What Is OpenClaw AI?
OpenClaw AI is an open-source AI assistant designed to connect with messaging apps and carry out tasks using configured tools. Learn how it works and what to consider before using it.
Overview
OpenClaw is an open-source, self-hosted AI assistant and agent runtime. It connects messaging apps and interfaces such as Telegram, WhatsApp, Slack, Discord, Signal and a web dashboard to a persistent Gateway that manages conversations, model requests, memory, tools and automations. The software is not itself a large language model: it uses a model supplied through a hosted provider or, if configured, a local model. Its defining feature is the combination of chat access and the ability to take actions through tools on the computer or services it has been granted access to. What is OpenClaw? - OpenClaw and openclaw/README.md at main · openclaw/openclaw · GitHub describe it as a self-hosted assistant and control plane.
In practical terms, OpenClaw can receive a message, use a model to interpret it, call an enabled tool, and return a response through the same or another configured channel. That can support tasks such as creating a briefing, drafting a message, searching a website, organizing files or running a scheduled reminder. It also means its permissions and security configuration matter: an agent that can read files, access credentials, run commands or send messages can cause effects beyond producing text.
What is OpenClaw AI in 2026?
The name “OpenClaw AI” commonly refers to the OpenClaw project, not to a separate OpenClaw-branded foundation model. It is best understood as a self-hosted agent platform: users operate the software on a computer, server or virtual machine, connect one or more chat channels, select a model, and choose which tools and integrations it can use. OpenClaw’s source code is available under the MIT License, while the model service, messaging platform and hardware may be supplied by other organizations. (openclaw/README.md at main · openclaw/openclaw · GitHub, openclaw/LICENSE at main · openclaw/openclaw · GitHub.)
OpenClaw therefore differs from a conventional chatbot in its operating model. A chatbot primarily responds in a hosted interface; OpenClaw can keep state between conversations and invoke external or local capabilities when authorized. It differs from a model because the underlying language model performs the language reasoning, while OpenClaw handles connections, routing, tool execution and persistence. The project also supports external agent harnesses and local inference options, so the details depend on which providers and components an operator configures.
How OpenClaw works
The Gateway is the always-on control process. It connects to messaging channels, routes incoming activity to an agent and session, coordinates access to models and tools, and stores the assistant’s state. The Control UI, command-line interface and terminal chat interface can connect to that Gateway. A Gateway can run on a personal computer or server and can be operated as a personal assistant or as a shared workspace service. openclaw/README.md at main · openclaw/openclaw · GitHub.
A simplified interaction follows this path:
Figure: Simplified OpenClaw request and response path. The model interprets the request and may propose a tool call; the Gateway coordinates execution and delivery. This is a conceptual diagram, not a guarantee that every configuration uses the same model, tools or sequence. The project describes the Gateway as the control plane for channels, sessions, tools and events in its openclaw/README.md at main · openclaw/openclaw · GitHub and Gateway runbook - OpenClaw.
A typical turn has several stages: OpenClaw receives an event, resolves the appropriate agent and session, assembles relevant conversation and workspace context, sends a request to the selected model, executes any allowed tool calls, and then records and delivers the result. Tool execution can include reading or modifying files, running commands, interacting with a browser, sending messages or calling connected services. The available actions depend on configured tools, plugins, credentials and policy settings; the model alone does not automatically gain every capability listed by the project. Overview - OpenClaw explains that tools are used to read data, change files, send messages, call providers or operate other systems.
Gateway, agents, sessions and memory
The Gateway is the central connection point, but an agent is the configured assistant that handles a task or channel. Operators can route different accounts, channels or workflows to different agents. Sessions preserve conversation context; workspace files and memory features can store information for later use. By default, state such as sessions, configuration, credentials and workspace files reside on the Gateway host. The official Where things live on disk - OpenClaw describes where these files live and distinguishes Gateway state from workspace documents.
Persistence is useful for recurring assistance but increases the importance of state management. If stored instructions or memory are changed, they may influence future turns. Session history, configuration and credentials also need appropriate access controls and backup practices. OpenClaw supports scheduled jobs and periodic heartbeat activity, which allow an agent to be triggered without a new user message; those features require the Gateway and applicable automation configuration to be running. (Heartbeat - OpenClaw.)
Tools, skills and plugins
These terms describe different extension surfaces. Tools are actions available to the agent at runtime, such as browser or file operations. Skills add packaged instructions and workflows for a task and may point to tools or scripts. Plugins can add larger capabilities, including tools, channels, model providers or speech features. The project’s skill registry, ClawHub, lets users discover and install community extensions. Because a skill can shape instructions or introduce executable files, it should be reviewed like third-party software rather than treated as a harmless prompt template. Skills - OpenClaw describes the extension mechanism and current audit signals.
