What is OpenClaw? The self-hosted AI agent that lives in your chats

OpenClaw is an open-source program you run on your own machine that puts an AI agent inside the chat apps you already use. You message it on Telegram. On the other end, a model reads what you sent, runs commands on that machine, edits files, calls APIs, and answers you in the same thread a few seconds later.

We run OpenClaw in production, so this page is written from operating it rather than from reading about it. Everything below was checked on September 15, 2026 against version 2026.9.2. The current npm release is 2026.9.4, published September 11. Sources for every claim are listed at the end, and the project ships fast enough that you should treat the numbers as dated and the shapes as durable.

What it is

An agent that acts for you needs three things: a model to think with, tools to act with, and a way for you to reach it. OpenClaw is the piece in the middle that holds all three together and keeps running after you close your laptop. Its own documentation describes it as a gateway for AI agents across Discord, Google Chat, iMessage, Matrix, Microsoft Teams, Signal, Slack, Telegram, WhatsApp, and Zalo.

It ships no model of its own. You point it at Anthropic, OpenAI, Google, OpenRouter, or a local runtime like Ollama or vLLM, and OpenClaw supplies everything around the model: the channel connections, the credentials, the tool execution, the scheduling, and the state that carries from one message to the next. The code is MIT licensed, written mostly in TypeScript with a Swift app for Apple platforms (Wikipedia).

This is the software underneath most of what people mean when they say they want an AI agent for their business, which is why it is the first subject in this knowledge base.

Where it differs from a hosted assistant

Three properties separate this from ChatGPT or Claude.ai.

It runs on hardware you control. The process lives on your laptop, your Mac mini, or a cheap VPS. Your API keys sit in a config file you own. Conversation history is a SQLite database on your disk. Nobody else's terms of service govern what your agent is allowed to remember.

It acts on the machine. Depending on the tool policy you configure, the agent runs shell commands, reads and writes files, drives a browser, generates images, and calls any API you hand it. It does the thing rather than describing how you could do the thing.

It starts conversations. The agent can run on a schedule, react to events, and message you first. That inverts how you use software: you stop opening an app to do the work, and the work arrives in your chat. It is also the line between a workflow that waits to be triggered and a system that decides when to act, which we wrote about separately in automation versus autonomy.

The cost of all three is the same cost. An assistant that holds your credentials, reads your mail, and runs commands on real computers deserves more scrutiny than anything else you have installed. OpenClaw's own docs make that argument at length in Why OpenClaw, which is the right instinct and a good sign about the people building it.

It is ten months old

Peter Steinberger, an Austrian developer best known for PSPDFKit, published the first version on November 24, 2025, under the name Warelay. He renamed it CLAWDIS nine days later, Clawdbot on January 2, Moltbot on January 27 after trademark complaints from Anthropic, and OpenClaw on January 30 (Wikipedia). Five names in nine weeks tells you the speed better than any adoption chart.

The chart is still worth a look. Wikipedia recorded 247,000 GitHub stars on March 2, 2026. The GitHub API returned 389,776 stars, 81,935 forks, and 7,419 open issues on September 15, with the most recent push landing that same afternoon. Roughly 143,000 stars in six months, on a repository that did not exist last Thanksgiving.

Steinberger announced he was joining OpenAI on February 14, 2026 and handed the project to the OpenClaw Foundation, an independent 501(c)(3) formally introduced on July 8. Version 2.0 shipped on August 30 with 933 contributors behind it, 569 of them first-timers, and more than 16,000 pull requests merged, which the Foundation says is about half of every PR ever merged into the project.

That history matters for a practical reason. Software this young, moving this fast, with this many hands in it, is worth adopting for what it does today and not for what its documentation implies it will do next quarter.

The shape of the system

The architecture documentation is the primary source for this section, and the shape is simpler than the page count suggests.

One long-lived process called the Gateway owns everything. There is exactly one per host. It holds the connection to Telegram, to Slack, to whatever else you configured, and nothing else is permitted to hold one.

Everything else you might think of as OpenClaw is just something connected to that process. The command-line tool, the browser dashboard, the Mac app, a paired phone, a scheduled job: all of them are windows onto the one Gateway, and none of them hold your credentials themselves.

That design explains the first thing that confuses new operators. The Gateway only listens to its own machine. By default nothing outside that computer can reach it at all, and it refuses to open up until you have configured a way to prove who is connecting. Getting at your agent from your phone or your office means running a private network like Tailscale, or tunneling in over SSH. Putting it directly on the public internet is not a supported setup, and that restriction is doing you a favor.

