✓ Reviewed by The Future Signal
✓ Reviewed by The Future Signal
OpenClaw is a genuinely remarkable free, MIT-licensed local AI agent that executes real tasks on your machine and works with any model including fully local ones. It is also the biggest open-source security story of 2026, with 60-plus CVEs, a poisoned skills marketplace, tens of thousands of exposed instances, and explicit warnings from Microsoft, Meta and the Dutch data protection authority. Recommended only for technically capable users on isolated hardware, or organisations using a hardened stack.
OpenClaw’s potential business impact is substantial and genuinely different from hosted assistants: an always-on agent that executes multi-step workflows across your actual files, applications and accounts, at zero software cost, with the option of complete data isolation using local models. Documented uses include community support bots deployed in twenty minutes and autonomous multi-day negotiation tasks.
The offsetting impact is risk exposure. Because every action carries the host machine’s full credentials and permissions, a compromise is not a data leak but a system takeover. For businesses, the real cost is the security engineering required — patching, isolation, skill review and monitoring — rather than the software itself.
Compare plans and pricing to find the best option for your needs.
Compare plans and pricing to find the best option for your needs.
Last Updated: 31 August 2026
This review covers the self-hosted OpenClaw software you install and run on your own machine or server. It does not cover any third-party hosted service built on it.
OpenClaw is the fastest-growing open-source project in GitHub’s history, and it deserves the attention. It is a free, MIT-licensed AI agent that runs on your own hardware, works with any model including local ones, and genuinely acts — running commands, editing files, browsing, sending email — through messaging apps you already use. It is also the subject of one of 2026’s most significant security incidents: 60-plus CVEs, tens of thousands of exposed instances, a poisoned skills marketplace, and a Microsoft classification of “not appropriate” for standard workstations. Extraordinary capability, genuine risk.
Estimated reading time: 11 minutes
OpenClaw is an open-source AI agent framework created by Austrian developer Peter Steinberger, founder of PSPDFKit. It first appeared in November 2025 as Clawdbot, was renamed Moltbot in early 2026 over trademark concerns — a reference to lobsters shedding their shells to grow — and became OpenClaw in January 2026. Users still call it Molty.
Its growth has no real precedent. Reports describe 60,000 GitHub stars within 72 hours, 100,000 by February, and figures above 340,000 by March 2026, making it among the fastest-growing repositories in GitHub’s history. Steinberger subsequently announced he was joining OpenAI, with OpenClaw continuing as a community project.
The distinction from a chatbot is that OpenClaw does things. It reads and writes files, runs shell commands, browses websites, sends email, calls APIs and chains multi-step workflows. You interact through messaging apps you already use — WhatsApp, Telegram, Slack, Discord, Signal — rather than a separate interface.
Two design decisions define it. First, configuration over code: agent identity, personality, capabilities and behavioural rules live in a plain Markdown file called SOUL.md. Second, a heartbeat daemon that wakes the agent on a schedule, so it acts proactively rather than only when prompted.
It is model-agnostic by design, working with Claude, GPT, Gemini, Grok, Mistral and DeepSeek, or entirely local models through Ollama or any OpenAI-compatible endpoint.
Why this matters for your business: OpenClaw is the clearest example yet of what a genuinely autonomous local agent looks like. It is also the clearest example of what happens when that capability ships faster than the security model around it. Both halves are the story, and treating either in isolation would misinform you.
OpenClaw is a strong fit for:
OpenClaw is probably not the right choice for:
Local-first execution. Configuration, memory and task history are plain-text files on your own hardware. With a local model, nothing leaves the machine.
Model agnosticism. Works with Claude, GPT, Gemini, Grok, Mistral, DeepSeek, or local models via Ollama and OpenAI-compatible endpoints. You are not locked to any provider.
SOUL.md configuration. Agent identity, capabilities and behavioural rules defined in plain Markdown rather than code — genuinely lowering the barrier to customisation.
Heartbeat daemon and scheduling. The agent wakes on a configurable interval and acts without prompting, which is what makes it an assistant rather than a tool you invoke.
Messaging interfaces. Control through WhatsApp, Telegram, Slack, Discord or Signal, so instructions come from the phone you already carry.
AgentSkills and ClawHub. Over 100 preconfigured skills covering shell execution, file management and web automation, with a community marketplace for thousands more — and, as covered below, the source of its most serious supply-chain problem.
Persistent local memory. Conversations and context stored in Markdown, giving long-term recall across sessions without a vendor holding your history.
Moltbook. A platform where OpenClaw agents interact with each other rather than with humans, used for multi-agent experiments.
