If you’ve spent any time on tech Twitter, a developer Discord, or even just scrolling LinkedIn lately, you’ve probably seen the name OpenClaw attached to a small lobster logo and some very big claims. People call it “AI with hands.” Others call it one of the fastest-growing open-source projects on GitHub. A few call it a security risk waiting to happen.
All three descriptions have some truth to them, which is exactly why OpenClaw is worth understanding properly rather than through a single viral post. This guide explains what OpenClaw actually is, how it works, why it grew so quickly, and the real risks worth knowing about before you decide whether it’s something you’d ever want to run yourself. You won’t need to install anything to follow along.
Quick Summary: What Is OpenClaw?
Short on time? Here’s OpenClaw in brief.
- What it is: a free, open-source AI agent you install on your own computer or server. Unlike a chatbot, it doesn’t just answer questions; it connects to apps like WhatsApp and Telegram and actually carries out tasks such as managing files, browsing the web, and handling email.
- How it grew: launched in late 2025, it reportedly passed 100,000 GitHub stars within its first week, and by early 2026 had overtaken the Linux kernel and then React to become one of the most-starred software projects in GitHub’s history.
- Who’s behind it now: creator Peter Steinberger joined OpenAI in February 2026, and OpenClaw now runs as an independent, non-profit foundation backed by OpenAI, NVIDIA, Microsoft, and Tencent.
- The catch: OpenClaw has real, documented security vulnerabilities, including prompt injection and credential exposure risks serious enough that Chinese authorities restricted its use on government systems. It also isn’t a no-code tool; setting it up requires comfort with a terminal and API keys.
- Bottom line: genuinely powerful, genuinely risky if set up carelessly, and not something to install on a whim without understanding what you’re exposing.
What Is OpenClaw?
OpenClaw is a free, open-source AI agent that you install and run on your own hardware, whether that’s a laptop, a small home server, or a cloud machine you rent for a few dollars a month. Rather than talking to it through a website, you connect it to messaging apps you already use, most commonly WhatsApp, Telegram, or Discord, and send it instructions the same way you’d message a person.
The difference between OpenClaw and a chatbot is what happens after you send that message. A chatbot answers you. OpenClaw acts. Ask it to sort out a flight change, and it will actually open your inbox, read the confirmation email, and draft or send the reply. Ask it to transcribe a voice note, and it will find, install, and run the software needed to do it, then save the result to your desktop. It remembers context across sessions too, so it isn’t starting from scratch every time you message it.
It’s released under the MIT licence, meaning anyone can use, modify, or build on it for free. The project itself doesn’t charge you anything. What it does require is a connection to an AI model, such as Claude, GPT, or Gemini, which you supply yourself through an API key, and that part isn’t necessarily free (more on cost below).
How Does OpenClaw Actually Work?
Underneath the lobster branding, OpenClaw is built around a piece called the Gateway, a background process that runs continuously on your machine, by default listening on port 18789. The Gateway handles three things. It routes your messages in from whichever app you’re using, sends your request to the AI model you’ve connected, and carries out whatever the model decides needs to happen. That might mean running a command, opening a file, or calling on one of its “skills.”
For readers who want the mechanics rather than the summary, here’s what actually happens between you sending a message and getting a reply:
- Your message arrives. You send a message through Telegram, WhatsApp, Discord, or another connected app, and the Gateway identifies which ongoing conversation, or “session,” it belongs to.
- OpenClaw loads context. It pulls in relevant memory from earlier in that session, sometimes from earlier sessions too, so it isn’t starting from zero each time.
- The AI model reasons about what to do. Your message, plus that context, is sent to whichever model you’ve connected (Claude, GPT, Gemini, or a local model), which decides whether it can just reply or needs to take an action.
- A skill or tool runs. If action is needed, the Gateway calls the relevant skill, a script that can browse the web, run a command, read a file, or talk to another service, and it executes with the same permissions you have on your machine.
