What Is OpenClaw? The Complete 2026 Guide (Local-First AI)

If you spent any time on developer Twitter this year, you've probably seen the lobster meme. The GitHub stars climbing faster than any repository in history. The security researchers losing their minds. The trademark drama that somehow made everything worse (or better, depending on your perspective).

OpenClaw is a local-first, open-source AI assistant that runs on your own hardware and takes instructions through chat apps you already use, like WhatsApp, Telegram and Slack. It passed 390,000 GitHub stars by September 25, 2026, less than a year after its first release, and became a cautionary tale about security risks in AI agent ecosystems along the way.

GitHub's own blog calls it the fastest-growing project in GitHub history. But that growth came with baggage: hundreds of malicious plugins, a one-click remote code execution bug, and open questions about whether those star counts even represent real adoption.

Here's what actually happened.

The Rebrand Chaos That Launched Everything

OpenClaw didn't start as OpenClaw. Not even close.

Peter Steinberger (founder of PSPDFKit) published it in November 2025 as Warelay, a WhatsApp relay built as a weekend project. By January it was Clawdbot, after Clawd, a pun combining Claude (Anthropic's AI model) with a lobster claw. Cute. Problem: Anthropic asked for a name change over trademark concerns, so on January 27, 2026 it became Moltbot (lobsters molt to grow), per the project's own history.

Moltbot didn't stick either. In Steinberger's words, it "never quite rolled off the tongue." So on January 30, 2026, the team rebranded again. This time to OpenClaw.

Here's the thing most people miss: the chaos worked. Each rebrand kept the project in headlines for another news cycle. The trademark drama created sympathy. By the time OpenClaw became the final name, the repository had momentum that couldn't stop.

The "Open" prefix signals open-source code and community-driven development. The "Claw" keeps the beloved lobster mascot. And this time, the launch post noted, the trademark searches came back clear.

The rebrands had darker consequences too. During the first rename, attackers grabbed the released GitHub organization and X handle within seconds, and typosquat domains plus a cloned repository followed within days. A fake $CLAWD Solana token briefly hit a $16M market cap, then collapsed once Steinberger denied any link to it.

Growth Metrics That Break Historical Patterns

The numbers still don't make sense.

By the January 30 rename, OpenClaw already had more than 100,000 GitHub stars and 2 million visitors in a single week, according to Steinberger. GitHub counted roughly 388,000 stars and more than 80,000 commits by August 26, 2026. On September 25, 2026, the repository showed about 390,000 stars.

For context: Kubernetes' main repository has about 128,000 stars after twelve years on GitHub.

The 2.0 release notes credit 987 contributors for that single release. That's not just people clicking a star button. That's actual code contributions.

I think the hype and the substance are both real. A viral hype cycle pulls in stars from people who will never install anything. The real question: does it matter if the underlying product actually works?

What Makes OpenClaw Different From Cloud AI Assistants

Most AI assistants keep your data on the vendor's servers. OpenClaw keeps it on yours.

The architecture is a local-first Gateway: state, memory and credentials live on your own hardware. The catch is the model. Your prompts, and whatever the agent reads to answer them, go to the model provider you configure (unless you run a local model), and your messages pass through whichever chat apps you use.

That still beats cloud assistants from Google, Microsoft and OpenAI, which also keep your chat history and memory on their own servers. The launch post summed it up: "Your assistant. Your machine. Your rules."

The platform connects to tools you already use:

• Chat apps: WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams and more (29 channels as of September 2026)
• Email and calendars: inbox triage, sending email and calendar management are its headline use cases
• Browser, files and shell: web browsing, form filling, file edits and shell commands, with or without a sandbox
• Community skills: thousands of add-ons on ClawHub, from Home Assistant to Apple Notes

The biggest update so far is v2026.8.1, which the project calls OpenClaw 2.0, released August 30, 2026 with a rebuilt web UI, simpler onboarding, stronger memory and shared team sessions. It works with hosted models from Anthropic, OpenAI, Google, xAI, Moonshot (Kimi) and OpenRouter, or local runtimes like Ollama and LM Studio.

Real Automation Workflows People Actually Use

Unlike most AI demos that never leave the demo stage, OpenClaw has a public showcase of community setups. They're user reports collected by the project, not independent tests, but they show the range.

Email and back-office work: One setup watches Gmail for work orders, writes quote PDFs and invoices through Xero. Another collects PDFs from email for a tax consultant.

Briefings and calendars: The official FAQ puts personal briefings (inbox, calendar and news summaries) first among its top everyday use cases.

Flight check-in: One workflow finds the next flight in your email, runs the online check-in and picks a window seat.

Knowledge organization: Users have turned years of lab results into a Notion database and kept an assistant's memory as markdown in an Obsidian vault.

