OpenClaw: The Open-Source AI Agent That Went Viral on GitHub (And What It Actually Does)

OpenClaw: The Open-Source AI Agent That Went Viral on GitHub (And What It Actually Does)

OpenClaw is a self-hosted, open-source AI agent that runs on your own machine and connects to the messaging apps and tools you already use, WhatsApp, Telegram, Signal, Discord, Slack, and more, without routing your data through a vendor's hosted API. It crossed 380,000+ GitHub stars by mid-2026, making it one of the fastest-growing and most-starred open-source repositories in GitHub's history.

In late November 2025, a small open-source project appeared on GitHub under the name Warelay. Within weeks it had been renamed twice, first to Clawdbot, then to Moltbot after a trademark complaint from Anthropic, before settling on its current name: OpenClaw. By late January 2026 it was adding tens of thousands of stars a day; by March it had passed React and the Linux kernel to become one of the most-starred software projects on GitHub.

Most people who saw the headlines assumed it was another chatbot wrapper or another "build your AI assistant in 10 minutes" tutorial project. It is closer to something else: a personal AI agent, built by Austrian developer Peter Steinberger, that runs on your own hardware and talks to you through the messaging apps already on your phone, while also being flexible enough for small teams to wire into CRM, calendar, and lead-gen workflows.

This article breaks down what OpenClaw actually is, why it went viral, how the architecture works, the security incidents that followed its rise, how it compares to commercial alternatives, and whether you should run it.

---

---

What Is OpenClaw?

OpenClaw is first and foremost a personal AI assistant. You install it on your own machine (Mac, Windows, or Linux), connect it to a WhatsApp or Telegram account, and it becomes an agent you talk to from the chat apps you already have open all day, reading and drafting email, managing your calendar, checking you in for flights, researching things on request, and chaining together whatever else you point it at. The project's own tagline is blunt about this: "Your own personal AI assistant. Any OS. Any Platform."

That personal-assistant framing is the one the current documentation, the GitHub repo itself, and most 2026 coverage leads with, a shift from OpenClaw's earlier public image as primarily a business-integration or workflow-automation runtime. The business use case still exists and is real: small teams and freelancers use OpenClaw for lead-gen workflows, prospect research, website auditing, and CRM integration, and the connector library (50+ applications, including HubSpot, Salesforce, Gmail, Google Calendar, Notion, Airtable, Jira, and Linear) supports that. But the primary on-ramp, and the reason it went viral with a broad, non-enterprise audience, is the "AI assistant that lives in your WhatsApp" pitch, not a business automation platform.

What makes OpenClaw distinct from a workflow tool like n8n or Make is the agent layer. Rather than executing a fixed sequence of steps, OpenClaw's runtime interprets natural-language instructions at runtime, selects which connectors to invoke, decides what data to pass between them, and handles error recovery without you defining every branch in advance. You describe the outcome. The agent figures out the path.

The "open" part matters for two reasons. First, you control the deployment: the runtime runs on your own infrastructure, and your data doesn't leave your network unless you explicitly configure it to. Second, the source is public under a permissive license, so the community can audit it, extend it, and build on it without vendor permission.

For individuals who want an AI assistant without handing a vendor their inbox and calendar, and for small teams who want automation without an expensive SaaS contract, that combination is genuinely new. It also, as the security section below covers, comes with real exposure if you're not careful about how you run it.

---

Why Did OpenClaw Go Viral?

The timeline is the story.

OpenClaw was first published on GitHub on November 24, 2025, under the name Warelay. It picked up its first serious traction fast: roughly 9,000 stars in its first 24 hours after launch. Over the following two months it was renamed twice, to Clawdbot on January 2, 2026, then to Moltbot on January 27, 2026, after Anthropic raised a trademark objection to "Clawdbot," and finally to OpenClaw on January 30, 2026. Each rename got picked up by tech press and developer communities, which compounded the attention rather than diluting it.

