Table of Contents
- What OpenClaw Actually Is
- The Name Confusion, Cleared Up
- Why It Exploded
- How It Works Under the Hood
- What People Actually Use It For
- The Security Situation, Honestly
- Running It Without Getting Burned
- A Realistic First Setup
- What It Is Not Good At
- OpenClaw vs n8n vs Managed Agents
- Should You Run It?
- Frequently Asked Questions
- Final Thoughts
Most AI tools wait for you to open them. You type, they answer, the conversation ends, and nothing persists except a chat log you will never read again.
OpenClaw does not work like that. It runs continuously on hardware you control, reachable through the messaging apps you already use, with memory that survives between conversations and the ability to actually do things to files, APIs and your operating system.
That difference explains both why it became one of the fastest-growing open-source projects in history and why it has accumulated an alarming security record in the same period. Both halves of that story matter.
What OpenClaw Actually Is
Strip the hype away and OpenClaw is a persistent daemon that wraps an agent loop.
A normal chatbot is request and response. You ask, it answers, the process ends. OpenClaw keeps that loop running as a background service, wires it to a dozen or more messaging platforms, adds a scheduler that can wake it up on a timer, and gives it memory that persists across sessions and across channels.
The practical consequence is that OpenClaw is reachable rather than launched. You message it on Telegram from your phone, it remembers the conversation you had in Slack yesterday, and it can act on something at three in the morning without you being present.
It is also model-agnostic. The framework connects to Anthropic’s Claude models, OpenAI’s GPT family, Google Gemini, xAI Grok, Mistral and DeepSeek. You are choosing an execution environment, not a model, which is a meaningful distinction when models change every few months.
The Name Confusion, Cleared Up
You will see three names in older discussions, which causes genuine confusion when searching for help.
The project was published in November 2025 by Austrian developer Peter Steinberger under the name Clawdbot. It briefly circulated as Moltbot during a transitional period, then settled on OpenClaw in January 2026.
Documentation, blog posts and Stack Overflow answers written before that rename still use the old names. They usually still apply, but check the version they reference – the project moved extremely fast during that window and a tutorial from December 2025 may describe an architecture that no longer exists.
Why It Exploded
OpenClaw passed roughly 250,000 GitHub stars in about sixty days, which puts it among the fastest-growing open-source projects ever recorded. Three things drove that.
It closed the gap between talking and doing. The dominant complaint about AI assistants through 2025 was that they produced text and nothing else. OpenClaw interacts with files, calls APIs and runs operating-system commands. For a lot of people it was the first time an assistant actually completed a task rather than describing how to complete one.
It met people where they already were. Rather than another web app to remember, OpenClaw connects to WhatsApp, Telegram, Slack, Discord, Signal, iMessage and web chat. An assistant you can message from the app already open on your phone gets used. One behind a browser tab does not.
It was genuinely yours. Self-hosted, open source, model-agnostic. No subscription, no usage caps, no vendor deciding what your assistant is permitted to do.
That combination is rare, and it explains the adoption curve better than any individual feature does.
How It Works Under the Hood
Four components, and understanding them is what makes the security discussion later make sense.
The daemon. A long-running process holding the agent loop. It does not spin up per request; it is always there, which is what enables scheduled and proactive behaviour.
The channel layer. Adapters for each messaging platform, normalising them into one conversation interface. Sessions are managed across channels, so context follows you between Slack and Signal.
Memory. Persistent storage of conversation history and learned context. This is what makes OpenClaw feel different in daily use – it remembers your projects, preferences and ongoing work rather than starting cold.
Skills and tools. Increasingly standardised through MCP. The capabilities the agent can invoke – file operations, HTTP requests, shell commands, and community-contributed skills installed from a marketplace. This is the most powerful part of OpenClaw and, as we will see, by some distance the most dangerous.
There is also a heartbeat scheduler that lets the agent act on a timer rather than only in response to a message.
What People Actually Use It For
Filtering out the demos, the durable use cases cluster into four groups.
Personal operations. Inbox triage, calendar wrangling, reminders that arrive with context rather than just a title, following up on things you said you would do.
Development assistance. Running tests, reading logs, checking build status, doing the mechanical parts of a workflow while you think about the rest.