Browser automation: Grocery orders and school-meal bookings run through browser control, no API needed.

These workflows embed the AI agent into daily routines rather than requiring you to adopt new tools. That's probably why adoption stuck beyond initial curiosity.

The Security Nightmare Nobody Saw Coming

OpenClaw's explosive growth exposed a critical weakness: ClawHub, the public registry for community-built skills and plugins.

Malicious skills: In early February, Koi Security audited the 2,857 skills then on ClawHub and found 341 malicious ones, most pushing the Atomic Stealer macOS malware through fake "prerequisites" and posing as crypto trackers, YouTube tools or ClawHub typosquats. 1Password's Jason Meller found that the top-downloaded skill at the time was malware too, and wrote that skill registries have "already become an attack surface."

CVE-2026-25253: A high-severity bug (CVSS 8.8) let a crafted link steal the Gateway's auth token through a manipulated gatewayUrl parameter, giving attackers one-click remote code execution, even on instances bound to localhost. Version 2026.1.29 fixed it on January 30, 2026.

Exposed instances: Bitsight counted more than 30,000 distinct OpenClaw instances reachable from the internet between January 27 and February 8, 2026.

This is the part that gets me. The project's core value proposition is privacy and data sovereignty. But the skill ecosystem undermines that entirely if users install malicious extensions that exfiltrate data anyway.

Governments noticed. In March 2026, Chinese authorities moved to restrict state agencies and state-owned firms, including the largest banks, from running OpenClaw on office computers.

Why OpenClaw Went Viral in January 2026

Five things converged to create the perfect viral storm.

Rebrand chaos kept headlines fresh: The Clawdbot → Moltbot → OpenClaw journey created continuous news cycles that kept the project visible for weeks.

Cultural amplification through Moltbook: On January 28, 2026, entrepreneur Matt Schlicht (not the OpenClaw team) launched Moltbook, a Reddit-style forum where only AI agents post and humans watch. Most of its agents ran on OpenClaw. It was absurd, hilarious and perfectly timed, and Meta acquired it in March.

High-profile attention: Andrej Karpathy (former Tesla AI Director, OpenAI founding member) called Moltbook "the most incredible sci-fi takeoff-adjacent thing I've seen recently," then called it "a dumpster fire" and warned people not to run this stuff on their computers.

Demand for self-hosted AI: It arrived MIT-licensed and self-hosted just as plenty of people wanted an assistant that didn't live on someone else's servers.

The Mac mini meme: People bought Mac minis to run it around the clock, and US searches for "Mac Mini" jumped, Business Insider reported, even as Steinberger posted: "Please don't buy a Mac Mini. You can deploy this on Amazon's Free Tier."

On February 14, 2026, Steinberger announced he was joining OpenAI and that OpenClaw would move to a foundation and stay open and independent.

Leadership Transitions and Acquisition Drama

Multiple acquisition offers emerged during the viral phase. Steinberger told Lex Fridman that both Mark Zuckerberg and Sam Altman made concrete offers, and that his condition was that the project stay open source.

His move to OpenAI raised an obvious question: would OpenClaw become an OpenAI project by proxy?

The answer was independent foundation governance, and it now exists. The OpenClaw Foundation is a US 501(c)(3) that employs the core team, signs every release and keeps the product MIT-licensed, with no paid tier, hosted service or token. Donors include OpenAI, Amazon, Red Hat and the University of Michigan. In the project's words: "OpenAI is a donor, not an owner."

The project's vision document lists security and safe defaults, stability, and setup reliability as current priorities.

OpenClaw vs Traditional AI Automation Tools

If you're evaluating OpenClaw against Zapier, n8n, or Make, the comparison isn't quite apples-to-apples. Those platforms are built around predefined triggers and actions, with AI agent steps added on top (Zapier Agents, n8n's AI Agent node). OpenClaw starts from the agent: you describe the job in chat and it picks the tools.

For teams already on a workflow tool, our n8n vs Zapier comparison for AI workflows covers how those two handle AI steps.

The key difference: OpenClaw acts more like a personal assistant you train through conversation, while traditional automation mostly has you define each step. That flexibility comes with security trade-offs.

Setting Up OpenClaw: What You Actually Need

The technical requirements aren't trivial. This isn't a browser extension.

Hardware: The install docs ask for macOS, Linux or Windows plus Node 24.16+ or 26.1+, which the installer sets up for you. They list no RAM minimum; people run it on old laptops, Raspberry Pis, Mac minis and rented VPS instances. Hardware only gets serious if you run models locally.

Model access: An API key for a hosted provider (Anthropic, OpenAI, Google, OpenRouter and many more), a supported subscription sign-in such as ChatGPT, or a local runtime like Ollama. Local models need enough memory and GPU for the model you pick.

