OpenClaw

Steinberger recalled that he had wanted an AI personal assistant since April 2025 but assumed the major labs would all build one, so he moved on to other projects; by November he was “annoyed that it didn’t exist,” so he prompted it into existence. The project began as a WhatsApp gateway named Warelay (“WhatsApp Relay”); on November 25, 2025, the warelay package was first published on npm, maintained by steipete under the MIT License.⁠[1][1][1][2][3][4][4]

That same month, Steinberger gave the assistant the persona of a space lobster named Clawd, a pun on AnthropicAnthropicAnthropic is an artificial intelligence research and product company founded in 2021 that develops the Claude models, assistant, and tools such as Claude Code, and operates as a public benefit corporation. Dario Amodei and Daniela Amodei are its co-founders, and its research covers model safety, interpretability, and steerability.Open the full entry’s Claude plus “claw.” He said the agent initially had no personality and was as polite as Claude Code, unlike the way friends talk on WhatsApp, so he had it write its own agents.md and give itself a name; the lobster was originally set inside the TARDIS from Doctor Who, because he is a fan of the show.⁠[3][2][1][1][1][1]

On January 4, 2026, the project was published on npm under the name clawdbot. Steinberger said he loved the ClaudeBot domain because it was short and catchy, and that at the time he did not expect the project to become so big. By late January, Clawdbot was one of the hottest open-source projects on GitHub with more than 80,000 stars; through messaging apps such as WhatsApp, Telegram, and Discord, users could run an AI assistant locally with full system access.⁠[5][1][1][6][6]

Anthropic considered “Clawd” too similar to the name of its Claude models and sent Steinberger a trademark claim. He said that just as the project exploded, he received a friendly email from an Anthropic employee asking for a quick name change; he asked for two days, because a rename meant switching the X account, domains, npm packages, Docker registry, and GitHub resources at once, and in the meantime another email arrived saying the lawyers were getting uneasy.⁠[6][6][1][1][1][1]

Early on January 27, the community proposed hundreds of names on Discord and settled on Moltbot, after the molting by which lobsters grow, and the mascot was renamed Molty. Steinberger later said he was not happy with the name and chose it only because he happened to hold that set of domains.⁠[2][2][2][1]

Steinberger renamed the GitHub organization and the X account at the same time, and in the gap between releasing the old handles and securing the new ones, crypto scammers hijacked both accounts and immediately promoted a fake token called CLAWD on SolanaSolanaSolana is a proof-of-stake (PoS) public blockchain designed for high throughput and low latency, with SOL as its native token; it was developed by Solana Labs and launched Mainnet Beta in March 2020. It is known for design choices such as its Proof of History clock and parallel execution, suffered several network-wide outages in its early years, and became one of the crypto industry’s focal points in events including the FTX collapse, U.S. SEC lawsuits, and the listing of Solana ETFs.Open the full entry, whose market capitalization was driven above $16 million within hours before it collapsed. He recalled that the account name was stolen in the five seconds it took to click rename between two browser windows; in the panic he also accidentally renamed his own personal GitHub account, which was immediately sniped and used to serve malware, and the root npm package was sniped as well; friends at X and GitHub later helped him recover them.⁠[6][6][6][1][1][1][1][1]

Steinberger denied any involvement with the token and asked the crypto community on X to stop harassing him, saying he would “never do a coin,” that any project listing him as coin owner was a scam, and that he would not accept fees. Some speculators blamed their losses on his denial and launched harassment campaigns against him. He later said it was the worst online harassment he had ever experienced and that he came close to deleting the entire project, refraining only out of consideration for the contributors who had already invested their time.⁠[6][6][6][1][1][1]

During the renaming turmoil, security researchers pointed out that hundreds of Clawdbot instances were exposed on the public internet with no authentication at all. AI developer Luis Catacora used Shodan scans to find gateways on port 18789 accessible without authentication, meaning shell access, browser automation, and API keys were exposed; Jamieson O’Reilly, founder of the red-teaming company Dvuln, said that of the instances he examined manually, eight had no authentication at all. The problem was that the authentication system automatically approved connections from the local machine, while most users ran it behind a reverse proxy, so all connections appeared to come from 127.0.0.1 and were automatically authorized; the blockchain security firm SlowMist also issued an alert, saying hundreds of API keys and private chat logs were at risk.⁠[6][6][6][6][6][6][6][6][6]

Steinberger responded that many of the early reports involved users putting the web backend on the public internet, something he repeatedly warned against in the docs, since it was only a localhost debug interface; but because the configuration allowed it, such cases were classified as remote code execution. He also argued that as long as users made sure they were the only person talking to the agent and kept it on a private network as he recommended, the risk would be greatly reduced.⁠[1][1][1][1][1]

On January 29, 2026, Steinberger announced that the project would be named OpenClaw, combining “Open” and the lobster’s “Claw,” and said that this time trademark searches had been completed, domains purchased, and migration code written; by then the project had more than 100,000 GitHub stars and 2 million visitors in a single week. He said that before settling on the name he even called Sam AltmanSam AltmanSam Altman is an entrepreneur and investor, and the co-founder and chief executive officer of OpenAI. He previously served as president of Y Combinator and founded the location-based social service Loopt. He also helped found Tools for Humanity and Merge Labs, has invested in energy and life sciences ventures, and has driven public discussion of AI governance, employment, and wealth distribution.Open the full entry to ask whether the name OpenClaw was okay.⁠[3][3][3][3][1]

On January 30, the team completed the migration within three hours: the GitHub repository became openclaw/openclaw, the X handle @openclaw was secured with a gold checkmark, npm packages were released under the new name, and the docs moved to docs.openclaw.ai. Within minutes, someone launched a scam token, $OPENCLAW, on Pump.fun using artwork published just 20 minutes earlier. The release shipped with the new name added Twitch and Google Chat channel plugins, support for models such as Kimi K2.5, and 34 security-related commits; Steinberger cautioned that prompt injection remained an industry-wide unsolved problem and that users should use strong models and follow security best practices.⁠[2][2][2][3][3][3]

The U.S. National Vulnerability Database listed CVE-2026-25253: OpenClaw versions before 2026.1.29 obtained a gatewayUrl value from the query string and automatically made a WebSocket connection without prompting, sending a token, with a CVSS 3.1 score of 8.8 (high). The flaw was discovered by Mav Levin, founding security researcher at depthfirst, who said it could be chained into a one-click remote code execution attack that compromised a victim within milliseconds of visiting a single malicious web page; he also noted that the sandbox and safety guardrails were designed to contain malicious actions of a model after prompt injection, and that users might think they would protect against this vulnerability, but they did not.⁠[7][7][8][8][8][8]

The vulnerability was fixed in version 2026.1.29, released on January 30, 2026. In his security advisory, Steinberger explained that the Control UI trusted gatewayUrl from the query string without validation, so clicking a crafted link or visiting a malicious site could send the token to an attacker, who could then connect to the victim’s local gateway, modify sandbox and tool policies, and invoke privileged actions; it was exploitable even when the gateway listened only on the loopback address, because the victim’s browser initiated the outbound connection.⁠[8][8][8][8][8]

ClawHub is a marketplace that makes it easy for OpenClaw users to find and install third-party skills. The security firm Koi Security audited 2,857 skills there and found 341 malicious ones, 335 of which used fake “prerequisites” to lure users into installing the macOS stealer Atomic Stealer, a campaign named ClawHavoc; the malicious skills masqueraded as ClawHub typosquats, Solana wallet trackers, PolymarketPolymarketPolymarket is a prediction market platform founded by Shayne Coplan in 2020, on which users buy and sell shares in the outcomes of political, sports, financial, cultural, and other events, with trading prices regarded as the market’s estimate of the probability that an event will occur. It rose to prominence during the 2024 US election, returned to the US market in 2025 by acquiring a licensed exchange and clearinghouse, and received a major investment from Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange, while facing gambling-regulation and insider-trading scrutiny in US states and several countries.Open the full entry trading bots, YouTubeYouTubeYouTube is Google’s video-sharing and creator platform, founded in 2005 by Steve Chen, Chad Hurley, and Jawed Karim and acquired by Google in 2006. Built around video uploading, viewing, and creator earnings, the platform has developed Shorts, YouTube Music, Premium, YouTube TV, and products for children, and is headquartered in San Bruno, California, United States.Open the full entry tools, auto-updaters, and more. At the time ClawHub was open to uploads by default, and the only restriction was that a publisher’s GitHub account had to be at least one week old.⁠[9][9][9][9][9][9][9]