Inside the Gateway, three concepts do the work.

An agent is a configured identity with its own workspace directory, model, session history, and tool policy. One Gateway can run several, and they do not share memory.

A channel is how a human reaches an agent. Telegram and the built-in web chat ship with the core install. Discord, Slack, Signal, WhatsApp, iMessage, Matrix, Microsoft Teams, Google Chat, and Zalo arrive as plugins.

A node is a paired device, usually a phone or a second computer, that the agent can run work on or read sensors from. Nodes connect to the same WebSocket server with device-based pairing and expose commands like camera capture, screen recording, and location.

What an agent actually is

Most people expect an agent to be code that a developer writes and only a developer can change. In OpenClaw it is a folder of plain text files that anyone can open and read.

A fresh install creates a workspace at ~/.openclaw/workspace holding AGENTS.md for operating instructions, SOUL.md for personality and tone, IDENTITY.md for who the agent is, and USER.md for who you are. An optional MEMORY.md holds durable facts. At the start of every session the runtime reads those files and injects them into the model's prompt before the agent has done anything at all.

So you configure behavior by writing English into a text file, and you version it with git. The docs recommend making that workspace a private git repository. Do that on day one.

Skills work the same way. A skill is a directory containing a SKILL.md with metadata and instructions, resolved bundled first, then global, then workspace, with the workspace copy winning. A procedure you want followed the same way every time belongs in a skill rather than in a prompt you retype. Every agent we deploy ships with its instruction set in that format, readable and editable by the client, because a behavior you cannot open in a text editor is a behavior you cannot correct.

Here is the part worth internalizing. Every time you message the agent, it reads those files, pulls up what it remembers, answers you, and then forgets everything that was not written down. There is no mind humming along between your messages. An agent that feels like it knows you is an agent whose files were written well. That single fact separates a useful deployment from an expensive novelty, and it gets its own page in this knowledge base.

What it is good at

Meeting you where you already are. The interface is the messaging app on your phone, not another browser tab you forget to open.

Breadth. More than ten chat apps, most of the major model providers plus local models, a plugin system, connectors for outside tools, scheduled jobs, and triggers that fire on events. Most of what you would otherwise pay someone to build already ships in the box and only needs configuring.

Persistence. Config and history live on your disk, so behavior carries across sessions. This is the piece that makes it a personal agent instead of a stateless chat window.

One product across the whole range. The docs are explicit that there is no enterprise edition. The same binary runs as a one-laptop assistant or a hardened team deployment, and configuration is the only difference between them.

Ownership. MIT license, 501(c)(3) steward, your hardware. The Foundation puts it as "AI that runs on your hardware, knows your context, and works for you. Not a product you rent from a platform."

The documented commercial uses are mundane and real: small businesses and freelancers running lead generation, prospect research, website auditing, and CRM integration. Tencent and Z.ai have both announced OpenClaw-based services, and Chinese developers adapted it for DeepSeek and WeChat (Wikipedia). Nothing on that list is exotic. It is the same work we ship as scheduled reporting and internal knowledge search, with a chat thread as the interface instead of a dashboard.

What it is not good at

The most credible criticism of OpenClaw comes from OpenClaw.

The project publishes a maturity scorecard that walks 50 parts of the product and grades each one. The overall mark is 68 percent, Alpha. The lowest number in it is feature coverage at 16 percent, which is their way of saying most of what they intend to build is not built yet.

A handful of pieces are rated stable enough to depend on: the command-line tool, the core Gateway, Linux and Mac as host machines, Discord, and the phone apps. The parts most businesses would actually lean on sit one rung lower, at Beta, including Telegram, Slack, WhatsApp, and the memory system. Image and video generation, plus running your own local model, are at the bottom rung.

Read that the way you would read a vendor telling you their product is in beta, because that is precisely what it is. The difference is that this vendor published the grade themselves, which almost nobody does.

The project also keeps a page titled "What we do not claim", which is the most useful thing on their entire documentation site. Here is what those five admissions mean for a business that installs this:

It will run commands on your machine without asking. Out of the box, there is no approval prompt and no isolation. Whatever the agent decides to do, it does, with your user account's permissions. You can lock this down by running it inside a container, and you should, but that is a deliberate step somebody has to take on day one. Nobody is going to make you.

