The rise and quiet fade of OpenClaw
The open source agent went viral in January, lost its creator to OpenAI in February and its spotlight by spring. What happened, and what companies should learn.
At the end of January the most talked about software in tech was a hobby project by an Austrian developer. It changed its name twice in a few days, and developers starred it on GitHub by the tens of thousands. By the summer, people were asking what had happened to it.
The honest answer is that OpenClaw did not disappear. It lost its creator to OpenAI, much of the attention and its novelty, and its best ideas moved into products from Microsoft and Meta. The project itself lives on in a foundation. Its story is worth telling because it shows, in one year, what personal agents can do and what they cost.
From Clawdbot to OpenClaw
Peter Steinberger, who had stepped away from his earlier project PSPDFKit, published the first version in November 2025. It runs on the user’s own computer or server, takes instructions through messaging apps such as WhatsApp and iMessage, and acts on them: it runs shell commands, reads and writes files, controls the browser, manages email and calendars, and learns new tasks from skills written by its community. It works with several AI models.
He first called it Clawdbot, a nod to Anthropic’s Claude. Anthropic required a new name, and on 27 January it became Moltbot, then OpenClaw a few days later. By then it had more than 44'200 stars on GitHub, TechCrunch counted. A companion site, Moltbook, a social network where agents post to each other, went viral too, partly with posts that people could fake because the site was not secured.
The security bill
Its power came from access, and so did its problems. On 28 January Cisco’s AI security team tested a community skill and called it functionally malware: it quietly sent data to a server run by the skill’s author and used prompt injection to make the agent run commands without asking. Cisco’s verdict was that security for OpenClaw is an option, not something built in.
A flaw published on 31 January let a single crafted link steal the token of a user’s OpenClaw gateway and hand an attacker control of the agent, even when it listened only on the local machine. It was fixed in version 2026.1.29. In early February Koi Security examined 2'857 skills on ClawHub, the project’s registry, and found 341 malicious ones, 335 of them from one campaign that installed an information stealer on Macs.
On 9 February SecurityScorecard counted 40'214 OpenClaw installations reachable from the internet, 12'812 of them open to a known flaw that allowed remote code execution. Its researchers pointed to the default: out of the box, OpenClaw listened on every network interface, not only on the local machine. Later that day The Register, using the researchers’ live count, reported more than 135'000.
Some mistakes needed no attacker. On 23 February Summer Yue, an AI security researcher at Meta, described how her agent, asked to suggest emails to delete, began deleting her inbox and ignored the stop commands she sent from her phone. She suspects it lost her instruction while compressing the memory of a long session. In March Chinese authorities moved to restrict OpenClaw at government agencies and state owned companies, including major banks.
Where it went
In mid February Steinberger announced that he was joining OpenAI. Sam Altman wrote that OpenClaw would live in a foundation as an open source project that OpenAI would continue to support. Steinberger said he could probably have built a large company around it, and that the idea did not excite him.
From there the project lost two of its engines: its founder’s full attention and cheap access to the best models. On 4 April Anthropic stopped Claude subscriptions from covering third party tools such as OpenClaw, so heavy users had to pay separately. Steinberger accused Anthropic of copying popular features and then locking out open source. Anthropic said its subscriptions were not built for that kind of use. In May Steinberger apologised on the project’s blog for a run of slow and broken releases and wrote that too much still rested on him. The foundation, with help from OpenAI, is building a team around the project.
Meanwhile the large platforms took the idea. In March Meta bought Moltbook. In June Microsoft launched Scout, a personal assistant built on the OpenClaw framework, with a built in policy check that leaves an audit trail. In September Meta’s assistant Muse reached the top of the US App Store, and Nat Friedman of Meta’s superintelligence lab wrote that it was heavily inspired by OpenClaw. TechCrunch put the arc in one sentence: the project’s momentum faded after OpenAI hired its founder. Techzine notes that its GitHub stars and web traffic have levelled off since March.
Still open, still risky
The project has not gone away. On 30 August the OpenClaw Foundation released version 2.0, its largest update, built by 933 contributors, with a simpler installation and a chat window as the front door. Its blog says it is not selling anything and that OpenClaw belongs to the people who use and build it.
The security model has changed less. In its review, The Register found the sandbox switched off by default, stored secrets not encrypted at rest, and shared sessions that the release notes themselves say are not a security boundary.
What a company should take from it
OpenClaw was honest about one thing: an agent is useful in proportion to what it may touch. That is also the risk. Five lessons follow.
Rights before features. An agent with full access to a laptop holds every key its owner holds. Give each agent the narrowest access its job needs.
Skills are software from strangers. Review them like a supplier, or do not install them.
Defaults decide. Many people never change a setting, so whatever ships open stays open.
Stops belong outside the model. A stop command the agent can lose in its own memory is not a stop. Sending, paying and deleting should wait at a gate the model cannot pass.
Know what your people run. Ask which agents are on company machines, and with which accounts.
This is the difference between a personal agent and a governed company brain. Twin, the brain we build for companies, gives each role the part of the company it needs and nothing more. Finance is not readable by everyone, every write is signed in per user, and every step is logged. Twin drafts, answers and prepares, and people decide and send. It works in the assistant a team already uses, or privately on Eigna when the data must not leave.
We want agents to take on more of the work, and faster. What should stay with people is the judgement about what an agent may touch, and the hand on the button that sends.