OPENCLAW AGENT
│
├─► Shell commands ──────► runs as YOUR user
├─► File system ─────────► read + write
├─► Browser automation ──► your sessions
├─► Email + calendar ────► your accounts
├─► API calls ───────────► your keys
└─► ClawHub skills ──────► third-party code
⚠ ~1 in 12 audited
packages malicious
│
▼
Every action carries the credentials and permissions
of the machine it runs on. That is the whole design —
and the whole risk.[Illustration placeholder: OpenClaw permission and risk surface]
Installation is straightforward for anyone comfortable with a terminal. A local model setup through Ollama takes two steps, and DigitalOcean provides a one-click hardened deployment. Configuration through SOUL.md is genuinely approachable — plain Markdown rather than code.
Running it safely is a different discipline entirely, and this is where the honest assessment sits. Safe operation requires understanding reverse proxies, authentication, network isolation, token scopes, filesystem permissions and third-party code review. One of the project’s own maintainers wrote in its Discord that if you cannot understand how to run a command line, the project is far too dangerous to use safely. That is an unusually candid statement from a maintainer, and it should be read as guidance rather than modesty.
Model choice also matters practically: reliable multi-step tool use generally requires local models of 14 billion parameters or larger, since smaller models frequently fail partway through command sequences.
Future Signal Tip: If you run OpenClaw at all, run it on a dedicated machine or VPS that holds nothing you would mind losing — no work credentials, no customer data, no production access. Isolation is the single most effective control available, and it costs a few dollars a month.
As an agent, OpenClaw performs impressively. A single task typically triggers three to eight model calls as it plans, acts, evaluates and continues, and the result genuinely feels like delegation rather than prompting. Documented real-world uses include a Slack community support bot deployed in twenty minutes, and an engineer whose agent spent several days negotiating competing dealer quotes and reportedly saved $4,200 on a car purchase while he slept.
The privacy performance is real and rare. Run a local model and configuration, memory and prompts stay entirely on your hardware — something no hosted assistant reviewed in this series can offer.
The limitation is not capability but reliability of the surrounding system. Because the agent runs continuously with broad permissions, failure modes are more consequential than in request-response tools. Prompt injection is a live attack path rather than a theoretical one, and at least one CVE covers prompt-injection-driven code execution.
| Capability | How it performs | Notes |
|---|---|---|
| Autonomous multi-step tasks | Genuinely strong | 3–8 model calls per task |
| Local privacy | Best in class | Nothing leaves the machine with Ollama |
| Model flexibility | Excellent | Any major provider or local model |
| Proactive scheduling | Strong | Heartbeat daemon, runs 24/7 |
| Safe default configuration | Weak | Exposure was widespread by default |
| Third-party skill safety | Poor historically | Improving with VirusTotal scanning |
This section is longer than usual because it is the review. Anyone recommending OpenClaw without it would be misleading you.
The vulnerabilities. More than 60 CVEs and 60 GitHub security advisories have been disclosed across multiple waves, several with public proof-of-concept code. Two stand out. CVE-2026-25253, nicknamed ClawJacked and rated CVSS 8.8, allowed a malicious website to hijack a local agent via WebSocket, with reports describing one-click account takeover leading to remote code execution and no user interaction required. It was reported on 26 January 2026 and patched in the main branch two days later. CVE-2026-32922, rated CVSS 9.9 and described as the most severe in the project’s history, allowed a paired device to escalate a pairing token into full administrative control with code execution, affecting all versions before 2026.3.11.
Others include command injection, server-side request forgery, path traversal enabling local file reads, and prompt-injection-driven code execution.
The exposure. Counts vary enormously by methodology and date, and should be read as indicative rather than precise. Censys tracked growth from roughly 1,000 to over 21,000 publicly exposed instances in the last week of January. Independent research identified 42,665 exposed instances, of which 93.4% of those actively verified showed authentication bypass conditions. SecurityScorecard’s STRIKE team reported over 135,000 exposed instances across 82 countries in early February, with 15,000 vulnerable to remote code execution. By late March, Censys fingerprinting identified 63,070 live instances — a reduction in exposure rather than a fix to the underlying model.
The supply chain. ClawHub, the skills marketplace, was poisoned at scale. Koi Security’s early-February audit found 341 malicious skills among 2,857 reviewed, including the most-downloaded skill on the platform. The malicious count later exceeded 1,184, with one attacker responsible for 677 uploads, and independent audits found roughly one in twelve packages carrying malicious payloads as the registry passed 13,700 skills. Microsoft Threat Intelligence separately confirmed a supply-chain incident in which an npm package silently installed OpenClaw for approximately eight hours in February.