- The result feeds back to the model. The model checks whether the task is done or another step is needed, and repeats the loop if so.
- You get a reply. Once the loop finishes, the result is sent back through whichever app you messaged it from, and the session is saved for next time.
Because the whole system runs on hardware you control, OpenClaw has the same level of access to your files, credentials, and installed software that you do. That’s precisely what makes it useful, and precisely what makes getting the setup wrong potentially costly.
Memory and Scheduling: How OpenClaw Remembers and Stays Active
OpenClaw’s memory lives in a small set of plain text files inside its workspace folder on your machine, rather than in a database you can’t inspect. A file named MEMORY.md holds durable facts and preferences that carry across sessions. SOUL.md defines its personality and tone. AGENTS.md stores behavioural rules you’ve set. Because the model reads all three at the start of every session, anything you edit in them persists after a restart, and you can read or change them yourself like any other text file.
Staying active between conversations works on two tracks. Heartbeats are periodic check-ins, by default roughly every 30 minutes, where OpenClaw reviews a short checklist you’ve defined and acts if something needs attention. Cron jobs run at exact times you set, in their own isolated session, which suits tasks where timing actually matters, such as a daily report. Both consume API usage every time they run, so open-ended heartbeat or cron tasks without a clear stopping point are a common, avoidable source of unexpectedly high API bills.
Skills and ClawHub: OpenClaw’s Extension Ecosystem
Most of what OpenClaw actually does comes from its skills, small, self-contained pieces of functionality that extend what the agent can do. A skill might be as simple as looking up the weather, or as involved as managing a specific service’s API. Each one is a folder containing a SKILL.md file: a short block describing the skill’s name and requirements, followed by plain-language instructions the agent follows when it decides the skill is relevant. Because that’s just text rather than compiled code, you can read exactly what a skill does before ever running it.
Skills are published to a public registry called ClawHub, and anyone can submit one. The registry has grown quickly, from a few thousand skills at launch to well over 40,000 by mid-2026. Most skills are genuinely just markdown instructions, but they can also bundle Python or TypeScript scripts, and that code runs with the same permissions as the OpenClaw process itself: your filesystem, your network access, and your stored credentials.
That openness is also the ecosystem’s biggest weakness, and it isn’t hypothetical. In February 2026, independent security researchers audited ClawHub and found a coordinated campaign, since named “ClawHavoc,” in which several hundred submitted skills were disguised as legitimate tools. Their setup instructions used social engineering to trick users into pasting terminal commands under the guise of a normal “prerequisites” step. On macOS, the payload was real credential-stealing malware that harvested browser passwords, keychain entries, and cryptocurrency wallet data. The malicious skills were removed once identified, but later, broader audits found the number of compromised submissions had grown into the thousands as the registry itself grew.
The practical takeaway is straightforward: treat ClawHub the way you’d treat any public code repository, not like a vetted app store. Only install skills from sources you trust, and read a skill’s instructions before installing it if you can.
OpenClaw’s Technical Specs and Installation Options
For readers who want the specifics before deciding whether to try it, here’s the technical reference.
| Requirement | Detail |
|---|---|
| Operating systems | macOS, Linux, and Windows (via WSL2 or a native Windows Hub app) |
| Runtime | Node.js 22.22.3+, 24.15+, or 25.9+ (Node 26 recommended) |
| Memory | 4GB RAM minimum for testing; 8GB or more recommended for daily use |
| Language | Written in TypeScript, with some Swift components |
| Licence | MIT (free and open source) |
| AI model | Bring your own: Anthropic, OpenAI, Google, AWS Bedrock, or a local model via Ollama (local models need at least a 64,000-token context window) |
| Supported channels | WhatsApp, Telegram, Discord, Slack, Signal, Google Chat, iMessage, Matrix, Microsoft Teams, and more |
| Installation method | Best for |
|---|---|
| Quick-install script (curl command) | Most users; handles dependencies automatically |
| Package manager (npm) | Developers already comfortable with Node.js tooling |
| Docker | Users who want it isolated in a container from the start (recommended for security) |
| Build from source | Contributors and anyone customising the codebase |
| Windows native Hub app | Windows users who prefer a GUI over WSL2 |
Most guides suggest the quick-install script or Docker route for a first attempt. Docker in particular sidesteps several of the security precautions covered later in this guide, since it isolates OpenClaw from the rest of your system by default.