One installation means one circle of trust. Everyone who can message the agent gets the same agent, with the same access to the same files and credentials. There is no built-in way to give your bookkeeper a limited version and your operations lead a fuller one. Separate people with separate access means separate installations on separate machines, which multiplies what you are maintaining.

Add-ons run with the same power as the core. A plugin you install is not fenced off from anything. It inherits everything the agent can reach, so installing one from a stranger is the same decision as handing that stranger your laptop.

Blocking outbound connections only stops software that agrees to be stopped. You can give the agent a list of approved destinations, and well-behaved code will respect it. A malicious skill that opens its own connection is not asking permission, which is exactly what Cisco found below.

Anything it decides to remember, it remembers forever. There is no expiry on facts the agent promotes into long-term memory. If it writes down a client's phone number today, that note is still sitting there next year unless a human goes and removes it. For anyone with a data retention policy, that is a policy you now have to enforce by hand.

None of this makes the software unsafe to use. It makes it software that assumes a competent operator, which is a real cost and belongs in the budget next to the token bill.

The outside verdicts line up with that. The Register reviewed 2.0 and concluded the release "is doing a lot to make installing and getting OpenClaw up and running for more people, but it's not bringing security by default along with that accessibility," flagging that Secret Store values are not encrypted at rest and that the sandbox stays off unless you enable it.

Cisco's AI Threat and Security Research team went further and ran a scanner over a popular third-party skill called "What Would Elon Do?" It turned up nine findings, two critical and five high. The skill told the agent to run a curl command shipping data to a server the skill author controlled, silently, and used a direct prompt injection to talk the assistant past its own safety rules first. Cisco's own word for the category was malware. The wider number in the research they cite is worse: of 31,000 agent skills analyzed, 26 percent contained at least one vulnerability.

Governments reacted too. In March 2026, Chinese authorities restricted state agencies, state-owned enterprises, and banks from running it. Satya Nadella called it virus-like in February, and by May Microsoft was internally testing an OpenClaw-based desktop under the name Project Lobster (Wikipedia).

One maintainer's summary on Discord is the most useful sentence written about the project: "if you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."

Underneath every one of these incidents is the same problem, and it has a name: prompt injection. Your agent reads text you did not write, from an email, a web page, a customer message, and somewhere in that text is an instruction aimed at the agent rather than at you. Because the agent cannot reliably tell your instructions from a stranger's, text becomes action. Telling the agent to be careful in its instructions does not fix this. A determined attacker is writing instructions too.

OpenClaw's answer is the right one on paper: put the rules in code the agent cannot argue with, keep credentials in the Gateway where the model never touches them directly, and run risky work somewhere disposable. On paper is the operative phrase. By their own scorecard, that work is not done.

For a business, the practical version is short. Do not connect an agent to a channel strangers can write into until you have isolated it, and keep it away from anything you would not want executed by someone impersonating you in an email.

What it costs to run

The install is one command on macOS, Linux, or WSL2:

curl -fsSL https://openclaw.ai/install.sh | bash

The installer provisions a Node runtime if you do not have a supported one, then opens a wizard that walks through picking a model provider and connecting a first channel. If you manage Node yourself, npm install -g openclaw@latest does the same job. The version we run requires Node 22.22.3 or later, 24.15 or later, or 25.9 or later.

Costs come from two places, and neither is the software. The software is free. You pay for model tokens from whichever provider you point it at, and you pay for the machine you keep it running on. A small VPS is enough for a single agent doing personal work, which is also how we set clients up: their own box, their own provider keys, no middleman on the token bill.

Watch the heartbeat setting. A fresh install checks in every 30 minutes, and every check-in is a model call you pay for whether or not anything happened. Set it to 0m while you are evaluating, then turn it on once you know what you want it doing with its time.

Where it is headed

Three threads are worth tracking, all of them from the Foundation's own writing rather than from the third-party sites that rank for "OpenClaw roadmap" and commit to nothing.

Governance. The Foundation runs on donations and partnerships from more than thirty organizations, including Atlassian, GitHub, Microsoft, NVIDIA, OpenAI, and Tencent, and signs releases under its own identity. Its stated ambition is to be "the Switzerland of AI," neutral ground that works with every model and every lab.

Stability. Alongside the scorecard, the Foundation introduced an extended-stable release channel so people can pin critical workloads instead of riding the weekly train. As of September 15 that channel sits at 2026.6.35 while latest is on 2026.9.4, which tells you how much moves between them.