What OpenClaw can be used for
The project lists personal briefings, research and drafting, reminders, browser automation and cross-device task dispatch among common examples. A user might ask for a summary of selected inbox messages, a draft follow-up, a reminder at a particular time, or a web task to collect information and send back a summary. OpenClaw can also connect to developer tools or run work on a remote Gateway while the user communicates from a phone. These are possible workflows, not guarantees of accuracy or successful completion. The official What is OpenClaw? - OpenClaw describe these tasks and advise keeping a human involved in outreach and advertising.
| Use case | What OpenClaw may do | Main constraint |
|---|---|---|
| Briefings and reminders | Retrieve connected information, summarize it or deliver a scheduled prompt | Requires correct integrations, access and schedule configuration |
| Research and drafting | Search or browse permitted sources and prepare a draft | The model can omit, misread or invent information; verify important claims |
| Browser-based tasks | Interact with pages or repeat a web workflow | Websites change, and page content may contain malicious instructions |
| File or coding assistance | Read or alter files, run commands or use development tools | Permissions can expose or modify more than the intended project |
| Cross-device assistance | Accept a message from one device and perform work through a Gateway elsewhere | The remote Gateway and its credentials become part of the trust boundary |
OpenClaw is not necessarily the best choice for every assistant task. Its own FAQ frames it as an assistant and coordination layer rather than a replacement for a dedicated coding environment such as Claude Code or Codex. A specialist coding harness may offer a more direct code-editing workflow, while OpenClaw emphasizes durable sessions, multiple chat entry points and orchestration across tools. (What is OpenClaw? - OpenClaw.)
History and project status
The project began in late 2025 under the name Clawdbot, according to a February 2026 OpenClaw founder Steinberger joins OpenAI, open-source bot becomes foundation By Reuters. It was subsequently known as Moltbot before taking the OpenClaw name in January 2026. The repository’s openclaw/docs/start/lore.md at main · openclaw/openclaw · GitHub gives Jan. 27 as the Moltbot rename and Jan. 30, 2026 as the OpenClaw name change; those precise dates come from the project’s own account.
Figure: Selected project milestones. The rename dates are from the project’s own history; the November origin and February leadership announcement are independently reported by OpenClaw founder Steinberger joins OpenAI, open-source bot becomes foundation By Reuters. Reuters also reported that the repository had passed 100,000 GitHub stars and had drawn two million visitors in one week, citing the founder’s blog. Those figures measure attention at that time, not the number of active installations, paying users or successful agent tasks.
As of 2026, the project’s openclaw/README.md at main · openclaw/openclaw · GitHub identifies the OpenClaw Foundation as its steward and describes it as an independent nonprofit. The repository carries an openclaw/LICENSE at main · openclaw/openclaw · GitHub. Reuters reported that founder Peter Steinberger joined OpenAI and that OpenAI would support the foundation-based project. The announcement concerned the founder’s role and the project’s stewardship; it should not be described as an acquisition of OpenClaw by OpenAI.
Setup and cost
OpenClaw is software to install and operate, not a fully hosted service that automatically supplies all required infrastructure. Installation requires a supported runtime and a model-access route, such as a provider API key or compatible login; users then configure the Gateway, choose channels and grant permissions. The official Getting started - OpenClaw is the appropriate source for current operating-system and version requirements, which can change as releases evolve.
The OpenClaw software itself has no paid tier or hosted service according to its openclaw/README.md at main · openclaw/openclaw · GitHub. That does not mean a complete setup is necessarily cost-free. A hosted model may charge for inference, a server or always-on computer has its own cost, and messaging or other connected services have their own terms and fees. Choosing a local model can avoid a per-request API bill but requires suitable hardware and does not remove the need to secure chat channels or other network connections. There is no single defensible monthly cost without specifying the model, usage volume, hardware, hosting location and connected services.
Privacy and security
Local storage is not the same as fully local processing
“Self-hosted” means the operator controls where the OpenClaw Gateway runs and where its own state is stored; it does not automatically mean that every piece of data stays on that machine. OpenClaw’s FAQ says that sessions, memory, configuration and workspace files are local to the Gateway host by default. Prompts sent to hosted model providers are transmitted to those providers, and messages sent through services such as Slack, Telegram or WhatsApp are handled by those platform operators. A local model can keep inference prompts on the device, but messages still pass through the selected chat platform. (Where things live on disk - OpenClaw.)
This distinction is central to the answer to “what is OpenClaw AI?” in privacy terms: it offers control over the runtime and local state, not a blanket guarantee of private or offline processing. The operator must consider each service in the data path, the credentials stored on the host, access to logs and transcripts, and any optional telemetry or diagnostic export.