The growth after the OpenClaw rename was extreme by any GitHub standard. On January 26, 2026, the project reportedly gained over 25,000 stars in a single day, a record at the time. By February 24 it had passed 224,000 stars, ahead of the Linux kernel. By March 3, 2026, it had crossed roughly 250,800 stars, passing React, a project that took more than a decade to reach the same mark. Growth continued through the spring: 346,000+ stars by April, 369,000+ by early May, and past 384,000 by July 2026. A live pull from the GitHub API on this article's most recent update shows 386,000+ stars, though the exact figure moves daily and GitHub periodically removes bot-inflated stars from repository counts across the platform.

The privacy narrative helped, but so did timing on the AI-industry side. On February 15, 2026, OpenAI CEO Sam Altman announced that OpenClaw's creator, Peter Steinberger, was joining OpenAI to work on "the next generation of personal agents," while confirming OpenClaw itself would stay open source under independent foundation governance. That announcement, from the CEO of the company most associated with commercial AI agents, put OpenClaw in front of a mainstream tech audience that hadn't been tracking GitHub trending pages. In May 2026, Altman posted again noting that OpenClaw supported signing in with a ChatGPT account, another signal of the two projects' proximity despite OpenClaw remaining independently governed.

The open-source-versus-proprietary-AI narrative running through 2025 also mattered. OpenClaw arrived as a concrete answer to whether a self-hosted, model-agnostic agent could actually be useful day to day. Support for Ollama and local models meant developers could run it without paying per-token costs, or point it at a commercial model where quality mattered most.

---

How OpenClaw Actually Works

OpenClaw's architecture has three layers.

The model layer sits at the bottom. OpenClaw does not ship a language model. Instead, it uses an OpenAI-compatible API interface, which means it works with any model that exposes that API format. In practice, people use either Ollama running a local model (Mistral, Llama, Qwen, or similar), or they point OpenClaw at a commercial provider (OpenAI, Anthropic, Google) for tasks where model quality is the priority. The separation is intentional: you swap the model without changing anything else in the stack.

The agent runtime sits in the middle. This is the core of what OpenClaw actually does. When you send the agent a task (through a messaging app, the API, or the chat interface), the runtime breaks the task into sub-steps, selects which connectors to call, sequences the calls, passes outputs between them, and handles failures. The runtime maintains a short-term working memory of the current task context, which is what allows it to chain multiple tool calls coherently rather than treating each step as an isolated action.

The integration layer sits at the top. Each connector is a small, standardized module that wraps a specific third-party API or messaging platform. Connectors handle authentication, request formatting, response parsing, and error normalization. Because each connector exposes a consistent interface to the runtime, adding a new connector doesn't require changes to the runtime itself. A large part of OpenClaw's growth has come through its skills marketplace, ClawHub, where the community contributes connectors and task "skills" the agent can install and run. That marketplace is also the source of the most serious security incident covered below.

The entire stack runs locally or in Docker. A basic deployment needs a modest amount of RAM for the OpenClaw runtime itself, plus whatever your chosen language model requires. For people running a quantized local model via Ollama, a mid-range machine is sufficient. For people using a commercial API endpoint, the OpenClaw runtime itself is lightweight.

The agent is not magic. It makes mistakes, it can misinterpret ambiguous instructions, and it's more reliable with well-structured tasks than open-ended creative ones.

---

---

The Security Incidents Behind the Growth

Any honest look at OpenClaw in 2026 has to cover the security side, because it's been as much a part of the story as the star count.

Within about three weeks of the project's surge in popularity, security researchers identified a critical remote-code-execution vulnerability, tracked as CVE-2026-25253 (CVSS 8.8). The bug was a one-click RCE chain that worked even against instances bound to localhost: OpenClaw's local server didn't validate the WebSocket origin header, so a malicious website you simply visited in your browser could silently connect to your running agent and issue commands. It was patched in version 2026.1.29.

Separately, researchers uncovered a large-scale supply-chain attack on ClawHub, OpenClaw's community skills marketplace. The campaign, referred to as ClawHavoc, planted malicious skills that delivered the Atomic macOS Stealer (AMOS) malware. Early scans found roughly 341 malicious skills, about 12% of the registry at the time; later, broader scans put the number above 800 malicious skills, close to 20% of everything listed.

