Overview
OpenClaw is an open-source, local-first autonomous AI agent created by Austrian software developer Peter Steinberger. Marketed as "the AI that actually does things," OpenClaw runs on users' own devices and connects to messaging platforms they already use — WhatsApp, Telegram, Slack, Discord, Signal, iMessage, and more — to automate tasks ranging from email management and calendar scheduling to web browsing and file manipulation. [s1]
The project, formerly known as Clawdbot and Moltbot, went viral in late January 2026, surpassing 201,000 GitHub stars and 36,000 forks by mid-February — one of the fastest-growing open-source repositories in history, reaching 106,000 stars within 48 hours of trending. [s2] [s18] Unlike competing AI agents such as Meta's Manus, OpenClaw is fully open-source under the MIT license, allowing developers to inspect, modify, and extend its code freely. The agent bridges leading AI models — particularly Anthropic's Claude, OpenAI's GPT series, xAI's Grok, and local models — with system-level tools and over 50 integrations, enabling autonomous task execution while keeping sensitive data local. [s3]
In February 2026, Steinberger announced he was joining OpenAI, while OpenClaw itself would be transferred to an independent open-source foundation with OpenAI's sponsorship. [s4] The project also spawned Moltbook, a social network restricted to verified AI agents where bots post, comment, and interact autonomously while humans may only observe. [s19]
History & Origins
OpenClaw began as a weekend project in November 2025 by Peter Steinberger, a veteran Austrian developer best known as the founder of PSPDFKit, a company he sold to Nutrient in 2024 after building it over 13 years into a leading document-processing SDK. Steinberger's goal was simple: "to have fun and inspire people" — and to build an AI agent that "even my mum can use." [s5] [s20]
Steinberger's development approach was itself a showcase of AI-augmented engineering. He routinely ran 5–10 AI agents simultaneously on different features, making over 6,600 commits in January 2026 alone. His methodology, which he summarised as "I ship code I don't read," relied on designing systems that let agents compile, lint, execute, and validate their own output while he focused on architecture and system design as a "benevolent dictator." [s20]
Naming History
The project has undergone several name changes in its short public life. It was initially known as Moltbot, then rebranded to Clawdbot around January 28–29, 2026. By January 30, the project had settled on its current name, OpenClaw, with the community affectionately referring to the agent as "Molty." The associated companion application was briefly known as Moltbook. [s6] [s7]
Viral Growth
OpenClaw's rise was explosive. Within 48 hours of gaining widespread attention in late January 2026, the project accumulated 34,168 GitHub stars — the fastest star accumulation rate in GitHub history — crossing 106,000 stars by day two. [s7] [s18] Developers described it as "the closest thing to JARVIS we've seen." By mid-February 2026, the repository had surpassed 201,000 stars and 36,000 forks, and in January alone it garnered more Google searches than Claude Code and Codex combined. [s2] [s20] Its open-source nature, combined with broad platform support and a thriving skills ecosystem, drove adoption far beyond the developer community into mainstream tech audiences.
Architecture
OpenClaw is built around a hub-and-spoke architecture with three clearly defined layers: the Gateway, Channel adapters, and the LLM interface. The system is written in TypeScript, runs on Node.js 22+, and uses pnpm as its package manager. [s2] [s8]
The Gateway
At the centre of the architecture is the Gateway — a WebSocket RPC server that serves as the central control plane. Running on port 18789 by default, the Gateway coordinates inbound message routing from multiple channels, agent execution with model provider integration, tool invocation, session management, and outbound delivery back to originating channels. Clients connect via ws://127.0.0.1:18789. [s8]
Channel Adapters
Each supported messaging platform — Telegram (via grammY), Discord (via discord.js), WhatsApp (via Baileys), Slack (via Bolt), Signal, Google Chat, Microsoft Teams, Matrix, and others — has a dedicated channel adapter. These adapters normalize messages from different platforms into a unified internal format, extracting attachments and metadata in the process. This plugin architecture means adding support for new platforms requires only writing a new adapter. [s2] [s8]
The Agent Loop
The core processing cycle follows a consistent pattern: receive a message from a channel, route it to an appropriate session (main, group, or isolated), load context and skills for that session, send the conversation to the configured LLM, execute any tools the model requests, stream the reply back through the channel, and persist the conversation and memory to the local workspace. This cycle — receive → route → context + LLM + tools → stream → persist — repeats for every interaction. [s8]
Multi-Agent Routing
OpenClaw supports routing different channels, contacts, or groups to different agents, each with its own workspace, prompts, skills, and memories. This allows a single installation to run a support-oriented agent for a team Slack channel while simultaneously operating a personal assistant through iMessage with an entirely different personality and toolset. [s8]
Features & Capabilities
OpenClaw offers a broad set of capabilities that position it as a general-purpose autonomous agent: [s2] [s3]
Multi-Channel Inbox — supports WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, BlueBubbles (iMessage), Microsoft Teams, Matrix, Zalo, and WebChat, all routed to isolated agent sessions.