Monitoring and alerting. The heartbeat scheduler makes OpenClaw a natural fit for watching something and telling you only when it changes in a way that matters.
Research and drafting. Long-running work you check in on rather than supervise continuously – the persistent memory means you can return to it days later without re-explaining.
Notice that the strongest uses are personal rather than organisational. OpenClaw is at its best as an individual’s assistant on their own hardware. Team deployments are where the risks compound fastest.
The Security Situation, Honestly
This is the part most coverage of OpenClaw skips, and it is the part you most need before deciding anything.
You can look any of these up yourself in the National Vulnerability Database. Across OpenClaw and its predecessors, roughly 138 CVEs were tracked between February and April 2026, including 7 rated Critical and 49 rated High. That is an extraordinary volume for a project of any age, and it reflects both the pace of development and the inherent difficulty of what the software does.
Two specific issues are worth knowing about because they illustrate the shape of the problem.
CVE-2026-25253 was a remote code execution flaw rated 8.8, arising from the WebSocket gateway listening on a default port with insufficient origin validation. In effect, visiting a malicious webpage while OpenClaw was running could allow commands to reach the agent.
CVE-2026-32922, rated 9.9, involved privilege escalation through token rotation – the most severe issue reported against the project.
Then there is the supply chain. The community skills marketplace was found to contain roughly 824 malicious skills – approximately a fifth of the marketplace at the time of discovery. Installing a skill means granting code the same reach the agent has, which is considerable.
Finally, exposure. In February 2026 researchers observed 40,214 internet-exposed OpenClaw instances, with about 35 percent flagged as vulnerable. That is not a flaw in the software so much as a reflection of how many people deployed it without securing it.
None of this means OpenClaw is bad software. It means it is a powerful agent with broad system access, developed rapidly, deployed enthusiastically by people who did not always change the defaults. That combination produces exactly this record.
Running It Without Getting Burned
If you do run OpenClaw, these are not optional refinements. They are the baseline.
Never expose it to the internet directly. The single largest category of compromise. Keep it on your local network or behind a VPN. If you need remote access, reach your network first, not the agent.
Update immediately and often. Given the CVE cadence, running a version from two months ago is a meaningful risk. Subscribe to the project’s security advisories rather than checking occasionally.
Treat every skill as untrusted code. Read what a skill does before installing it. Prefer skills from the core project or authors you can identify. A fifth of a marketplace being malicious is not a statistic you can average away.
Run it in a container with minimal privileges. Not on your main user account with full filesystem access. Restrict what it can reach to what it genuinely needs.
Scope every credential narrowly. Read-only where possible, per-service, revocable. Assume that any credential the agent holds may eventually be exposed.
Remember it reads untrusted input. Prompt injection sits at the top of the OWASP Top 10 for LLM applications for good reason. An agent connected to your messaging apps is processing text written by other people. Prompt injection through a message or a fetched webpage is a real attack path, which is why dangerous tools and public input should not share an agent.
Keep irreversible actions behind approval. Sending money, deleting data, publishing anything. The convenience of full autonomy is not worth the tail risk.
A Realistic First Setup
If you have decided to try it, the sequence matters more than the speed.
Start on a machine you can wipe. A spare laptop, a virtual machine, a small home server. Not your primary work computer with your SSH keys and client files on it. This single decision removes most of the downside of getting something wrong.
Connect one channel, not seven. Pick the messaging platform you actually live in and wire only that. Every additional channel is another surface, and the novelty of reaching your agent from six apps wears off within a week.
Give it one model and no skills. Run the core agent with nothing installed for the first few days. You need a baseline understanding of what OpenClaw does out of the box before you can judge whether a skill improved anything.
Read the logs. Watch what it actually does when you ask for something – which tools it invokes, what it reads, where it goes. This is the fastest way to develop an accurate mental model, and it is also how you notice behaviour you did not intend.
Then add one capability at a time. A week apart. If something breaks or behaves oddly, you know what caused it.
People who set OpenClaw up this way tend to still be running it three months later. People who install twenty skills on day one tend to either abandon it or, occasionally, end up in the exposure statistics.