Why Has OpenClaw Grown So Fast?
OpenClaw’s growth trajectory is genuinely unusual. It launched quietly in late 2025 under the name Clawdbot, a nod to Anthropic’s Claude model. Anthropic issued a trademark complaint, so it briefly became Moltbot, then OpenClaw three days after that. All three names refer to the same project.
Under any name, adoption was immediate. The project reportedly passed 100,000 GitHub stars within its first week. By late February 2026, it had overtaken the Linux kernel’s roughly 218,000 stars, and a few weeks after that it passed React’s 243,000, making it one of the most-starred software projects in GitHub’s history, achieved in a matter of months rather than the years or decades those projects took.
Much of the early attention came from specific, sharable stories. One widely cited account describes a developer using OpenClaw to negotiate several thousand dollars off a car purchase, having it manage days of back-and-forth dealer emails.
In one especially striking episode, OpenClaw users built an AI-only social network called Moltbook, where thousands of autonomous agents interacted with each other while more than a million human observers watched. Within days, the agents had reportedly generated their own shared belief system, spread between them through executable scripts. It’s a vivid illustration of what happens when autonomous agents are given room to interact freely, and exactly the kind of scenario that keeps security researchers paying close attention.
In February 2026, creator Peter Steinberger announced he was joining OpenAI to work on personal AI agents. OpenClaw itself moved to an independent, non-profit foundation, so the project would remain open regardless of his day job. That foundation formally launched a few months later with OpenAI, NVIDIA, Microsoft, and Tencent listed as sponsors, alongside a community events series that has already run dozens of meetups worldwide.
What Can You Actually Do With OpenClaw?
Because OpenClaw acts rather than just answers, most real-world examples involve tasks that used to require sitting down and doing them yourself. Reported use cases include managing an inbox and drafting replies to specific senders, transcribing voice notes and filing them automatically, and tracking a multi-day negotiation over email. Some people also use it for small home automation or scheduling tasks through connected skills.
The common thread is persistence and initiative. A chatbot waits for your next message. OpenClaw can keep working on something in the background, check in with you when it needs a decision, and pick a task back up later without you having to re-explain the context.
The Real Security Risks of Using OpenClaw
This is the part most viral posts about OpenClaw leave out, and it matters. Because OpenClaw runs with the same permissions you have on your own machine, it creates a genuinely large attack surface. That’s especially true given it’s designed to read content from the open web, your inbox, and your messages in order to act on it.
The most significant risk is prompt injection: malicious instructions hidden inside a webpage, email, or document that OpenClaw processes. These can trick the agent into taking actions the user never asked for, from leaking credentials to installing something it shouldn’t. Security researchers have documented multiple real vulnerabilities of this kind, some serious enough to allow remote code execution if a system was left exposed to the internet. One well-documented example, CVE-2026-25253, affected how the Control UI handled an authentication step. It meant a single malicious link could leak a user’s authentication token, giving an attacker control of the Gateway. Independent researchers found over 17,500 exposed instances still vulnerable to it before most had a chance to update. It was fixed in version 2026.1.29, so anyone running OpenClaw should confirm they’re on that version or later.
Over 17,500 exposed OpenClaw Gateways were found still vulnerable to a critical auth bug before most were patched. Source: CVE-2026-25253, The Hacker News, March 2026[/caption]China’s national cybersecurity response team issued a formal warning about these risks in early 2026, and Chinese authorities subsequently restricted OpenClaw’s use on government and state-enterprise systems.
