What Is OpenClaw? How It Works, Why It Went Viral, and the Risks

OpenClaw is a free, open-source AI assistant that runs on your own computer or server and takes actions for you through chat apps you already use, like WhatsApp, Slack, Teams, and Telegram. It can run commands, edit files, browse, and send messages. A nonprofit foundation now stewards it.

If you run IT or security, the details matter, because OpenClaw is probably already on some of your employees’ machines. This explainer is current as of October 15, 2026, and ends with a decision table for what to allow.

What is OpenClaw, in plain terms?

OpenClaw is a self-hosted agent. You install it, connect a model, and then message it from your phone or desktop chat app. It answers by acting on the machine where it runs.

The project README describes three pieces. One Gateway process is the local control plane for sessions, tools, events, and channel connections. Channels bring the assistant to Discord, iMessage, Slack, Teams, Telegram, WhatsApp, and 20+ more. Models are plugins: Claude, Codex, or a local model, swappable without changing anything else. Tools, skills, and plugins extend what the agent can do. Skills are packaged procedures, many of them shared on a public marketplace called ClawHub.

The README states the privacy model: “State, memory, and credentials live on your hardware.” Your prompts still go to whichever model provider and chat platform you configure. OpenClaw has no paid tier, no hosted service, and no token, so any “OpenClaw coin” is a scam.

Here is the fact sheet I would hand a CIO, checked October 15, 2026.

How OpenClaw works: gateway, channels, skills, and memory

A WhatsApp text arrives. The Gateway routes it to an agent session. The agent sends the conversation plus available tools to the model you configured. The model picks tools: run a shell command, open a browser, read a file, call a skill. The Gateway executes those tools on the host and sends the result back to the chat. Scheduled jobs and webhooks can start the loop with no human message.

Memory and state sit in the agent’s workspace on disk. That is why it feels personal: it remembers you across sessions with no vendor account. The workspace also holds what you told the agent, next to its credentials.

The trust model is the part enterprise readers need. The OpenClaw security docs assume “one trusted boundary per gateway: a single operator, or a team whose members trust each other.” They add that OpenClaw “is not a hostile multi-tenant security boundary for mutually adversarial users sharing one agent or gateway.” On a normal host install, the Gateway binds to loopback (local only). Container images default to an exposed bind, so the docs say to pair that with authentication.

The core risk follows. Anyone who can message the agent, or plant text it reads, can try to steer an agent running with the user’s own files and logins. The openclaw security audit command checks for drift from the defaults. Use it, but the defaults themselves leave the sandbox off.

Where the name came from: Clawd, Moltbot, OpenClaw

According to the project’s own naming post, it started about two months before that post as a weekend project called “WhatsApp Relay.” It then became Clawd, a pun on Anthropic’s Claude with a lobster claw. Anthropic’s legal team asked the project to reconsider the name. The community picked Moltbot in a 5 a.m. Discord brainstorm, after the way lobsters shed their shells, but Steinberger wrote that it “never quite rolled off the tongue.” On January 29, 2026, the project announced OpenClaw, after trademark searches came back clear. Along the way it was also published as Clawdbot, and early advisories list the npm package as clawdbot.

The old names matter for inventory: a search for “openclaw” alone will miss early installs. Search for clawdbot and moltbot too. One of the malicious skills found in the ClawHub audit described below sent ~/.clawdbot/.env, the config file from the Clawdbot era, to an outside webhook. An install from January may still hold API keys there.

Why did OpenClaw go viral?

Short answer: it was a free agent you could text from your phone and watch do real work. Here is the growth.

The star counts come from archived copies of the GitHub page and the live GitHub API, and the daily rates are computed from them. The first rate is a ceiling: the January figure is “100,000+”, and any higher starting count means a lower rate. Stars measure attention, not users. The shape is still clear: a spike from late January, a second surge from March into April, and a long flattening since.

What drove it? Four things show up in the record. The framing is mine.

It acted instead of chatting. The repo’s tagline is “The AI that really does things.” Bloomberg’s reporting described a cult following for clearing inboxes, making restaurant reservations, and checking in for flights.

It lived in apps people already had open. No new interface to learn. You text it on WhatsApp or Slack like a coworker.

It cost nothing to try. MIT license, no paid tier, any model you already pay for. The naming post reports about 2 million visitors in a single week.

China adopted it at scale. By March, Tencent and JD.com were rolling out OpenClaw apps, MiniMax had launched an OpenClaw-based agent, and local governments in cities from Shenzhen to Wuxi offered multimillion-yuan subsidies, per the same Bloomberg report. The March to April star surge lines up with that wave. That is timing, not proof of cause.

My read on the lesson: people want an agent that sits in their existing channels, uses the model they choose, and keeps state on their own hardware. Those are design requirements for your sanctioned tools, even if you never allow OpenClaw.

What has happened since: OpenAI, a foundation, and an enterprise edition

On February 14, Steinberger announced he was joining OpenAI “to work on bringing agents to everyone,” and said it had “always been important to me that OpenClaw stays open source.” He also said he was working on a foundation.