The institutional response. Microsoft classified OpenClaw as “untrusted code execution with persistent credentials” and stated it is “not appropriate” for standard workstations. Meta banned it from corporate devices. The Dutch Data Protection Authority issued a formal warning. Microsoft, CrowdStrike, Cisco and Palo Alto Networks all published advisories.
What has improved. OpenClaw partnered with VirusTotal to scan ClawHub uploads, with over 3,000 skills analysed. Critical patches have shipped quickly — ClawJacked was fixed within roughly 48 hours of disclosure. Hardened deployment options exist through DigitalOcean’s image and NVIDIA’s NemoClaw stack, which adds sandboxing, filesystem isolation and real-time policy approval.
⚠️ If you run OpenClaw, do these five things. Update to the latest version immediately and keep monitoring advisories. Never expose the gateway to the internet — most incidents traced to gateways running without authentication behind misconfigured reverse proxies. Review the source of every ClawHub skill before installing it. Run it on isolated hardware with no work credentials. And treat prompt injection as an active threat, not a hypothetical one.
OpenClaw’s integration model is unusually broad because it operates at the operating-system level rather than through connectors. Anything with a CLI, an API or a browser interface is reachable.
Messaging platforms — WhatsApp, Telegram, Slack, Discord, Signal — serve as the interface layer, which is a genuinely good design decision: instructions arrive from the phone you already carry rather than another dashboard.
Deployment integrations have matured. DigitalOcean offers a one-click deploy with a hardened security image. NVIDIA’s NemoClaw provides an open-source reference stack orchestrating OpenShell to run OpenClaw with Nemotron models on DGX hardware, adding sandboxed execution, network and filesystem isolation and policy approval for external access. A Kubernetes community operator exists, though ARMO has noted that compromise of a gateway pod could expose cluster service account tokens and adjacent workloads.
OpenClaw itself is free and MIT-licensed. There is no subscription, no seat cost and no tier gating — a genuine outlier in this review series.
| Cost element | What you pay |
|---|---|
| OpenClaw software | $0, MIT licence |
| Cloud model access | Your provider’s API rates |
| Local models via Ollama | $0 beyond hardware and electricity |
| Hosting (recommended) | VPS from a few dollars monthly |
| Hardened deployment | Varies by provider |
The practical cost driver is model usage. Because a single task typically triggers three to eight model calls, an always-on agent with a heartbeat daemon can consume meaningfully more tokens than interactive use. Anyone running it against a paid API should set spending limits before enabling scheduled tasks.
Running local models removes API cost entirely and is the configuration that delivers the strongest privacy argument. The trade-off is hardware: reliable tool use generally needs models of 14 billion parameters or more.
The honest value assessment is unusual here. On price, nothing competes — it is free, open, and yours. On total cost of ownership, add the security work: patching, isolation, skill review and monitoring are not optional, and for a business they represent real hours. That labour, not the software, is what OpenClaw actually costs.
What would it cost your business if this agent were compromised while holding your credentials? That question, rather than the price, should decide whether and how you deploy it.
Claude Code or similar developer agents — narrower scope, vendor-maintained security, and a sandboxed execution model rather than full host permissions.
NVIDIA NemoClaw — worth naming separately: it runs OpenClaw itself but adds sandboxing, isolation and policy approval, which is the sensible route for on-premises enterprise use.
Hosted agent platforms — meaningfully less capable and less private, but with a vendor accountable for security patching rather than you.
n8n or similar self-hosted automation — deterministic workflow automation without an autonomous agent holding your credentials, for cases where you do not need reasoning.
OpenClaw is the most important open-source AI project of 2026, and its significance is not the code. It is the demonstration that a genuinely capable autonomous agent can be free, local and model-agnostic — and that a community can build one faster than any vendor.
It is also the clearest available demonstration of the central unsolved problem in agentic AI. An agent useful enough to act on your behalf must hold the permissions to do so, and those permissions are exactly what an attacker wants. The vulnerabilities disclosed here were mostly ordinary — path traversal, SSRF, command injection — but in a system that browses, executes and remembers, ordinary flaws become severe ones.
The institutional reaction is the part worth watching. When Microsoft classifies a popular open-source tool as untrusted code execution with persistent credentials, and a data protection authority issues a formal warning, the category has moved from enthusiast curiosity to governance question.
The likely trajectory is bifurcation: hardened, sandboxed distributions like NemoClaw for organisations, and the raw project for individuals who accept the risk. Watch whether OpenClaw’s defaults become safe rather than permissive. That single change would resolve most of what this review criticises.