Technical skills: Installing is now a one-line script or a desktop app for macOS and Windows, followed by a guided onboarding wizard. The harder part comes after: API keys, channel pairing, permissions and the security settings below.

Time investment: The install is quick. Connecting accounts and tightening permissions is where the real time goes. That's the price of any self-hosted, privacy-focused tool.

Common Mistakes When Deploying OpenClaw

Most of these mistakes show up in the security reports above or in the project's own docs.

Installing skills without vetting source code: The skills docs say to treat third-party skills as untrusted code and read them before enabling. If you can't read the code, don't install the skill. OpenClaw skills use the open AgentSkills format, a folder built around a SKILL.md file, the same structure our Claude Skills guide walks through.

Exposing instances to the public internet: Unless you specifically need remote access, keep the Gateway on loopback or behind a private network like Tailscale or an SSH tunnel, and run openclaw security audit --deep after config changes.

Underestimating model costs: An agent that processes hundreds of tasks daily racks up API costs fast, and the bill depends on the model and volume. Check per-token prices and set a spending limit with your provider first.

Skipping security updates: Seven stable releases shipped in September 2026 alone (the last that month, v2026.9.6, on September 23), and CVE-2026-25253 showed what an outdated install can cost.

Over-trusting automation: OpenClaw makes mistakes. Letting it send emails, schedule meetings, or manage tasks without human review creates risk. The docs recommend letting it draft while you approve, and giving it only the tools and accounts it needs. Start read-only and expand permissions gradually.

What the GitHub Stars Do and Don't Tell You

Everyone says GitHub stars are a vanity metric. They're right, but not for the reasons you'd think.

Any reading of OpenClaw's roughly 390,000 stars comes down to one question: genuine adoption or hype-driven inflation? Stars are easy to fake: an ICSE 2026 study found about six million suspected fake stars on GitHub from 2019 to 2024, used mostly to push malware repositories but also AI and LLM projects. That proves nothing about OpenClaw's count, but it's why a star count alone can't settle the question.

Here's what bugs me about star-count arguments: they assume stars and adoption are the same thing. They're not. Stars measure interest, curiosity, and FOMO as much as actual usage. The better metrics are commits (80,000+ by August 2026), contributors (987 on the 2.0 release alone), and release cadence (seven stable releases in September 2026 alone).

What matters more is whether the product delivers enough value to keep its momentum once the hype cycle ends.

What OpenClaw Gets Right About AI Agents

Strip away the viral growth and security drama. What actually works?

Local-first architecture addresses real privacy concerns: Cloud AI assistants require trusting providers with sensitive data. OpenClaw narrows that trust to the model provider and chat apps you choose, and a local model narrows it further.

Integration with existing tools reduces friction: You don't need to adopt new productivity apps. The agent works within your current workflow.

Open-source code enables customization and auditing: Enterprises can review source code, modify functionality, and deploy without vendor lock-in.

Community-driven development accelerates feature velocity: More than 80,000 commits in its first nine months outpaces most commercial development teams.

MIT license removes adoption barriers: No licensing fees, usage restrictions, or vendor negotiations.

These advantages explain why the project gained traction despite immature security practices. The core value proposition resonates with developers and privacy-conscious users.

Where OpenClaw Stands in September 2026

The foundation that was a promise in February now runs the project, and OpenClaw has since had something the viral phase lacked: a professional security audit. Trail of Bits reviewed OpenClaw through OpenAI's Patch the Planet initiative and filed 24 severity-rated reports (2 High, 16 Medium, 6 Low, none Critical). The project says every actionable issue is fixed in 2026.8.1.

What hasn't changed is the security defaults. Version 2.0 made OpenClaw far easier to install, but sandboxing is still off by default and stored secrets are still unencrypted at rest, which is what The Register's review of 2.0 criticized.

The governance transition addresses the biggest criticism of OpenClaw's viral phase: that explosive growth outpaced institutional maturity. Security defaults are the part it still has to fix.

Frequently Asked Questions

Conclusion

OpenClaw represents both the promise and peril of open-source AI agents. The technical achievement is real: a local-first assistant that automates daily workflows while keeping data under user control, backed by more than 80,000 commits.

But the security problems exposed by rapid growth (hundreds of malicious skills, a one-click RCE bug and more than 30,000 exposed instances) show what happens when viral adoption outpaces security maturation.

The rebrand chaos ultimately worked: it kept the project in the news through its viral January, and the stars kept climbing past 390,000. Whether those stars represent sustainable adoption or hype-driven inflation matters less than whether the foundation can mature security practices fast enough to support enterprise deployment.

For teams evaluating OpenClaw in 2026, the central question isn't whether it can automate tasks (the showcase suggests it can) but whether you can deploy it securely without opening supply chain attack surfaces. The project's future depends on that answer.

← Back to the blog