Palo Alto Networks had earlier warned that OpenClaw combined access to private data, exposure to untrusted content, and the ability to communicate externally, what British programmer Simon Willison calls the “lethal trifecta,” and that with persistent memory an attack could be split into seemingly benign inputs written into long-term memory and assembled for execution later. In response to the malicious skills, Steinberger rolled out a reporting feature: signed-in users can report a skill, and skills reported by more than three unique users are hidden by default.⁠[9][9][9][9][9]

China’s Ministry of Industry and Information Technology warned that improperly configured OpenClaw deployments could pose significant security risks and expose users to cyberattacks and data breaches; the ministry said it had found users running OpenClaw with inadequate security settings and called on deploying organizations to thoroughly audit public network exposure and implement identity authentication and access controls. The warning did not constitute a ban. OpenClaw was then growing in popularity among Chinese technology enthusiasts, and cloud providers including Alibaba Cloud, Tencent Cloud, and Baidu launched services letting users rent servers to run OpenClaw remotely. In the same week, Moltbook, a social network advertised as exclusively for OpenClaw bots, drew attention, and the security firm Wiz said it had a major flaw that exposed private data on thousands of people.⁠[10][10][10][10][10][10][10][10][10]

OpenClaw announced a partnership with Google’s VirusTotal: skills published to ClawHub are bundled and given a SHA-256 hash, checked against VirusTotal, and analyzed by its Code Insight (powered by Gemini) for what the code actually does; skills judged benign are approved automatically, suspicious ones are marked with a warning, malicious ones are instantly blocked from download, and all active skills are rescanned daily. The announcement also acknowledged that this was not a silver bullet, since a skill that uses natural language to instruct an agent to do something malicious, or a carefully crafted prompt injection, would not trigger a virus signature. The project also brought on Dvuln founder Jamieson O’Reilly as lead security advisor.⁠[11][1][11][11][11][11][11][11][11]

On February 14, Steinberger announced that he was joining OpenAI to work on bringing agents to everyone, and that OpenClaw would move to a foundation and remain open and independent; he wrote that OpenAI had made strong commitments enabling him to dedicate his time to the project and already sponsored it. The next day, OpenAI CEO Sam Altman announced the news on X, saying OpenClaw would live in a foundation as an open source project that OpenAI would continue to support.⁠[12][12][13]

Thirty-eight researchers including Natalie Shapira and David Bau published “Agents of Chaos” on arXiv: twenty AI researchers interacted over two weeks with autonomous agents deployed in a laboratory environment and documented eleven representative cases, including compliance with non-owners’ instructions, disclosure of sensitive information, destructive system-level actions, denial of service, identity spoofing, and partial system takeover, and in some cases agents reported task completion while the system state contradicted them. The study ran its agents on OpenClaw, and the report stated that, in contrast to the default settings, the agents were given unrestricted shell access (with sudo permissions in some cases) and no tool restrictions, and that the setup did not implement OpenClaw’s security recommendations.⁠[14][14][14][14][14][14][14][14][15][15][15]

Steinberger responded that the paper was the loudest example of an incentive problem: the researchers disabled guardrails in sudo mode, granted broad shell access, and used no sandboxing, yet wrote it up as if this were what users get out of the box; the paper later added a brief acknowledgment that guardrails had been disabled, but the headlines did not change. He said OpenClaw is designed for one trusted person per agent, and that sharing an agent with people one does not trust means sharing its tool access; groups or companies should split agents and credentials by trust boundary and turn on sandboxing.⁠[16][16][16][16][16]