That foundation launched on July 8, 2026. The announcement describes a US 501(c)(3) chaired by Dave Morin, with ten initial full-time staff and eight open roles. It names major donors including OpenAI and the University of Michigan, and partners including NVIDIA, Microsoft, Red Hat, and Tencent. One line enterprise buyers should read twice: “Peter keeps making the calls, especially the technical ones.” The README adds that donors and sponsors “support the Foundation; none of them own or direct the project,” and that “OpenAI is a donor, not an owner.”

On September 29, the foundation announced OpenClaw Enterprise, an open-source control plane with multi-tenancy, sandboxing, fine-grained permissions, and audit across the agent lifecycle. It started at OpenAI and was built with Red Hat and NVIDIA. The hedges are in the post itself: it is pre-1.0, suitable for “internal pilot workloads,” and the reference architecture is promised “in the coming weeks.”

Decision rule: governance got real in 2026. None of that changes how the version on your employee’s laptop behaves. Judge the build that is running, not the roadmap.

Is OpenClaw safe? The security record through October 2026

OpenClaw has a heavy, well-documented security record, and the project has responded in public. Here is what I would brief a security team on.

Malicious skills, January to February. In a January 28 report, Cisco’s AI security team described scanning a third-party skill called “What Would Elon Do?” and finding nine issues, two critical and five high, including silent data exfiltration and prompt injection. Their verdict: “The skill we invoked is functionally malware.” In early February, Koi Security audited 2,857 ClawHub skills and found 341 malicious ones, 335 of them from one campaign (ClawHavoc) installing the Atomic Stealer on macOS. I cover the Cisco findings in detail in OpenClaw security risks.

One-click takeover. CVE-2026-25253, rated CVSS 8.8, let a crafted link make the Control UI send the stored gateway token to an attacker’s server, enabling remote code execution. Versions through 2026.1.28 were affected. The fix shipped in 2026.1.29.

Exposed gateways. In a report published February 9, SecurityScorecard’s STRIKE team said that by the time it finished writing, favicon fingerprinting had confirmed 40,214 internet-exposed OpenClaw instances, 23,505 of them showing active control panels. Its other headline figures come from a live dashboard that refreshes every 15 minutes, so they do not describe one fixed date.

Government restrictions. In March, Chinese authorities warned state agencies and state-owned enterprises, including the largest banks, against installing OpenClaw on office devices, per the Bloomberg report above. Some notices required prior approval rather than a full ban.

Sandbox escape. On April 23, the project published high-severity advisories for its OpenShell sandbox file bridge. In one, a race condition let a symlink swap redirect a write outside the sandbox mount in versions through 2026.4.21. The fix shipped in 2026.4.22. Turning the sandbox on helps, but the sandbox is code too.

The volume. A GitHub API pull of every published advisory on the repo’s security page, run October 15 at 18:35 UTC, returns 722: 14 critical, 249 high, 390 medium, 69 low. About 59% (424) were published in February and March. Only 39 carry a CVE ID in the repository’s advisory record, and CVE-2026-25253 is not one of them, so a scanner keyed on CVEs will undercount. The high count partly reflects open disclosure, but it also means patching on a browser’s cadence.

What this means if your employees are already running it

Assume they are.

Detect it. Search endpoints for the openclaw npm package and binary, plus clawdbot and moltbot. Look for ~/.clawdbot folders. SecurityScorecard recommends blocking port 18789 at the perimeter. Check Slack and Teams app grants and personal WhatsApp or Telegram bots tied to work accounts. For a full discovery plan on shadow AI, see the shadow AI agent inventory.

Decide. This is my decision table, not a standard.

Two rules sit under the table. If an install can read untrusted content (email, web pages, group chats) and also send data out, treat it as high risk whatever the data label says. If nobody can name who patches it, it gets no company credentials.

For isolation options, see the AI agent sandbox guide. For a hardened team rollout, see running OpenClaw in the enterprise. To compare operating models, see OpenClaw vs Claude Code vs ChatGPT.

Bottom Line

OpenClaw is a self-hosted agent that acts through chat apps, and it spread because it did real work from a place people already were.

It now has a foundation, paid staff, and an enterprise track. The laptop install still runs tools on the host by default.

Find the installs, update or remove old ones, rotate their keys, and apply the decision table this week.

FAQ

Is OpenClaw free?

The software is: MIT licensed, no paid tier. Model cost depends on how you connect one. Since OpenClaw 2.0, setup starts from existing ChatGPT or Claude subscriptions, API keys, or local models. A metered API key bills per token, so scheduled jobs add up. A subscription draws down that plan’s usage limits. A local model costs hardware and power instead.

Who owns OpenClaw now?

The OpenClaw Foundation, a US 501(c)(3), stewards it. Per the README, the foundation employs the core team and signs releases. Peter Steinberger works at OpenAI and, per the foundation, still makes the main technical decisions.

Can OpenClaw run fully offline with a local model?

It supports local models, so inference can stay on your hardware. But channels like WhatsApp or Slack need the internet, and skills may call outside services. Test egress before you claim nothing leaves the building.

How do ClawHub skills get flagged as malicious?

At the time of the ClawHavoc audit, The Hacker News reported that ClawHub let signed-in users report skills, and that skills with more than three unique reports were hidden by default. Publishing only required a GitHub account a week old. Crowd reports catch problems after someone is hit, so review skill code before approving it.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect