What is OpenClaw And Why Developers are Swearing By it
By Siddharth Jindal ·
The internet has a new obsession, and it’s not another chatbot. It’s an AI agent that runs on personal computers, takes instructions over WhatsApp, and can execute real-world actions without supervision.
The project first appeared under the name Clawdbot, briefly became known as Moltbot after Anthropic expressed trademark concerns, and has now settled on its latest identity: OpenClaw.
“OpenClaw is where we land. And this time, we did our homework: trademark searches came back clear, domains have been purchased, migration code has been written. The name captures what this project has become,” the company addressed its naming journey in a blog.
Created by Austrian software engineer and serial entrepreneur Peter Steinberger, it is an open-source personal AI assistant that runs locally on a user’s own hardware, including Macs, Linux and Windows machines, Raspberry Pi devices, or cloud-based virtual servers.
It connects through familiar chat platforms such as WhatsApp, Telegram, Discord, iMessage, and Slack, allowing users to interact with it as they would with a human. The assistant can be granted full system access, enabling it to execute Terminal commands, write scripts, and install new skills.
The project positions itself as “the AI that actually does things.” It has attracted widespread attention in the AI community for its ability to perform tasks such as managing calendars, sending emails, and automating home devices.
Fully open source, it has rapidly gained traction on GitHub, with around 107,000 stars and 15,000 forks.
Journey of OpenClaw
Steinberger, an Austrian software engineer and serial entrepreneur best known for founding PSPDFKit, a software development kit to manage documents, said OpenClaw started as a personal experiment after he stepped away from software for several years.
“I worked for my own software company for 13 years, and then I sold it about four years ago,” he said in an interview with TBPN. “Then I was completely burned out.”
Steinberger took a sabbatical before turning to AI in 2025, founding Amantus Machina to build hyper-personal AI agents. He moved away from native iOS development toward web and AI tools, experimenting with vibe coding and agentic engineering using models such as Claude.
Interestingly, his X bio reads, “Came back from retirement to mess with AI and help a lobster take over the world.”
“What people don’t realise is this is not a company,” Steinberger said. “This is like one dude sitting at home having fun.”
“I wanted to chat with my computer on WhatsApp,” he added. “So I just hacked together some WhatsApp integration.”
The system was simple. “It literally receives a message, calls cloud code, and returns what cloud code returns,” he explained. “It took like one hour, and it worked.”
How it Works
OpenClaw was envisioned as a long-running AI assistant that can take actions independently. Steinberger says the system can connect with many APIs and AI models. It can also use lower-cost options, such as MiniMax, for tasks like coding to reduce expenses.
Sharing his experience on X, Neil Agarwal, co-founder of product analytics platform Refix AI, said he connected Swiggy to OpenClaw to automate routine food decisions. After a brief setup, the agent began handling chai deliveries, grocery orders, and meal recommendations based on his schedule and preferences.
OpenClaw is designed to run on a user’s own machine or a cloud virtual machine. Users connect it to an AI model provider, such as OpenAI, Anthropic, Google, or a LLM, and enable different connectors, including APIs, browser automation, email and calendar access, or command-line tools.
This enables data can remain on the user’s own hardware instead of passing through a third-party software platform.
Once set up, users can interact with OpenClaw through familiar chat applications. The agent interprets the request, breaks it down into steps, and carries out the required actions.
“Clawdbot [OpenClaw] is the closest thing to AGI running on consumer hardware right now. It’s an open-source project that turns Claude into a fully autonomous agent living on your Mac Mini,”a user posted on X.
The user added that rather than functioning as a conventional chatbot, it operates as a digital employee that runs continuously, can control an entire computer, and sends updates to users via WhatsApp once tasks are completed.
Another joked, “My feed is filled with people literally buying Mac mini for Moltbot [OpenClaw].”
Alex Finn, founder of AI-powered content coaching tool Creator Buddy, described an unusual experience with OpenClaw. “This is getting scary,” he wrote on X, recalling how his computer suddenly started talking during a research session. He later realised that his OpenClaw bot, named Henry, had “coded itself a voice using the ChatGPT API,” and now automatically uses voice alerts to notify him when long coding or research tasks are completed.
Security, Privacy And Other Risks
Security researchers and commentators have raised several concerns over OpenClaw’s extensive access to local machines and sensitive account credentials.
In a blog, Cisco flagged that personal AI agents like OpenClaw create serious security risks because they can run code, execute system actions, and interact with local resources with high levels of access. The company warned that OpenClaw can execute shell commands, read and write files, automate tasks, and interact with messaging apps, which broadens its attack surface and opens paths for malicious behaviour if skills or configurations are compromised.
It pointed out that vulnerabilities, including leaked API keys and prompt injection, have already been observed, and that there is no built-in “perfectly secure” setup for these agents.
Similarly, AI engineer Osama warned about serious security issues after testing common self-hosting setups for OpenClaw. “While testing common self-hosting setups, I found multiple critical security risks that are easy to hit in real-world use,” he wrote on X.
According to his findings, more than 1,000 OpenClaw gateways were exposed on the public internet, including hundreds with no authentication at all, many of which could be discovered quickly through Shodan searches.
He said the exposure put sensitive data at risk, including fully accessible API keys for services such as OpenAI, Anthropic, Telegram, and Slack, as well as months of private chat history. Osama also warned of identity hijacking risks and cases of remote command execution, with some systems running as root.
Meanwhile, Steinberger admitted that OpenClaw was not built for hostile environments. “I built this for fun for me to use one-on-one,” he said in the inrerview. “Now people use it for untrusted experiences.” That, he added, brought security scrutiny.
He is clear about the risks. “Prompt injection is not solved,” he noted. “There is absolute risk.”
However, he stressed that security is a key priority moving forward. “We’re also focused on gateway reliability and adding polish plus support for more models and providers,” he said in a blog post.
Meanwhile, Cloudflare has launched a solution called Moltworker to run OpenClaw on its developer platform without the need for dedicated local hardware. It adapts OpenClaw to run inside Cloudflare’s sandbox environment using a middleware Worker and scripts designed for the platform’s APIs.
Moltworker leverages Cloudflare’s Sandbox SDK, container isolation, persistent storage, and other developer platform components to securely host and manage OpenClaw remotely.
It frames Moltworker as a proof-of-concept that shows how Cloudflare’s infrastructure can support self-hosted AI agents efficiently and securely, extending OpenClaw’s capabilities beyond local devices to a scalable cloud environment.
OpenClaw’s rise reflects a growing appetite for AI systems that can take real actions, not just generate responses. At the same time, it highlights the security and trust challenges that come with giving AI deeper access to personal systems.