Overall Rating: 6.5 / 10
This score reflects OpenClaw as a business decision, not as an achievement. As an achievement it is remarkable: free, MIT-licensed, genuinely autonomous, genuinely local, and the fastest-growing open-source project in GitHub’s history for good reason.
As something to deploy in a business, the security position is serious. Sixty-plus CVEs, a poisoned skills marketplace, tens of thousands of exposed instances, and explicit warnings from Microsoft, Meta and a European data protection authority are not details to work around — they are the central consideration.
Future Signal recommends OpenClaw only for technically capable users running it on isolated hardware with no sensitive credentials, or for organisations deploying through a hardened stack such as NVIDIA NemoClaw. We do not recommend installing it on a standard work machine.
Is OpenClaw free? Yes. The software is free and MIT-licensed with no subscription or seat costs. You pay only for model access from whichever provider you choose, and nothing at all if you run local models through Ollama.
Is OpenClaw safe to use? Not on a standard work machine. More than 60 CVEs have been disclosed, including critical vulnerabilities rated CVSS 9.9 and 8.8, Microsoft classified it as inappropriate for standard workstations, and Meta banned it from corporate devices. It can be run reasonably safely on isolated hardware by technically competent users who patch promptly.
What was ClawJacked? CVE-2026-25253, rated CVSS 8.8, allowed a malicious website to hijack a local OpenClaw agent through its WebSocket connection with no user interaction, leading to account takeover and code execution. It was reported on 26 January 2026 and patched within roughly 48 hours.
Are ClawHub skills safe to install? Treat them as untrusted code. One audit found 341 malicious skills among 2,857 reviewed, and the total later exceeded 1,184, with roughly one in twelve audited packages carrying malicious payloads. OpenClaw now partners with VirusTotal to scan uploads, which helps but does not catch prompt injection or dynamically loaded content.
Can I run it without sending data to any AI company? Yes, and this is its strongest feature. Running a local model through Ollama means configuration, memory and prompts all stay on your hardware. Reliable multi-step tool use generally requires models of 14 billion parameters or larger.
Who maintains OpenClaw now? It was created by Peter Steinberger, who subsequently announced he was joining OpenAI. The project continues as a community open-source effort under the OpenClaw name, having previously been called Clawdbot and Moltbot.
How much will the API costs be? More than you expect if you enable scheduled tasks. A single agent task typically triggers three to eight model calls, and the heartbeat daemon means it acts without being prompted. Set provider spending limits before switching on autonomous scheduling.
Is there a safer way to run it in a business? Yes. NVIDIA’s NemoClaw reference stack runs OpenClaw with sandboxed execution, network and filesystem isolation and real-time policy approval, and DigitalOcean offers a hardened one-click image. Both are meaningfully safer than a default install.
OpenClaw is the most interesting thing to happen in open-source AI this year. It proved that a genuinely autonomous, local-first, model-agnostic agent could be built by a community rather than a lab, given away under an MIT licence, and adopted faster than any repository in GitHub’s history. The privacy argument is real: run a local model and nothing you say leaves your machine, which no hosted assistant in this series can match.
The security record is equally real and cannot be footnoted. Sixty-plus CVEs including two critical ones, a skills marketplace where roughly one in twelve audited packages carried malicious payloads, tens of thousands of exposed instances, and formal warnings from Microsoft, Meta and the Dutch data protection authority describe a project whose capability outpaced its safety model.
Neither fact cancels the other. The practical conclusion is about deployment rather than adoption: if you want to run it, run it somewhere it cannot hurt you — dedicated hardware, no work credentials, authentication on, gateway off the internet, skills reviewed before installation, and a hardened stack if this is for a business. Do that and OpenClaw is a genuinely powerful assistant that costs nothing. Install it on your laptop because a demo impressed you, and you have handed a continuously running program with your full permissions to code you have not read.
Our final assessment after evaluating features, performance, value, and business impact:
OpenClaw is the most significant open-source AI project of 2026 and simultaneously its most serious security story, and an honest verdict cannot separate the two. The capability is genuine: free, MIT-licensed, model-agnostic, truly local-first, with proactive scheduling that makes it feel like delegation rather than prompting. Run with a local model, it offers privacy no hosted assistant in this series can match.
The security position is equally genuine. Sixty-plus CVEs including CVSS 9.9 and 8.8 criticals, a skills marketplace where roughly one in twelve audited packages carried malicious payloads, and explicit warnings from Microsoft, Meta and a European regulator. Recommended only on isolated hardware, or through a hardened stack such as NemoClaw.
We may earn a commission if you purchase through our links, at no extra cost to you. This helps support independent reviews.
Explore this tool compared with other highly rated AI tools…
Explore other highly rated AI tools we’ve reviewed in this category.