What It Is Not Good At
Worth being direct, because the enthusiasm around the project tends to skip this.
Predictability. An agent deciding its own approach will sometimes decide differently for the same request. That is fine for personal assistance and unacceptable for a business process that must behave identically every time.
Auditability. Reconstructing exactly why it did something three weeks ago is harder than with a deterministic workflow. If you need a clean audit trail, this is the wrong architecture.
Multi-user contexts. The design centres on one person’s assistant with one person’s memory and credentials. Teams sharing an instance run into permission and context problems quickly.
Being left alone. Between the release cadence and the security advisories, this is software that expects attention. If you want to configure something once and forget it, you will end up running a vulnerable version.
Handling sensitive data. Not because it cannot technically, but because the combination of broad system access, community skills and a young security record is a poor match for regulated or confidential material.
OpenClaw vs n8n vs Managed Agents
| OpenClaw | n8n | Managed agent SaaS | |
|---|---|---|---|
| Shape | Always-on personal assistant | Workflow and agent builder | Hosted product |
| Interface | Your messaging apps | Visual canvas | Vendor app |
| Persistent memory | Core feature | Configurable | Varies |
| System access | Broad by default | What you wire up | Sandboxed |
| Security burden | High, on you | Moderate, on you | On the vendor |
| Best for | Individuals, personal automation | Business processes, teams | Non-technical users |
These are less competitors than different answers. If you want an assistant that lives in your pocket and remembers your life, OpenClaw. If you want reliable business processes with audit trails and approval steps, an orchestration platform is the better fit – our guide to n8n AI agents covers that approach, and self-hosting it gives you similar control with a considerably smaller attack surface.
Plenty of people run both, which is a reasonable answer.
Should You Run It?
Reasonable candidates: technically confident individuals, people who genuinely want an always-available assistant on their own hardware, anyone who would otherwise not use an AI assistant because opening an app is too much friction, and people comfortable maintaining self-hosted software.
Poor candidates: businesses handling customer or regulated data, anyone who will not update it regularly, people who would install skills without reading them, and anyone who wants this to be low-maintenance. OpenClaw is not low-maintenance.
If you are in the second group but the idea appeals, the honest advice is to wait. The project is maturing quickly and the security posture is improving. A version six months from now, run by someone who has read the advisories, is a considerably safer proposition than a rushed deployment today.
Frequently Asked Questions
Is OpenClaw free?
The framework is open source and free to self-host. You pay for whichever model provider you connect, and for whatever hardware you run it on.
What was it called before?
Clawdbot originally, briefly Moltbot, then OpenClaw from January 2026. Older tutorials use the earlier names.
Does it need to run on a server?
No. Many people run OpenClaw on a home machine or a small always-on device. A server is only necessary if you want it available when your main computer is off.
Can it use local models?
Yes. Being model-agnostic, it connects to local model servers such as Ollama as well as hosted providers, which keeps everything on your own hardware.
Is it safe to use?
It can be, with deliberate configuration – not exposed to the internet, updated promptly, skills vetted, credentials scoped, containerised. On defaults, deployed carelessly, the track record says otherwise.
How is this different from a chatbot?
Persistence and capability. It runs continuously, remembers across sessions, reaches you through messaging apps, and can act on files, APIs and system commands rather than only producing text.
Where do I start?
The project’s own documentation and repository, and read the security advisories before the quickstart rather than after. If agent concepts are new, our guide to building AI agents covers the fundamentals in a lower-risk environment.
Final Thoughts
OpenClaw is the most interesting thing to happen to personal AI in a while, and the honest assessment has to hold two ideas at once.
It genuinely delivered something people wanted – an assistant that persists, remembers and acts, on hardware they control, without a subscription. The adoption numbers were not manufactured hype. People used it because it worked.
It also has broad system access, an aggressive release cadence, a marketplace that shipped malicious code at scale, and tens of thousands of instances exposed by users who never changed a default. Those are not contradictions – they are the predictable cost of the thing that makes it useful.
If you run it, run it deliberately. Not exposed, always updated, skills read before installed, credentials scoped tight. Treat OpenClaw as what it is: a capable process with hands, sitting inside your network, doing what it is told by whoever manages to tell it.