Why an agent runtime needs stronger safeguards than a text-only chatbot
OpenClaw can connect untrusted input to tools that have real permissions. A message, web page or document may contain instructions that attempt to redirect the model; if the agent can access accounts or execute commands, a mistaken or manipulated tool call can have consequences. Persistent memory and schedules can allow changed instructions or access to continue affecting later runs. OpenClaw’s own security documentation recommends treating input as untrusted and recognizes that the Gateway is a single trust domain, not a security boundary for mutually adversarial users. On a regular host installation, it binds to loopback by default and commonly pairs unknown direct-message senders rather than processing their messages; operators can also run its security audit and configure tool restrictions. These defaults reduce exposure but do not replace deployment-specific review. (Security - OpenClaw.)
Microsoft Defender Security Research describes the relevant combination as untrusted text, third-party skills and persistent credentials. It advises organizations evaluating OpenClaw to isolate it in a dedicated virtual machine or separate system, use dedicated non-privileged credentials and non-sensitive data, restrict skill sources, and monitor activity. This is Microsoft’s defensive guidance, not a claim that every OpenClaw installation has been compromised. (Running OpenClaw safely: identity, isolation, and runtime risk | Microsoft Security Blog.)
A concrete supply-chain incident illustrates the risk. The European Union Agency for Cybersecurity’s CERT-EU reported that researchers identified at least 341 malicious skills published to ClawHub and GitHub in the ClawHavoc campaign, designed to steal items such as API keys, wallet keys, SSH credentials and browser passwords. That is a report about a campaign and its identified material, not a claim that 341 skills remain available or that all skills are malicious. (AI branding to gain widespread installation and facilitate persistent surveillance across user environments. artificial intelligence link.)
ClawHub now presents automated security-audit signals for skills, including review of files, instructions and declared capabilities. The project cautions that an audit is not a guarantee that a release is risk-free. Users should verify the publisher and version, inspect what the skill asks to access, avoid blindly running pasted shell commands, and grant only the permissions needed. (Security Audits - OpenClaw.)
Practical safeguards
For an individual evaluation, a lower-risk setup uses a dedicated machine or isolated virtual machine, separate accounts and narrowly scoped credentials. Keep the Gateway on loopback unless remote access is necessary; if remote access is needed, configure authentication and network protections rather than exposing an unauthenticated service. Pair or allowlist senders, restrict group-chat access, and enable only the tools needed for the task. Review skills and plugins before installation, and require a person to approve consequential actions such as sending external messages, moving money or changing production systems. For organizations or multi-user environments, use separate Gateways for users who do not share a trust relationship. The project explicitly warns that one shared Gateway is not designed to isolate hostile tenants from one another. (Security - OpenClaw; Running OpenClaw safely: identity, isolation, and runtime risk | Microsoft Security Blog.)
How OpenClaw compares with other AI assistants
| Approach | Where it runs and what it emphasizes | Main trade-off |
|---|---|---|
| OpenClaw | Operator-managed Gateway, connected chat channels, persistent sessions and configurable tools | Greater control and extensibility, but the operator owns setup, permissions, security and maintenance |
| Hosted general-purpose assistant | Provider-managed interface and infrastructure, often with built-in integrations | Easier to start; data handling and available integrations depend on provider policies and product design |
| Coding-focused agent or IDE assistant | A workflow centered on software projects, code editing and development tools | More focused for coding; usually not designed as a general always-on assistant across personal chat channels |
| Local model interface | Runs a model on local hardware, often focused on private inference or direct chat | Can reduce dependence on model APIs, but may lack OpenClaw’s channel routing, persistence and action orchestration unless combined with additional tools |
These categories overlap: OpenClaw can use local models, and hosted assistants can perform actions. The distinction is primarily about who operates the control plane, how broad the tool and channel integrations are, and who bears responsibility for security. OpenClaw is a particularly strong fit for technically capable users who want a customizable assistant they can operate themselves. It is a weaker fit for those who need a managed service, cannot maintain a persistent host, or intend to give a broadly empowered agent access to sensitive accounts without isolation and oversight.
Bottom line
OpenClaw is an open-source framework for running a persistent, tool-using AI assistant through familiar messaging channels. Its Gateway connects users, models, sessions and actions; its practical value comes from that orchestration, not from a proprietary OpenClaw model. Self-hosting gives an operator more control over local state and model choice, but does not by itself ensure privacy, accuracy or safety. The same persistent access and tool execution that make OpenClaw useful also make careful isolation, least-privilege credentials, skill review and human approval important parts of any responsible deployment.