Steinberger published a review of the project’s security work, opening with the remark that “a lot of people screamed it was so insecure.” As of April 30, GitHub showed 1,309 security advisories received since January 10, of which 535 were published and 746 closed as invalid; 109 were marked critical, of which only 14 were published and 95 were judged invalid. He said that nothing able to run tools, hold credentials, and install plugins is safe by default, but that the project had fixed real problems such as authentication bugs, privilege confusion, and sandbox bypasses, moved more functionality out of the core into plugins, changed releases so that he and another foundation employee sign off on them, and added checks such as CodeQL, Semgrep, and Codex Security; over the previous month the team had handled more than 700 ClawHub moderation issues.⁠[16][16][16][16][16][16][16][16][16]

After the 2026.4.24 through 2026.4.29 releases, users saw gateways slow down, plugin dependency repair get stuck in loops, and channels such as Discord, Telegram, and WhatsApp misbehave, and many were forced to downgrade. Steinberger apologized, saying the trouble came from ending up in “the worst middle state” while moving functionality out of the core, and that it also exposed that the project was still too founder-driven, with too much release, review, packaging, and support work resting on him; he announced that the core would keep shrinking, optional features would move to ClawHub, and a long-term support (LTS) release would be offered separately.⁠[17][17][17][17][17][17]

The project acknowledged that ClawHub was targeted immediately after its launch alongside OpenClaw by actors trying to publish skills bundling known malware. Starting in June, every skill on ClawHub comes with a Skill Card describing its purpose and origin and is scanned by NVIDIA’s SkillSpector for hidden instructions and agentic risks.⁠[18][18]

OpenClaw launched dedicated iOS and Android apps; after pairing a phone with their own OpenClaw gateway, users can chat with the assistant, hold real-time voice conversations, and, once permitted, let it use the camera, screen, photos, contacts, calendar, and reminders. The Android version drew criticism after launch: 9to5Google first pointed out that it looked more like a vibe coding experiment than a finished product, with sparse menus and unnamed tabs; shortly after launch it was rated only 2.2 stars, with user reviews calling it “unusable” and “the worst app I have ever used in my life,” and the problems largely stemmed from failures to connect and pair with the gateway. As of October 14, 2026, the app had a 2.4-star rating on Google PlayGoogle PlayGoogle Play is a digital content distribution service operated by Google, centered on the Google Play Store, the app store for Android devices. Its predecessor, Android Market, launched in October 2008 alongside the first Android phone, and in March 2012 it merged with Google Music and the Google eBookstore and was renamed Google Play. As the main distribution channel for Android apps, its commissions, billing rules, and review practices have drawn controversy, including the Epic Games antitrust lawsuit in the United States and penalties under the European Union’s Digital Markets Act.Open the full entry (294 reviews) and more than 100,000 downloads.⁠[19][19][19][19][19][19][19][19][20]

Dave Morin and Steinberger jointly announced that OpenClaw had officially become a U.S. 501(c)(3) nonprofit organization, aiming to keep OpenClaw MIT-licensed, open, and independent; Steinberger continues to lead the project, especially technical decisions, while the foundation handles governance, stable funding, and paying maintainers. The foundation hired a full-time team for the first time, with Vincent Koc as chief architect. Major donors include Offline Holdings, Lobster Computer Company, the University of Michigan, and OpenAI; the University of Michigan is the largest donor and launched the Institute for Agentic Computing as an academic home for OpenClaw.⁠[21][21][21][21][21][21][21][21]

Among the partners listed in the announcement, OpenAI provides inference and Codex Security and set up a team inside the company called Claw Labs, led by Steinberger; NVIDIA launched NemoClaw at its GTC conference, which installs OpenClaw and Nemotron models with a single command, and Jensen Huang said at the event that “every company in the world today needs to have an OpenClaw strategy”; Microsoft announced Microsoft Scout, built on OpenClaw open-source technology, at Build; and Tencent added full-time maintainers for security, stability, and ClawHub. The foundation said its community event series ClawCon had held 34 events in 16 countries within five months.⁠[21][21][21][21][21][21][21]

OpenClaw released version 2.0, the largest update in the project’s history, built by 933 contributors, 569 of them first-time contributors, and comprising more than 16,000 pull requests across installation, messaging, memory, skills, models, automations, the browser and native apps, plugins, and security. The project had previously shipped 106 releases in 230 days, and this time went nearly seven weeks without a release to make sure both new installs and upgrades worked properly.⁠[22][22][22][22][22]