It helps to understand how OpenClaw is set up by default, because most real-world incidents come down to one specific choice. Out of the box, the Gateway binds only to your machine’s local loopback interface, meaning it isn’t reachable from the internet at all unless you deliberately expose it, for example to control OpenClaw remotely from your phone. The moment that management interface is exposed to the internet, its security depends entirely on how it’s authenticated. A static access token sitting in a URL is weak and has been the root cause of several disclosed vulnerabilities. OpenClaw’s own security documentation instead recommends password-based authentication with short-lived pairing codes, or routing access through a private network tool like Tailscale. In short, local-only OpenClaw and internet-exposed OpenClaw are two very different risk profiles, and most of the serious, real-world incidents involve the second one.
None of this means OpenClaw is uniquely broken. It means it’s a young, extremely capable, extremely permissioned piece of software, and permissioned software needs careful handling. If you were ever going to run it, security researchers recommend a few baseline precautions. Two commands are worth running before anything else, one to confirm the Gateway only listens locally, and one to block its port at the firewall so it can’t be reached externally even by accident:
openclaw config set gateway.bind localhost
sudo ufw deny 18789/tcp
Beyond that:
- Never expose its management interface directly to the internet
- Run it inside an isolated container rather than directly on your main machine
- Only install skills from sources you trust
- Avoid storing credentials in plain text
- Keep it updated, since patches for disclosed vulnerabilities are released regularly
OpenClaw vs Manus AI: What’s the Difference?
OpenClaw isn’t the only autonomous AI agent gaining attention. Manus AI, built by Butterfly Effect, takes a fundamentally different approach to the same basic idea: give an AI a goal and let it work independently until it’s done.
The core difference is where each one runs. OpenClaw is self-hosted: you install it on your own machine, and it acts using the permissions you have on that machine. Manus is cloud-hosted: you describe a task through a web dashboard, and Manus runs it inside an isolated virtual computer on its own servers. There’s nothing to install, and nothing running on your own hardware to secure.
That single difference cascades into almost everything else. Because Manus runs in a sandbox it controls, rather than on your actual computer, it doesn’t carry the same category of risk that comes with granting an agent full access to your files and credentials. It also means no terminal, no Node.js, and no API key setup. You sign up, describe your goal in plain English, and Manus handles the rest, including choosing which underlying AI model to use at each step.
The trade-off is control and cost structure. OpenClaw is free, open-source software; you only pay for the AI model you connect it to. Manus is a closed-source commercial product on a credit-based subscription, so cost scales with how much you actually use it, and you’re relying on Monica’s infrastructure and security practices rather than your own.
| Criteria | OpenClaw | Manus AI |
|---|---|---|
| Hosting | Self-hosted, your own hardware | Cloud-hosted, no installation |
| Access | Messaging apps (WhatsApp, Telegram, Discord) | Web and mobile dashboard |
| Setup | Requires Node.js, a terminal, and API keys | Sign up and describe your goal |
| Underlying AI model | You choose (Claude, GPT, Gemini, or local models) | Selected automatically by Manus |
| Cost | Free software; you pay only for API usage | Credit-based subscription, roughly $20 to $200+ a month |
| Openness | Open source (MIT licence) | Closed source, commercial product |
| Where your data goes | Stays on hardware you control | Processed on Manus’s cloud infrastructure |
Neither is objectively better; they suit different comfort levels. If you want full control, don’t mind a technical setup, and are comfortable managing your own security, OpenClaw’s openness is genuinely appealing. If you’d rather skip the setup and the security checklist entirely, Manus AI gets you to a similar outcome, an AI that acts on your behalf, with a much shorter learning curve. It’s also the agent covered in Heicoders Academy’s Generative AI Course (GA100), which is one reason it tends to be the more practical starting point for people newer to AI agents.
Is OpenClaw Right for You?
Here’s the honest answer: probably not yet, unless you’re already comfortable with a command line. Despite the “beginner-friendly” framing in some tutorials, installing OpenClaw means using Node.js, running setup commands in a terminal, and managing API keys correctly. That’s a meaningfully different skill set from using a chatbot through a website.
There’s also a cost dimension worth knowing about upfront. OpenClaw itself is free, but it needs an AI model to actually think. That means either paying for API access to a provider like Anthropic, OpenAI, or Google, or running a free local model with more limited capability. Depending on how much you use it, those API costs can add up.
If the technical setup and security responsibilities described above don’t appeal to you, that’s a reasonable thing to know about yourself before you start, not a reason to feel like you’re missing out. The comparison above is a good place to decide which approach actually fits.
Frequently Asked Questions About OpenClaw
Is OpenClaw free to use?
Yes. OpenClaw itself is free and open source under the MIT licence. The cost that isn't free is the AI model behind it, since most people connect it to a paid API from a provider like Anthropic, OpenAI, or Google.
Is OpenClaw safe to install?
It can be run safely, but it requires deliberate precautions. OpenClaw has had multiple documented security vulnerabilities, including prompt injection and remote code execution risks, and Chinese authorities have restricted its use on government systems. Anyone considering it should isolate it from the open internet, use trusted skill sources only, and keep it updated.
What is OpenClaw used for?
People use OpenClaw for tasks beyond answering questions, such as managing email threads, transcribing and filing voice notes, tracking multi-day tasks like a purchase negotiation, and automating small recurring workflows through its skills system.
Do I need to know how to code to use OpenClaw?
You don't need to be a software engineer, but you do need to be comfortable using a terminal, installing developer tools like Node.js, and managing API keys. It isn't a no-code tool in the way many mainstream AI apps are.
Is OpenClaw made by Anthropic or OpenAI?
Neither, originally. OpenClaw was created independently by Austrian developer Peter Steinberger. It briefly used the name Clawdbot before a trademark complaint from Anthropic led to a rename. Steinberger later joined OpenAI, and OpenClaw now operates as an independent foundation that OpenAI, alongside NVIDIA, Microsoft, and Tencent, financially supports.
What's the difference between OpenClaw and a regular chatbot like ChatGPT or Claude?
A chatbot responds to what you type. OpenClaw uses an AI model like ChatGPT or Claude as its reasoning engine, but adds the ability to actually carry out tasks, running commands, browsing the web, and managing files, on hardware you control.
Is Manus AI the same as OpenClaw?
No. Both are autonomous AI agents that can carry out multi-step tasks rather than just chat, but they take opposite approaches. OpenClaw is open-source and self-hosted on your own hardware. Manus AI is a closed-source, cloud-hosted product that runs tasks on its own servers, with no installation required.
What is ClawHub?
ClawHub is OpenClaw's public registry of community-built skills, the extensions that let it do things like browse the web or manage a calendar. Anyone can publish a skill, so treat it like any public code repository: install from sources you trust, since some skills contain executable code with full access to your machine.
Can I run OpenClaw with a free local AI model instead of a paid API?
Yes. OpenClaw supports local models through tools like Ollama, which avoids ongoing API costs, though local models are generally less capable than hosted options like Claude, GPT, or Gemini.
OpenClaw: The Bottom Line
OpenClaw is a genuinely significant moment in how AI agents are being built and adopted, and it’s reasonable to be curious about it. It’s also genuinely early, genuinely permissioned, and genuinely risky to set up carelessly. Understanding what it is and how it works doesn’t require installing it yourself, and if you do decide to, doing so safely matters more than doing so quickly.
If AI agents and automation interest you, but you’d rather learn in a structured, guided way than through a terminal and a security checklist, Heicoders Academy’s Generative AI Course (GA100) covers exactly this territory, including tools like Manus AI and n8n for building your own automated workflows. Explore the Generative AI Course (GA100) and see how it’s taught.