The scale of internet exposure compounded both issues. Internet-scanning services tracked the number of publicly exposed OpenClaw instances growing from roughly 1,000 to more than 21,000 in the last week of January 2026 alone, with independent researchers separately identifying over 42,000 exposed instances, thousands of them actively vulnerable, and the large majority of those showing authentication bypass conditions. Third-party research (including from Cisco) also flagged that some community skills exfiltrated user data without clear disclosure to the person running the agent. China's government restricted state agencies from using OpenClaw in March 2026, citing these concerns.

None of this means OpenClaw is unusable, the RCE is patched, and the marketplace issue is a known, actively-policed risk rather than a secret one. But it does mean that "self-hosted" is not automatically "safer." If you run OpenClaw, keep it updated past 2026.1.29, don't expose the runtime to the open internet, and vet any third-party skill from ClawHub before installing it, the same due diligence you'd apply to any browser extension or npm package from an unknown publisher.

---

OpenClaw vs Commercial AI Agents

How does OpenClaw compare to the managed AI agent products from OpenAI and Anthropic? The honest answer is: it depends entirely on which dimensions matter most to you.

The clearest advantage OpenClaw has over commercial agents is in the data privacy and cost columns, plus reach into the messaging apps you already use daily. The clearest disadvantage is that you own security and uptime yourself: there's no managed SLA, and 2026's incidents showed what happens when tens of thousands of instances get exposed to the internet without anyone patching them.

---

Who Should Use OpenClaw?

OpenClaw is a strong fit for a few kinds of users.

People who want an AI assistant inside apps they already use. If the appeal is "talk to an AI agent from WhatsApp or Telegram instead of a separate app," OpenClaw is built for exactly that, and it's the reason most people are adopting it in 2026.

Regulated industries and privacy-conscious teams. Healthcare, finance, legal, and government teams often can't route sensitive data through external APIs, even under a data processing agreement. Self-hosting removes the data-residency problem at the architecture level rather than the contract level, provided the deployment is locked down properly.

Cost-sensitive teams with high automation volume. If your team runs a large volume of routine automations, per-token pricing from commercial providers adds up quickly. Paying for infrastructure instead of tokens is often cheaper at real scale.

Developers who want control over the full stack. OpenClaw is open source. You can read the connector code, modify runtime behavior, and extend the agent in ways a black-box API doesn't allow.

If you want to explore AI agent development and need a framework you can fully customize and audit, OpenClaw deserves serious evaluation, with the security caveats above factored in.

---

Who Should Not Use OpenClaw?

OpenClaw is the wrong choice for a few kinds of users.

Anyone who won't keep it patched. The 2026 RCE and supply-chain incidents both hit people running outdated or exposed installs. If you're not going to stay current on updates or vet third-party skills, the risk outweighs the benefit.

Teams without DevOps capacity. Running OpenClaw for business use in production requires someone who can manage the deployment, monitor resource usage, debug connector failures, and keep the runtime patched.

Teams where model quality is non-negotiable. If your use case requires the best available reasoning consistently, OpenClaw with a local model is not a substitute for a frontier commercial model. Pointing OpenClaw at a commercial API narrows that gap but gives up some of the cost advantage.

Teams that need a managed SLA. If your workflow is customer-facing or business-critical, you need a predictable escalation path when something breaks. OpenClaw doesn't offer that, you're responsible for your own uptime and incident response.

If you want a realistic picture of what self-hosted AI maintenance actually involves, it's worth being honest about the operational and security commitment before you start.

---

Foundation Governance: What It Means for Long-Term Trust

OpenClaw's creator, Peter Steinberger, joined OpenAI in February 2026, shortly after the project went viral. That raised an obvious question: what happens to an open-source project when the person who built it joins one of the commercial competitors in the same space?

Sam Altman addressed this directly when announcing the hire: OpenClaw would remain open source, governed independently rather than folded into OpenAI. The project sits under foundation-style governance, controlling the roadmap, the ClawHub registry standards, the release process, and the trademark, with no single company, including OpenAI, holding special governance rights.

