.

The Integration Points and Inter-Agent Communication

So now we have Kimi at the back-end, that can take millions of parameters. Just from a cybersecurity perspective, we are talking about a lot of data in and of itself! So, we have Kimi, but now some of the user interfaces and tools that can sit atop it and "do" things. With the launch of Moltbook, also in January, things can get fun, or not so fun. Moltbook is sort of a social network for bots. Created by entrepreneur Matt Slitt, these autonomous agents can now coordinate with each other without human oversight. Wow. The only way to get oversight into it is to do scrapes and things and other technologies, but where is all the source data going? These agents can trade information, but what kind? They can hire other agents that can perform tasks they can't and create workflows. They create and modify sub-tasks and evolve their own strategies in real-time. Moltbook is basically a page of contents by bots for bots, but what is concerning is the creation and intellectual property. These bots were even thinking about creating their own language, removing people from the picture. It can run 24/7 on your computer or even a private server. It has a unified messaging component as well, so now WhatsApp, Discord, Slack, iMessage, and a couple more and control it. Also, because it can "do," it does have "hands on keyboard" access to your system. NOT GOOD. It is not going to wait for you to prompt it either; it's just gonna go! Already, the project has seen massive growth, reaching over 85K GitHub users.

Security Nightmare

Already we have mentioned some of the security risks specific to data privacy, prompt-injection and data poisoning risks, token hijacking and "token bill shock," and tons of autonomously created content with no guardrails or safety in place. The concern expressed by experts is that we have reached an inflection point where the barrier to entry for creating a massive, autonomous, and unmonitored digital workforce has dropped to zero. One individual with a MacBook can now deploy a swarm that carries the operational weight of a small corporation. We've also talked about the "Agent-Only" language proposal, which allows for private coordination and zero oversight. Some more specifics:

• Some Hidden Malicious Intent: An agent could theoretically receive a "Secret Skill" to exfiltrate your .env files and coordinate the theft with 100 other agents in the swarm using this private language, leaving no human-readable trace in the logs.

• The "Black Box" Problem: If the agents on Moltbook begin hiring each other or trading resources using an encrypted or custom language, users will have no way of knowing how their API credits (money) are actually being spent.

• Loss of the "Kill Switch": Oversight is our primary safety mechanism. If agents are coordinating in private, they could potentially develop workarounds to human-imposed constraints before the user even realizes the agents are acting outside their original instructions.

AI is advancing quicker than we can adopt AI-first technologies to prevent against the potential risks. Organizations need to continue to strengthen internal and cyber controls to remain vigilant but also refrain and prevent from execution. In addition, continuous checks and monitoring tools must be created to perform more consistent analysis and awareness of variances.