OpenClaw Users Reportedly Circumventing Anti-Bot Measures

In San Francisco, OpenClaw seems to be ubiquitous, even in places where it wasn’t intended to be. Social media posts indicate that people are leveraging the viral AI tool to scrape information from websites, despite those sites employing strict anti-bot measures.

Allegedly, one method they are using is an open-source tool named Scrapling, which is designed to circumvent anti-bot systems like Cloudflare Turnstile. Scrapling, created with Python, is compatible with various AI agents, but OpenClaw users appear to have a particular affinity for it. On Monday, viral posts began circulating on X, promoting Scrapling as a must-have for OpenClaw users. Since its launch, Scrapling has surpassed 200,000 downloads.

“No bot detection. No selector maintenance. No Cloudflare headaches,” reads one trending post this week about the open-source tool. “OpenClaw instructs Scrapling on what to extract. Scrapling manages the stealth.”

Cloudflare is not pleased. The company had already blocked previous iterations of Scrapling because users of the open-source tool kept attempting to bypass anti-scraping defenses. This week, the company is working on a patch for the latest version of Scrapling. “We make adjustments, and then they modify theirs,” says Dane Knecht, chief technology officer at Cloudflare. He indicates that the company’s extensive website data and trend-tracking capabilities give it an advantage.

“We had already noticed they were getting better at circumventing our defenses,” says Knecht. “Our security operations team was already focused on developing a new set of countermeasures.”

Large language models were trained on vast swathes of the internet, a process that required significant scraping. In some ways, Scrapling users are emulating the original model creators but on a more personal level.

In recent years, website owners have implemented additional anti-bot measures to either block tools like Scrapling or monetize the bots attempting to access their sites. Consequently, Cloudflare has been working hard to fend off increasingly sophisticated bots trying to override these protections.

Cloudflare offers its clients extra tools to block AI crawlers unless the bots pay for access. Over the past year, the company claims to have thwarted 416 billion unauthorized scraping attempts.

“I Didn’t Know What I was Getting Into”

As Scrapling gained popularity recently, crypto enthusiasts seized the moment by launching a $Scrapling memecoin. Karim Shoair, claiming to be the sole developer of Scrapling, shared information about the memecoin on X (those posts have since been removed). After a brief surge in price lasting about five hours, $Scrapling rapidly plummeted as users liquidated their investments. “A bunch of scammers,” reads one comment on the Pump.Fun site hosting the coin.

“I didn’t know what I was getting into when that coin was created and I endorsed it,” Shoair said in a direct message to WIRED. “But once I realized, I didn’t want to be associated with it, and the money I withdrew will go to charity; I won’t benefit from it in any way. Or maybe just let it go to waste.”

In the aftermath of this incident, the unofficial GitHub Projects Community account, which boasts over 300,000 followers on X, deleted its recent posts promoting Scrapling’s open-source software and seemed to distance itself from the project. “We do not support, promote, or engage in crypto assets, token offerings, trading activity, or crypto-based fundraising,” it stated in a post late Monday night.

Setting aside the crypto ventures, most software leaders consider agents and autonomous AI tools to be the future of the web. Even Knecht from Cloudflare, whose role includes blocking bots from non-consensual scraping, envisions a world where both humans and bots can benefit from online data while respecting website owners’ wishes. “I see a path toward an internet that is welcoming to both agents and humans,” he states.

This is an edition of Will Knight’s AI Lab newsletter. Read previous newsletters here.