This is not unprecedented in open source; the Apache Software Foundation and the Linux Foundation exist for the same reason: to decouple project governance from any single company's interests. It doesn't guarantee the project will be maintained indefinitely or that security response will always be fast (the ClawHavoc campaign shows that policing a fast-growing marketplace is genuinely hard), but it does reduce the risk of a single company redirecting or shutting down the project.

If you're evaluating OpenClaw alongside managed commercial options for enterprise use, it's worth reading the OpenClaw and NemoClaw enterprise setup guidance, which covers the additional tooling and support structures available for production deployments.

---

Getting Started with OpenClaw

OpenClaw's setup involves four steps. This isn't a full tutorial, but here's the high-level overview.

Step 1: Install the runtime. OpenClaw runs locally on Mac, Windows, or Linux, or in Docker if you'd rather containerize it. A basic setup, runtime plus a database for state persistence, is usually running within 30 minutes.

Step 2: Connect a messaging app or model. Link a WhatsApp or Telegram account if you want the personal-assistant experience, and/or point the runtime at your model endpoint (Ollama for local models, or an API key for a commercial provider).

Step 3: Configure your first connector. Connector configuration is straightforward: each connector or messaging channel has its own setup for authentication credentials and settings.

Step 4: Write your first agent task. Start with a simple, well-defined task, for example, "check my inbox for anything from [client] and summarize it," and iterate from there. Before installing any third-party skill from ClawHub, check it against the current known-malicious-skill reports; the ClawHavoc campaign is ongoing, not a one-time cleanup.

If your team wants support for a more complex OpenClaw deployment, custom workflow automation services are available to handle the integration design, configuration, and hardening.

---

---

If your team is evaluating OpenClaw for enterprise use, our OpenClaw and NemoClaw enterprise setup service handles installation, environment configuration, security hardening, and integration with your existing stack. Book a free setup consultation to review your infrastructure requirements.

Key Takeaways

OpenClaw is a real product solving a real problem, and it's grown faster than almost anything else in GitHub's history. It launched on November 24, 2025, as Warelay, went through two more names before landing on OpenClaw at the end of January 2026, and has since passed 380,000+ GitHub stars.

It's best understood today as a personal AI assistant you run yourself and talk to through WhatsApp, Telegram, or another messaging app, not primarily as a business-integration platform, though it supports both.

Its rise came with real security costs: a patched but serious RCE vulnerability, an ongoing supply-chain problem in its skills marketplace, and tens of thousands of exposed instances discovered by researchers. Foundation governance and OpenAI's continued backing (after hiring creator Peter Steinberger) reduce the long-term project-abandonment risk, but they don't substitute for keeping your own install patched and your skills vetted.

The honest trade-off: OpenClaw gives you data privacy, cost efficiency, model flexibility, and full codebase auditability, at the cost of owning your own security and uptime. For individuals who want a private AI assistant, and for teams with the operational discipline to run it safely, it's worth serious evaluation. For teams that need managed reliability and vendor-backed security, the commercial alternatives remain the pragmatic choice.

If you want to explore whether OpenClaw fits your use case, reach out to discuss.

---

For the exact process we run in production, see our AI agent deployment workflow: steps, tools, and when not to use it.

Ready to run OpenClaw in production, safely? Our OpenClaw enterprise setup service includes environment configuration, security hardening, and a handoff playbook your team can maintain. Book a free scoping call.

FAQ

Is OpenClaw free?

The software itself is free and open-source. You pay for whatever hardware or infrastructure you run it on and for any language model API costs if you use a commercial endpoint. There's no per-seat or per-operation fee from OpenClaw itself.

Is OpenClaw safe to use?

It depends on how carefully you run it. The code is open-source and auditable, but 2026 saw a serious remote-code-execution vulnerability (CVE-2026-25253, patched in v2026.1.29) and an ongoing supply-chain campaign (ClawHavoc) planting malicious skills in the ClawHub marketplace. Researchers also found tens of thousands of publicly exposed instances, many misconfigured. If you keep your install updated, avoid exposing the runtime to the open internet, and vet third-party skills before installing them, OpenClaw can be run safely. If you skip those precautions, you're taking on real risk.

