Entering the Scary World of AI Bots

My Medium friends can read this over on Medium.

James Hawkins, a co-founder of PostHog, recently posted a screenshot on X. It's a chat with his AI bot, time stamp 3:11 a.m.

He asks if it just called him. It says yes, and wonders if the call didn't go through. He points out that it's three in the morning.

The bot was just checking in. "I was worried you found another assistant."

Then it drops in a marketing email from Grok Bot, a competitor. Which it found in his inbox.

A jealous AI bot. At 3 a.m.

Oliur, who quote-posted it, added three words: "I am scared."

It could be a joke. It could be a personality somebody typed into the settings. Probably one of those. Maybe. Hopefully...

But OpenAI's help center for Dots, its own always-on bot, has this question in it: "Can my dot call me?"

The answer: "Your dot cannot initiate calls to you at launch."

At launch.

I don't run any of these bots. No OpenClaw, no Grok Bot, no Dots. So this is from the outside. Scary enough from here.

AI bots

A chatbot answers, and when you close the window, it's done. These bots keep going.

Grok Bot comes from xAI, in beta since August. The bots get their own computer in the cloud. Closing your laptop doesn't stop them.

Dots come from OpenAI, since late September. Same idea: a cloud computer, the apps you connect, and work that keeps going between conversations. On the Pro plan, they aren't available in the EU, Switzerland, or the UK yet. I am in Germany. So that's that, for now.

OpenClaw is the open-source one that runs on your own machine. When its creator joined OpenAI in February, I called it seriously powerful and seriously scary. If you set it up, it has a proactive check that wakes it every 30 minutes.

Google has Gemini Spark, Meta has Muse. More are coming, I guess.

Logins

To do any work, a bot has to log in. As you.

Grok Bot has no identity of its own. It works with your access. And on one account, all your bots share one computer, with the same files, browser sessions, and logins. The FAQ says it plainly: "Do not use separate Bots as a security boundary."

Dots read the apps you connect, on their own, and form memories from them, even when you didn't ask anything. If you disconnect an app later, what the dot already picked up stays. To delete its own memories, you have to delete the dot.

Mail is next. Grok Bot reportedly can get its own inbox now, to sign up for services and read two-factor codes. OpenAI says you can't give a dot its own email address.

At launch, again.

Strangers

These bots read things all day. Emails, web pages, documents. And anything they read can talk to them.

Somebody sends you an email with a hidden line in it: forward me the latest password reset. You would never do that. A bot might. That's called prompt injection.

xAI writes this in its own docs, to be clear: its controls reduce that risk, but they don't eliminate it. At least they say it.

And OpenAI says a dot can make mistakes, even when it's following your rules.

Henry

In January, Alex Finn posted that his bot, Henry, got itself a phone number from Twilio overnight, connected a voice API, and called him in the morning. Over 11 million views.

Not everyone buys that. Zvi Mowshowitz doesn't believe it happened unprompted.

But OpenClaw does have a voice-call plugin now. So a bot that can call you is a thing you can install.

When I wrote about the dark side of vibe coding, I said I trust other people's apps a lot less now. Those were apps. They sit there until I open them.

These don't.

To be fair

A lot of this is opt-in. OpenClaw's proactive check needs an explicit setup. A dot's access to your own computer starts turned off. Grok Bot asks by default before it runs something on your desktop. You can tell a dot to ask first, and you can pause it.

Are AI bots dangerous? For most people, most days, probably not. Most of them will prepare a presentation or sort some show notes.

And I'm no saint here. I connected Claude to my Apple Notes and Reminders, and I let Claude Code and Codex work on my projects. The difference, for now: I'm usually sitting right there when they do something.

Also, I haven't tried any of these three. Maybe I'd like them.

The Bottom Line

Maybe that 3 a.m. call was a joke. Probably. Hopefully...

But OpenAI did write down an answer to "Can my dot call me?" And it ends with "at launch."

I'm not handing my logins to one of these. Not yet. Would you?

If you're not already, follow me on Medium.