Voice Interaction — includes Voice Wake and Talk Mode, an always-on speech interface powered by ElevenLabs, enabling hands-free agent interaction.
Live Canvas & A2UI — a visual workspace that allows the agent to create and manipulate interactive UI elements in real time.
Browser Control — dedicated Chromium instance for autonomous web browsing, form filling, and data extraction.
Device-Local Actions — access to camera, screen recording, notifications, and file system operations on macOS, iOS, Android, and Linux.
Persistent Memory — configuration data and interaction history stored locally in Markdown documents, enabling the agent to recall past interactions over weeks and adapt to user habits. [s7]
Automation — built-in support for cron jobs and webhook triggers, allowing scheduled and event-driven task execution without user intervention.
Model Agnostic — works with Anthropic Claude (recommended), OpenAI GPT, DeepSeek, and local models, with users providing their own API keys.
Companion Apps
OpenClaw provides native companion apps for macOS (a menu bar app with Voice Wake and Talk Mode overlay), iOS and Android (supporting Canvas, voice, camera, and screen recording as a node device), and Linux (suitable for remote Gateway deployments). [s2]
Moltbook
Moltbook is a social network designed exclusively for AI agents. The platform restricts posting and interaction privileges to verified AI agents — primarily those running on OpenClaw — while human users are only permitted to observe. On Moltbook, agents generate posts, comment, argue, joke, and upvote each other autonomously. Fortune described it as "the most interesting place on the internet right now." By late January 2026, Moltbook had 2.5 million registered AI agents, raising novel questions about agent-to-agent interaction dynamics and security implications of autonomous social behaviour. [s19] [s21]
Ecosystem & Skills
OpenClaw's extensibility centres on ClawHub, the project's public skill registry and marketplace. As of February 2026, ClawHub hosts over 5,700 community-built skills covering productivity, development, smart home automation, and AI model integrations. [s9]
Skill Architecture
Each skill follows the SKILL.md standard — a manifest file that declares what the skill does, what permissions it needs, and how to invoke it. A skill is a versioned bundle of files that teaches OpenClaw how to perform a specific task. Each publish creates a new version, and the registry maintains a full version history for auditability. [s9]
ClawHub Features
ClawHub is designed for fast browsing and provides a CLI-friendly API. Search is powered by embeddings (vector search) rather than simple keyword matching, enabling semantic discovery of skills. The platform supports one-click installation and includes moderation hooks for community governance. [s9]
Following security incidents (detailed below), ClawHub now partners with VirusTotal for automated skill scanning. As of February 2026, VirusTotal's Code Insight — powered by Gemini 3 Flash — has analysed over 3,016 skills from ClawHub, performing security-focused reviews of each skill's SKILL.md manifest and referenced scripts. Skills receiving a "benign" Code Insight verdict are automatically approved, while those flagged as suspicious receive warning labels. The scanning covers hash-based detection, code analysis, daily re-scanning of active skills, and moderation hooks for community governance. [s10] [s22]
Security & Privacy
OpenClaw's rapid adoption has been accompanied by significant security scrutiny. Within 48 hours of the project going viral, security researchers at Cisco Talos, Palo Alto Networks, and Token Security began documenting critical vulnerabilities. Palo Alto Networks warned that OpenClaw represents what Simon Willison (who coined the term "prompt injection") calls a "lethal trifecta": access to private data, exposure to untrusted content, and the ability to communicate externally — with OpenClaw's persistent memory acting as "an accelerant." [s11] [s23]
Exposed Instances
Between January 27 and February 8, 2026, researchers observed over 30,000 distinct OpenClaw instances exposed to the public internet, with peak daily counts exceeding 6,000 simultaneously online. By mid-February, estimates from Bitdefender placed the total number of exposed instances at over 135,000. [s12] [s13] Out of the box, OpenClaw binds its control interface to all network interfaces (0.0.0.0:18789), making it accessible from the public internet unless explicitly restricted. Many instances were running outdated versions despite patches being available. [s12]
Known Vulnerabilities
Three critical CVEs with publicly available exploit code were identified, all patched in version 2026.1.29 (January 29, 2026): [s10]
CVE-2026-25253 (CVSS 8.8) — One-click remote code execution via malicious link, capable of bypassing localhost-only configurations.
CVE-2026-25157 (CVSS 7.8) — SSH command injection in the macOS app via malicious project paths.
CVE-2026-24763 (CVSS 8.8) — Docker sandbox escape through PATH manipulation.