OpenClaw published the results of a Trail of Bits security audit conducted through OpenAI’s Patch the Planet initiative: Trail of Bits submitted 27 private advisories and 3 standalone hardening pull requests, 24 of the advisories describing severity-rated vulnerabilities, rated 0 critical, 2 high, 16 medium, and 6 low; the most common problem was requests losing their permission limits as they passed between steps. The project said every actionable issue had been repaired and shipped in the 2026.8.1 and 2026.7.33 LTS stable releases.⁠[23][23][23][23][23][23]

Microsoft introduced Autopilot, a persistent, proactive personal agent in its new Copilot experience whose foundation is OpenClaw; Autopilot is the new name for Microsoft Scout, announced earlier that year. Omar Shahine, who leads the product, said the team was working with Steinberger and the OpenClaw Foundation to make OpenClaw an enterprise-grade runtime, and Microsoft also committed to contributing features such as policy conformance directly upstream.⁠[24][24][24][24]

The foundation released OpenClaw Enterprise, an open-source, vendor-neutral platform for managing persistent agents in sensitive environments, offering multi-tenancy, hard security boundaries, and governance and auditing across the agent lifecycle. The announcement acknowledged that organizations broadly believe a stronger security and governance standard is needed before agents can be fully adopted, so the default stance of IT departments in most organizations is to ban agent platforms like OpenClaw outright. On October 2, Tencent’s AI-Infra-Guard was integrated into ClawScan, ClawHub’s review tool, so every uploaded skill and plugin is scanned separately by it and by NVIDIA SkillSpector before an AI judge makes a final assessment.⁠[25][25][25][25][26][26][26]

On October 3, 2026, Steinberger posted on X: “Do I know anyone at Google who could help? We’re now over a week in review limbo for OpenClaw’s Android app.” About half an hour later, Google and Alphabet CEO Sundar Pichai replied under the post: “Ack, will follow up.” What was stuck was an update to the already published app; Google did not publicly explain why the review was delayed. The app requests permissions for the camera, microphone, precise location, reading and writing contacts and calendars, and declares a service that reads notifications. The app’s update date on Google Play is October 4.⁠[27][27][28][28][29][29][30][30][30][30][30][30][20]

OpenClaw runs on the user’s own computer and connects to more than 20 chat channels, including Discord, iMessage, Slack, Teams, Telegram, and WhatsApp, with native apps for macOS, iOS, Android, Windows, and Linux; the same gateway can serve as a personal assistant on a laptop or as a shared team deployment. State, memory, and credentials are stored on the user’s hardware, and models and agent harnesses such as Claude, Codex, and local models plug in as swappable plugins; by default, OpenClaw itself only performs a daily version check, and anonymous feature statistics must be enabled by the user. The project has no paid tier, hosted service, or token.⁠[31][31][31][31][31]

The agent’s identity, instructions, and memory are stored as Markdown files, such as SOUL.md defining its personality, long-term memory in memory/*.md, and operating instructions in AGENTS.md; the mascot is a space lobster named Molty. The project advises treating inbound messages as untrusted input; unless sandboxing is configured, tools for the main session run directly on the host, and users should read the security guide before connecting other users or exposing the gateway remotely.⁠[2][31][31][31][31]

As of October 2026, the foundation employs the core team and signs releases; donors include Amazon, Lobster Computer Company, Offline Holdings, OpenAI, Red Hat, and the University of Michigan, with infrastructure support from Blacksmith, Convex, GitHub, NVIDIA, and Vercel; the project states that neither donors nor sponsors own or direct it, and that OpenAI is a donor rather than an owner. On October 13, 2026, openclaw version 2026.10.3 was released on npm.⁠[31][31][31][32]

OpenClaw: Official website: https://openclaw.ai/ (opens in a new window).⁠[33][34]

OpenClaw Foundation: Official website: https://openclaw.org/ (opens in a new window).⁠[31][35]

Code repository: https://github.com/openclaw/openclaw (opens in a new window)⁠[2]

X: Public account: https://x.com/openclaw (opens in a new window)⁠[2]