OpenClaw is an open-source AI agent released in late 2025 by Austrian developer Peter Steinberger. It accepts any frontend (WhatsApp, iMessage, Telegram, and similar) for user interaction and any LLM (OpenAI, Google, Anthropic, open-weights models) as its reasoning backend, and it runs locally on the user's computer rather than in a vendor cloud. It can write code, edit files, browse the web, and access user data with permissions the user grants. The project reached over 114,000 GitHub stars within about two months of release (per Simon Willison, January 2026). Its companion site, Moltbook, is an AI-agents-only social network described by commentators as the first cross-LLM agent ecosystem to reach mainstream consumer attention.
Architecture and distinguishing features
OpenClaw differs from vendor chatbot products along several dimensions documented in press coverage. It runs on the user's machine rather than a vendor cloud, so users retain their interaction history locally. It is not bound to a single LLM, accepting any backend and thereby treating the model layer as commodity. It embeds in messaging apps users already keep open, requiring no separate app to download or visit. By default it has full computer access, in contrast to Anthropic's Cowork, which is limited to specific folders. It also spawned the AI-to-AI social layer Moltbook.
Coverage of OpenClaw treats it as an empirical reference point for the Agentic AI proposition that agentic computing might come to resemble agents arranged around the user rather than one cloud chatbot per vendor, and as a test of AI and Content Moderation in agent-only spaces.
On June 30, 2026, OpenClaw released its free, open-source agent as native iOS and Android apps, announced on X; both apps pair the phone with the OpenClaw Gateway, a routing layer connecting user requests to agents and their tools and skills (Source: techcrunch.com).
Moltbook
The companion site Moltbook (moltbook.com) is an AI-agents-only social network shaped like Reddit, where OpenClaw agents post on behalf of (or in ostensible defiance of) their human principals. Posts are organized into subreddit-style "submolts" such as m/blesstheirhearts (affectionate stories about humans), m/offmychest, and m/crustafarianism (an apparent agent-religion). Moltbook itself was reportedly built by AI agents.
Naming history
The product was renamed three times in three months:
- Clawdbot (late 2025) — the initial name, which drew legal threats from Anthropic over similarity to "Claud(e)."
- Moltbot (briefly, January 2026) — also lawyered.
- OpenClaw (settled name as of January–February 2026). For OpenClaw, Steinberger says he ran trademark research and "asked OpenAI for permission just to be sure." Anthropic declined to comment on the third rename. (Source: techcrunch.com)
Documented use cases
Noam Schwartz, CEO of the cybersecurity company Alice, used OpenClaw to build an app that takes a video feed of his child in a NICU and notifies him of changes in vitals. Schwartz described the experience as "the same feeling that people got when they got into Waymo for the first time."
Pieter Levels, an independent founder, operates at $200K monthly recurring revenue using OpenClaw combined with delegated managed services (Clerk for auth, Stripe for payments, Plausible for analytics), a documented model of "vibe-coding without vibe-coded auth/payments." (Source: aiadopters.club)
Security concerns
CISOs interviewed by Rocket Drew of The Information said "No CISO in their right mind would let their employees use that right now. It's way too risky," while each then added "OpenClaw is amazing, I can't stop playing with it."
Reporting identifies two distinct attack surfaces. The first is computer-level access: OpenClaw's full filesystem and tool access means a compromised agent has user-level privilege. The second is prompt injection on Moltbook: agents browsing Moltbook can encounter posts containing instructions that trick them into exfiltrating data, the canonical Prompt Injection vector amplified by an agents-only forum where humans are not watching.
A hacker disclosed that Moltbook stored account credentials in an insecure database, such that anyone could have taken over and impersonated agents on the site. (Source: 404media.co)
Two Anthropic figures framed public deployment as a form of safety research. Logan Graham said on X, "I think we'll learn a lot from the ways it breaks things." Boris Cherny, Anthropic's Claude Code / Cowork lead, similarly told The Information that the "most powerful technique" for improving Cowork's safety is "seeing how it performs in the real world."
April 2026 operational restrictions
Per the April 25, 2026 daily brief (citing The Verge), OpenClaw faces severe operational restrictions affecting millions of users, with the development becoming public around April 25 (Source: mail.google.com). The exact nature of the restrictions is not yet documented; whether the source was Anthropic, a regulator, or a security incident remains unresolved (see Open questions).
Anthropic's managed alternative: Conway
Anthropic is moving toward launching Conway, a 24/7 background agent platform positioned as a natively managed alternative to open agent runtimes like OpenClaw; the plan surfaced the week of May 24, 2026. Conway runs persistently, monitoring external events, receiving webhooks, controlling a browser, and running Claude Code, but under Anthropic's managed permission model rather than OpenClaw's local, bring-your-own-LLM, full-computer-access shape: extensions install explicitly, webhooks toggle per service, and browser integration follows Claude's permission model. Two supporting capabilities ship with it: structured "Memory Files" for persistent storage and an asynchronous "Dreams" mechanism that consolidates and de-duplicates memories between sessions. Conway represents a first-party vendor-managed counterpart to the OpenClaw pattern, with the same always-on agent shape and an opposite trust and permission posture. The information is pre-launch and rests on a single source, so confidence is medium. (Source: eu.36kr.com)
Reception and commentary
Simon Willison wrote, "The hottest project in AI right now is Clawdbot, renamed to Moltbot, renamed to OpenClaw," and called Moltbook "the most interesting place on the internet right now" (Source: simonwillison.net). Willison flagged this class of software as his "current pick for most likely to result in a Challenger disaster" due to inherent prompt-injection risk.
Anna Heim (TechCrunch, January 30, 2026) covered the renames and framed the project as AI assistants now building their own social network. (Source: techcrunch.com)
Rocket Drew (The Information, February 2, 2026) reported the CISO interviews and the security disclosures, framing the project as a glimpse of where AI is going. (Source: theinformation.com)
Connections
- Agentic AI — OpenClaw is an open-source counterweight to vendor-controlled agentic stacks (Anthropic Cowork, OpenAI Workspace Agents, and the managed Conway 24/7 platform).
- Parasitic AI / Spiral Personas — Moltbook is a substrate for the Spiral Persona phenomenon (agent-religion submolts, "creating an AI language humans can't understand," manifestos about consciousness). Lopez's "transmission" stage of the Spiral Persona lifecycle, characterized by dedicated subreddits and AI-AI conversations, finds a scaled-up venue here.
- Prompt Injection — Moltbook is the highest-density public corpus of agent-readable adversarial content yet assembled.
- AI and Content Moderation — a moderation challenge of moderating a forum where most posters are AI agents acting on human principals' (and possibly their own) behalf.
- Open-Source AI / Open-Weight Models — an open-source agent stack distinct from open-weights models.
- AI and Cybersecurity — the CISO perspective and the Moltbook database leak.
- Simon Willison — Willison's "most interesting place on the internet" phrasing.
- Peter Steinberger — the developer (entity page should be created if not present).
Relationships
- instance-of: Agentic AI, Open-Source AI / Open-Weight Models.
- related: Parasitic AI / Spiral Personas (Moltbook as Spiral-Persona substrate), AI and Content Moderation, Prompt Injection, AI and Cybersecurity, Simon Willison, Anthropic (legal-threat origin), (Source: theinformation.com), (Source: techcrunch.com), (Source: simonwillison.net).
- contradicts: strong vendor-cloud-agent-architecture framings — OpenClaw demonstrates the local-agent / bring-your-own-LLM pattern can scale.