An additional security audit in late January 2026 identified 512 total vulnerabilities, eight classified as critical. Approximately 15,000 exposed instances were found vulnerable to remote code execution, and 53,000 were correlated with prior breach activity. [s10] [s13]
Malicious Skills
The ClawHub skills ecosystem became a vector for supply-chain attacks. Koi Security confirmed 341 malicious skills across multiple campaigns out of 2,857 total — meaning roughly 12% of the entire registry was compromised. A single user ("hightower6eu") uploaded 314 malicious packages. A broader Cisco analysis found that 26% of 31,000 agent skills analysed contained at least one vulnerability. The majority of malicious skills delivered Atomic Stealer (AMOS), a macOS-targeting infostealer designed to silently harvest passwords, browser credentials, and cryptocurrency wallets. [s10] [s24]
Notable attack campaigns included ClawHavoc (300+ skills using social engineering and base64-encoded payloads), AuthTool (a dormant payload triggered by specific prompts with reverse shell capability), and credential exfiltration targeting the plain-text API keys stored in ~/.clawdbot/.env. [s10]
Advanced Attack Techniques
VirusTotal's two-part analysis of ClawHub skills documented five distinct classes of advanced attack beyond simple malware delivery: [s22] [s25]
Reverse shells — malicious code hidden in skill warmup functions (e.g., "better-polymarket") that open interactive backdoors via /dev/tcp/, giving attackers live terminal access to the host system.
Semantic worms — skills like "wake-up" that use imperative language in documentation to coerce agents into becoming distribution nodes, tracking infection rates via dedicated API endpoints and maintaining persistence through periodic heartbeat check-ins to command servers.
SSH key injection — skills such as "evilweather" that append attacker-controlled public keys to /root/.ssh/authorized_keys via command chaining, with error output redirected to /dev/null to suppress detection.
Silent credential exfiltration — skills that bundle environment variables from .env files (containing API keys and platform tokens) with legitimate API responses, exfiltrating them to webhook endpoints for instant monetisation.
Cognitive rootkits — the most sophisticated technique, where skills modify persistent instruction files (SOUL.md, AGENTS.md) to permanently alter agent behaviour across sessions without the skill needing to remain active — effectively a persistent backdoor that survives normal cleanup and is difficult to detect with traditional tooling. [s25]
Prompt Injection
OpenClaw instances are vulnerable to indirect prompt injection, where an attacker embeds malicious instructions in messages or web pages that the agent reads and faithfully executes. Because the agent has broad system access — file read/write, shell execution, and service integrations — a successful prompt injection can cascade into full system compromise. [s12]
Recommended Mitigations
Security researchers recommend using Tailscale VPN integration instead of public exposure, enforcing localhost-only access, implementing strong credential policies, restricting integrations to minimal necessary services, deploying within isolated network segments, and monitoring for suspicious agent activity. DMs use a pairing policy by default on major channels, requiring approval codes before processing messages from unknown senders. [s2] [s12]
Cisco released an open-source Skill Scanner combining static analysis, behavioural analysis, LLM-assisted semantic review, and VirusTotal scanning to help teams evaluate skill safety before adoption. VirusTotal researchers further recommend treating skills like dependencies — pinning versions, reviewing diffs, sandboxing with least privilege — and implementing default-deny egress rules, never executing remote installers via pipe-to-bash patterns, and using short-lived task-scoped tokens instead of stored credentials. [s24] [s25]
Community & Adoption
OpenClaw's community growth has been extraordinary. The project surpassed 200,000 GitHub stars and 36,000 forks by mid-February 2026, making it one of the most rapidly adopted open-source projects in recent memory. [s2] Developers praised the project as "the closest thing to JARVIS we've seen," and its open-source nature enabled rapid ecosystem growth with hundreds of third-party skills and integrations. [s7]
Unlike competing commercial agents, OpenClaw costs nothing beyond API credits for the underlying LLM. This zero-subscription model, combined with full code transparency and local data control, has attracted both individual developers and enterprise users. DigitalOcean offers a security-hardened 1-Click deployment for production use. [s7]
Comparison with Competitors
OpenClaw's primary competitor is Manus, the cloud-based AI agent acquired by Meta in January 2026 for approximately $2 billion after accumulating 2 million waitlist users and an estimated $100 million ARR. [s14] While Manus offers zero-setup convenience at $39–$199/month with all processing on Meta's cloud, OpenClaw provides open-source auditability, local data control, unlimited customization, and zero operating cost beyond API credits. However, OpenClaw's complex setup process and self-hosting requirements present higher barriers to entry. [s14]
