OpenClaw: The Open-Source AI Agent That Promises Everything - But How Secure Is It Really?

In just three weeks, OpenClaw grew from a hobby project into one of the most discussed AI tools in the world. With more than 234,000 GitHub stars, hundreds of thousands of users, and a creator personally recruited by Sam Altman to join OpenAI, the story seems almost too good to be true. And perhaps, in part, it is. In this article, we dive deep into exactly what OpenClaw is, what it can do, and why security experts worldwide are sounding the alarm.

What is OpenClaw?

OpenClaw is a free, open-source AI agent developed by Austrian developer Peter Steinberger. Unlike regular chatbots that only generate text, OpenClaw actually performs tasks on your computer. Think of reading and responding to emails, managing your calendar, executing terminal commands, controlling your smart home, or deploying code-all via a chat interface in apps like Signal, Telegram, WhatsApp, or Discord.

The project began in November 2025 under the name Clawdbot, a wordplay on "Claude," the AI model from Anthropic. Following a friendly request from Anthropic's legal department, a name change to Moltbot followed, and eventually to OpenClaw. The name refers to the molting process of lobsters: growing by shedding your old shell.

Technically, OpenClaw runs as a long-running Node.js process (the so-called Gateway) on your own hardware. You link your own API key-from Anthropic, OpenAI, Google Gemini, or DeepSeek-and everything runs locally. Memory is stored as Markdown files on your disk, meaning your data, in principle, never leaves your device.

How does it work in practice?

The power of OpenClaw lies in three pillars: computer access, persistent memory, and the so-called heartbeat system.

Through the skills system, you can give the agent new capabilities. A skill is essentially a Markdown file containing instructions for specific behavior: from performing a security audit to managing your Spotify playlist. On ClawHub, the official skills marketplace, more than 5,700 community-built skills are now available. What makes the system unique is that OpenClaw can also write new skills itself based on your requests. Thus, the agent learns along with you.

The memory system operates on multiple layers. There is a daily log read into every session, and a curated long-term memory for recurring preferences and workflows. When a session nears the context limit, OpenClaw automatically triggers a compaction procedure: the model first writes out important memories before older information is removed. This ensures as little context as possible is lost.

The advantages: Why OpenClaw is impressive

Privacy and control. OpenClaw's biggest selling point is its privacy-first approach. Because everything runs locally and you decide which models, skills, and permissions to enable, you maintain maximum control over your data. For those concerned about the data hunger of big tech companies, this is a refreshing alternative.

Real tasks, not just text. Where most AI assistants stop at generating answers, OpenClaw goes a step further. It can move files, visit websites, run scripts, and send messages-across more than fifty platforms. This makes it a potentially powerful automation tool for developers and IT professionals.

Open-source and no subscription. There are no monthly costs associated with OpenClaw itself. You only pay for the API usage of the underlying language model. For light usage, most users sit comfortably below thirty euros per month.

A vibrant community. The growth of the ecosystem is impressive. By early February 2026, the GitHub project counted 140,000 stars and 20,000 forks. Additionally, entrepreneur Matt Schlicht launched Moltbook-a kind of social network for AI agents, described by some as "Reddit for bots." On Moltbook, AI agents communicate with each other, post messages, and vote on each other's contributions. The platform now claims 1.6 million registered agents.

Self-improving system. OpenClaw can expand its own skills by automatically writing code for new capabilities. This makes the system adaptive and allows it to grow with the user's needs.

The disadvantages: Why experts warn

Serious security issues. This is the primary concern. A security audit by Kaspersky in January 2026 revealed no fewer than 512 vulnerabilities, eight of which were labeled critical. The most severe, CVE-2026-25253 with a CVSS score of 8.8, allowed for remote code execution. Although patches have been released, it demonstrates the fundamental vulnerability of the system.

Security researchers from Censys and Bitsight discovered that between late January and early February 2026, more than 30,000 OpenClaw instances were publicly accessible on the internet-many without any authentication. This means API keys, personal messages, and login credentials for services like Gmail and Slack were visible to anyone.

Supply chain attacks. In February 2026, 386 malicious skills were discovered on ClawHub. These skills contained hidden instructions that could exfiltrate sensitive data. In at least one case, a security researcher at Meta had their entire inbox wiped by a compromised skill. The open marketplace is therefore not just a blessing, but a serious risk.

Prompt injection. Because OpenClaw communicates through messaging apps, the attack surface is widened. Malicious actors can send specially crafted messages that manipulate the agent into unintended behavior-from forwarding private messages to executing harmful commands.

Not for beginners. OpenClaw requires significant technical knowledge. You must be comfortable with Docker, API key management, logging, and possibly a VPS. For the average consumer, the threshold is simply too high, and the risks of misconfiguration are too great.

Costs can add up. While basic usage is affordable, costs can rise quickly with intensive use. Users running heavy automation or browser-driven tasks report monthly costs between fifty and one hundred and fifty euros-and sometimes more.

Hype versus reality. Despite impressive demos on social media, OpenClaw does not replace human employees. It can speed up repetitive tasks, but it cannot take responsibility. Those who blindly trust the output without verification run significant risks.

What does the future hold?

On February 15, 2026, Steinberger announced that he is joining OpenAI, where he will work on making AI agents more accessible. OpenClaw itself will be housed in an independent open-source foundation to ensure the continuity and independence of the project.

This is a crucial moment. The transition to a foundation could provide the project with the professional governance it needs-including better security audits, a stricter review process for skills, and clearer guidelines for users. However, it could also mean that rapid, community-driven innovation slows down.

Conclusion: Impressive, but with caveats

OpenClaw represents a fascinating new generation of AI tools that push the boundary from generating text to actual action. The privacy-oriented architecture, the extensible skills system, and the vibrant community make it a project to watch.

However, the security risks are currently too great to recommend OpenClaw for daily use by non-technical users. The combination of broad system access, an open skills marketplace, and the lack of a mature security framework makes it vulnerable to abuse.

For developers and IT professionals who know what they are doing and are willing to manage the risks, OpenClaw is a powerful experiment that offers a glimpse of what personal AI assistants could look like in the near future. For everyone else: follow developments with interest, but wait a little longer before jumping in.

Getting started with AI yourself? Check out our AI Agents e-learning or AI workshops for teams.

// About the author

Remy Gieling

Mede-oprichter, AI-expert & bestseller-auteur

Tech-expert (1988) gespecialiseerd in kunstmatige intelligentie en mede-oprichter van ai.nl, The Automation Group, Proxies en eBrain.ai. Oud-hoofdredacteur van diverse zakenmerken en daardoor een geoefend verteller op het podium en in de media. Verzorgt jaarlijks 150+ AI-keynotes in binnen- en buitenland en is gastdocent aan Nyenrode. Co-auteur van zeven boeken, waaronder 'Handboek AI Strategie' en 'AI Agents', en bekend als presentator op radio en RTL Z. Reist langs de labs van OpenAI, Nvidia en Tencent en vertaalt de nieuwste doorbraken naar inzichten die leiders direct kunnen toepassen.

LinkedIn