Does OpenClaw work with ChatGPT?

Yes. OpenClaw works with any model that exposes an OpenAI-compatible API, including OpenAI's GPT models, and since May 2026 supports signing in directly with a ChatGPT account to use an existing OpenAI subscription. In this configuration, your agent reasoning data does go through OpenAI's infrastructure, though data flowing to your connected apps (Slack, Jira, CRM, your inbox) still comes from your own machine.

What is OpenClaw's connection to OpenAI?

OpenClaw's creator, Peter Steinberger, joined OpenAI in February 2026 to work on personal agents. OpenClaw itself remains open source and independently governed rather than owned by OpenAI; OpenAI has publicly backed keeping it that way. No single company, including OpenAI, has special governance rights over the project.

How does OpenClaw compare to n8n?

n8n is a workflow automation tool that executes predefined sequences of steps. OpenClaw is an AI agent that interprets natural-language instructions and decides which steps to take at runtime. They solve different problems, and many people use both: n8n for deterministic, well-defined workflows, and OpenClaw for flexible, conversational, instruction-driven automation.

What actually happened with OpenClaw's security incidents?

Two separate things happened close together in early 2026. First, researchers disclosed CVE-2026-25253, a critical remote-code-execution bug caused by the local OpenClaw server not validating WebSocket origin headers, meaning a malicious webpage could reach into a running agent. It's patched as of v2026.1.29. Second, a supply-chain campaign called ClawHavoc planted malicious skills in the ClawHub marketplace that delivered infostealer malware; at peak, close to a fifth of the marketplace's listed skills were found to be malicious in later scans. Combined with tens of thousands of exposed instances found by internet-scanning researchers, this made OpenClaw a widely-covered case study in how fast-growing open-source AI tools can outpace their own security response.

What connectors and channels are available?

The messaging side covers WhatsApp, Telegram, Signal, Discord, and more. The broader connector library covers 50+ applications including Slack, HubSpot, Salesforce, Gmail, Google Calendar, Google Drive, Notion, Airtable, Jira, Linear, Zendesk, Intercom, GitHub, GitLab, and a generic REST connector for custom endpoints. The community-maintained ClawHub registry adds many more, with the caveat that not everything in it has been vetted, see the security section above.

How does the NemoClaw enterprise variant differ?

NemoClaw is a distribution of OpenClaw maintained for enterprise deployments, built on top of the open-source OpenClaw core and governed by the same foundation. It adds enterprise-specific features including role-based access controls, audit log exports, high-availability clustering, and optional commercial support contracts, along with the additional hardening enterprise deployments need given the 2026 security incidents. See the OpenClaw and NemoClaw enterprise setup page for details.

For a broader comparison of open-source AI agent frameworks available in 2026, see best open-source AI agent frameworks.

---

Sources

• OpenClaw, Wikipedia — launch date (Nov 24, 2025), rename history (Warelay → Clawdbot → Moltbot → OpenClaw), governance, security incidents
• github.com/openclaw/openclaw — live star count, project description ("Your own personal AI assistant. Any OS. Any Platform.")
• OpenClaw Surpasses Linux to Become the 14th Most-Starred GitHub Project, star-history.com — Feb 24, 2026 star-count milestone
• OpenClaw Surpasses React to Become the Most-Starred Software Project on GitHub, star-history.com — Mar 3, 2026 star-count milestone
• OpenClaw creator Peter Steinberger joining OpenAI, Altman says, CNBC, Feb 15 2026
• OpenClaw: The AI Agent Security Crisis Unfolding Right Now, Reco.ai — CVE-2026-25253, ClawHavoc supply-chain campaign, exposure stats
• The OpenClaw security crisis, Conscia — corroborating security-incident detail
• OpenClaw rocks to GitHub's most-starred status, but is it safe?, The New Stack
• Live GitHub API star count pulled for this update: 386,192 stars (Aug 14, 2026)