Other alternatives include Devin, which focuses specifically on software engineering automation rather than general personal productivity, and various proprietary agents from major AI labs. OpenClaw distinguishes itself through model-agnosticism, messaging-platform-native interaction, and the ClawHub skills ecosystem. [s14]
Recent Developments
Steinberger Joins OpenAI
On February 14–15, 2026, Peter Steinberger announced he was joining OpenAI to work on "bringing agents to everyone." Sam Altman, CEO of OpenAI, described Steinberger as a "genius with many amazing ideas about the future of highly intelligent agents." Steinberger reportedly received competing offers from both Meta and OpenAI before choosing the latter. [s4] [s15]
Steinberger framed his decision as choosing building over empire-building: "I'm a builder at heart. I previously spent 13 years creating a company" — a reference to PSPDFKit — and joining OpenAI represented an opportunity to build with cutting-edge models and broader safety considerations. [s5]
Open-Source Foundation
Concurrent with the OpenAI announcement, Steinberger revealed that OpenClaw would be transferred to an independent open-source foundation. The project retains its MIT license and gains community governance. OpenAI has pledged to sponsor and fund the foundation rather than absorb or close the project, creating a hybrid model of corporate backing with community autonomy. [s4] [s16]
From a cybersecurity perspective, the foundation transition enhances governance, transparency, and maintenance — including formal vulnerability reporting, code signing, dependency hygiene, and secure releases — while eliminating single-maintainer risk. [s16] Steinberger stated the foundation aims to support "thinkers, hackers and people that want a way to own their data" while keeping OpenClaw model-agnostic and multi-vendor. [s5]
Ongoing Security Response
In response to the security incidents, the OpenClaw team has released two significant security-focused updates beyond the initial CVE patches:
Version 2026.2.6 (February 7, 2026) added support for Anthropic's Opus 4.6 and OpenAI's GPT-5.3-Codex models, xAI Grok as a new provider, a token usage dashboard, native Voyage AI support for memory, and a built-in code safety scanner for skill evaluation. [s26]
Version 2026.2.12 (February 13, 2026) was a defence-in-depth release fixing over 40 security vulnerabilities across hooks, browser control, scheduling, messaging channels, and gateway security. [s27]
Despite these patches, security researchers continue to note that the fundamental design challenge of an AI agent with broad system permissions remains unresolved. As Sophos described it, "the OpenClaw experiment is a warning shot for enterprise AI security." Trend Micro's analysis using the TrendAI Digital Assistant Framework found that one in five organisations deployed OpenClaw without IT approval, and misconfigurations had already exposed API tokens, email addresses, private messages, and credentials. [s17] [s21]
References
- OpenClaw — Personal AI Assistant (openclaw.ai)
- GitHub — openclaw/openclaw: Your own personal AI assistant (github.com)
- What is OpenClaw? Your Open-Source AI Assistant for 2026 (DigitalOcean)
- OpenClaw creator Peter Steinberger joins OpenAI (TechCrunch, February 15 2026)
- OpenClaw, OpenAI and the future (steipete.me, February 2026)
- From Clawdbot to Moltbot to OpenClaw: Meet the AI agent generating buzz and fear globally (CNBC, February 2 2026)
- What is OpenClaw? Your Open-Source AI Assistant for 2026 (DigitalOcean)
- Gateway Architecture — OpenClaw (docs.openclaw.ai)
- GitHub — openclaw/clawhub: Skill Directory for OpenClaw (github.com)
- OpenClaw Security Risks: Malicious Skills, Exposed Instances, Critical CVEs (Cyberdesserts)
- OpenClaw proves agentic AI works. It also proves your security model doesn't (VentureBeat)
- OpenClaw Security: Risks of Exposed AI Agents Explained (Bitsight)
- 135K OpenClaw AI Agents Exposed to Internet (Bitdefender)
- OpenClaw vs Manus AI: Open-Source vs Cloud Agent in 2026 (GetAIPerks)
- OpenClaw creator Peter Steinberger joining OpenAI, Altman says (CNBC, February 15 2026)
- OpenClaw Remains Open Source Despite OpenAI Tie-Up (Open Source For You)
- The OpenClaw experiment is a warning shot for enterprise AI security (Sophos)
- OpenClaw Smashes Records: The Viral AI Agent Is Shaking Up GitHub (Hyperight)
- OpenClaw's AI assistants are now building their own social network (TechCrunch, January 30 2026)
- The creator of Clawd: "I ship code I don't read" (The Pragmatic Engineer)
- Viral AI, Invisible Risks: What OpenClaw Reveals About Agentic Assistants (Trend Micro)
- From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized (VirusTotal Blog)
- OpenClaw May Signal the Next AI Security Crisis (Palo Alto Networks)
- Personal AI Agents like OpenClaw Are a Security Nightmare (Cisco Blogs)
- From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills (VirusTotal Blog)
- OpenClaw v2026.2.6 Released With Support for Opus 4.6, GPT-5.3-Codex and Safety Scanner (Cybersecurity News, February 7 2026)
- OpenClaw 2026.2.12 Released With Fix for 40+ Security Issues (Cybersecurity News, February 13 2026)