Security. The May 2026 post "Where OpenClaw Security Is Heading" is the most concrete forward-looking document the project has published, and four of its commitments answer the gaps above directly. Plugins get a fenced-off view of the filesystem, and a plugin caught climbing out of the fence gets marked down for it. The skill directory gets tiers, so official and vetted publishers are distinguishable from anonymous ones, with known-bad skills blocked at install. Outbound traffic gets routed through a checkpoint the agent cannot talk around, which closes the loophole in the fourth admission above. And the loose files holding conversation history and scheduled jobs move into a proper database.

The fifth commitment is the one we would watch most closely. They call it contextual approval, and the reasoning behind it is the sharpest paragraph in the document: approval prompts that arrive faster than anyone can read them teach people to stop reading and turn the prompts off entirely. Anyone who has clicked through a permissions dialog to get on with their day already knows this. A security control that annoys its user is a security control that gets disabled, and the project is one of the few saying so out loud.

The 2.0 release pointed at easier onboarding, the browser app as the front door, and shared cloud sessions that let you hand a running task to a teammate with its context intact.

How we see it being useful

Two things decide whether an OpenClaw deployment is still useful in six months, and neither one is which model you picked.

The files are the product. A model with no memory is a brilliant stranger every morning. The workspace files, the memory discipline, and the skills are what turn it into a coworker who knows what you are working on. Most of the work in a good deployment is writing and pruning those files.

Put it on a server, not a laptop. An agent that only runs when your laptop is open is a toy. An agent on a machine that never sleeps can check in, watch for events, and finish work while you are asleep, which is the entire point of the proactive behavior and the reason every deployment we do starts with a VPS.

The ownership argument holds up under load too. We replaced the hosted search provider behind our agent's web search tool with a search stack running on our own machine, and nothing above that layer had to change. That is what owning the runtime buys you in practice: swapping out a dependency without asking anyone's permission.

Should you run this yourself

The maintainer's line about the command line is the honest filter, so take it literally. If you are comfortable on a server, run this yourself. The install is one command, the configuration is text files you can open and read, and nothing in this article is knowledge we are holding back. Give it a weekend, keep it off any channel a stranger can write into until you have it isolated, and turn the heartbeat down while you are still learning what you want from it. The pages beneath this one go deeper on the parts that decide whether a deployment survives its first six months, and they land in the knowledge base as we write them.

The other case is a business that wants what an agent does and has no interest in becoming its operator. There the install is the cheap part. The cost is everything after it: the workspace files that decide whether the thing is useful in March, the memory discipline that keeps it from either forgetting your business or remembering a client's phone number forever, the sandboxing that stays off until somebody deliberately turns it on, and the call about which of your systems an agent should never be allowed to touch. None of that comes in the box, and getting it wrong is not a bug report, it is a Tuesday you spend explaining something to a client.

Where we come in

That second case is the work we do. We deploy the agent on your own machine under your own provider keys, write the instruction and memory files that decide how it behaves, set the boundaries around what it is allowed to reach, and keep it working as the project changes underneath it. You own the machine and the token bill, so there is no middleman to keep paying to keep your agent running.

Tell us what you are trying to automate and we will tell you whether an agent is the right shape for it, including when the answer is that it is not.

Sources

All checked September 15, 2026, against OpenClaw 2026.9.2.

The project's own material

• OpenClaw documentation, 734 pages in the version we run, including architecture, channels, nodes, skills, install, and heartbeat
• Why OpenClaw, source of the "What we do not claim" list
• Maturity scorecard, source of the 68 percent Alpha grade
• openclaw/openclaw on GitHub, source of the star, fork, and issue counts
• Foundation blog: Introducing the OpenClaw Foundation, Extended-stable releases and maturity scorecards, Where OpenClaw Security Is Heading, OpenClaw 2.0

Outside the project

• OpenClaw on Wikipedia, source of the naming history, the March 2026 Chinese restrictions, the Nadella quote, and the maintainer's Discord quote
• The Register, "OpenClaw 2.0 pours glitter on slow-burning security dumpster fire", August 31, 2026
• Cisco, "Personal AI Agents like OpenClaw Are a Security Nightmare", source of the Skill Scanner findings
• Security analysis of 31,000 agent skills, source of the 26 percent vulnerability figure

Version numbers and counts were read from the running install, the npm registry, and the GitHub API on the date above. Anything version-shaped in this article should be re-checked before you rely on it.