OpenClaw is the open source AI agent that lives on your own computer and takes orders through WhatsApp, Telegram, Slack and two dozen other chat apps. It reads and writes files, runs shell commands, browses the web, fills in forms and remembers your preferences. In short, it is an assistant that acts, beyond one that only chats.
It is also one of the fastest growing software projects ever. OpenClaw passes React as the most starred software project on GitHub and now sits near 393,000 stars. It comes with real risks too: three serious security flaws, hundreds of malicious add ons and API bills that shock new users.
In this OpenClaw review, I have analyzed features, real costs, pros, cons, limits, scores, user views and the best alternatives.
- TL;DR
- What Is OpenClaw?
- OpenClaw Timeline: From Clawdbot to Foundation
- OpenClaw Key Features
- How to Install OpenClaw
- OpenClaw Pricing
- OpenClaw Security
- OpenClaw Pros
- OpenClaw Cons
- OpenClaw Limitations
- OpenClaw Feature Ratings
- OpenClaw User Reviews
- Who Should Use OpenClaw?
- Best OpenClaw Alternatives
- Final Verdict on OpenClaw
- OpenClaw Review FAQs
TL;DR
- OpenClaw is a free, MIT licensed AI agent that runs on Mac, Windows, Linux or a server.
- You chat with it through 29 channels, from WhatsApp and Telegram to Slack, Teams and iMessage.
- It works with Claude, GPT, Gemini, DeepSeek, Mistral and local models through Ollama or LM Studio.
- The software is free, and model usage runs from about $7 to $1,500+ a month.
- ClawHub offers more than 67,000 skills, though early scans find hundreds of malicious ones.
- Three serious flaws, one of them a one click takeover, get fixed early on.
- A Trail of Bits audit finds 27 issues, zero critical, all now patched.
- Version 2.0 makes setup simpler and lets you reuse ChatGPT or Claude logins.
- The sandbox still stays off by default, and secrets sit unencrypted at rest.
- Creator Peter Steinberger now works at OpenAI, and a non profit foundation runs the project.
- Microsoft Autopilot and services from Tencent and Z.ai build on OpenClaw.
- My final rating: 7.7 out of 10, great for tinkerers, risky for anyone who skips security.
What Is OpenClaw?
OpenClaw is a personal AI agent that runs on your own machine. A central Gateway process runs on your machine, connects to the AI model of your choice and listens for messages in your chat apps. You text it like a person, and it carries out the task: sort your inbox, add a meeting, check you in for a flight, research hotels or write code.
It keeps a persistent memory of your preferences, projects and contacts, runs scheduled jobs and reacts to triggers such as a new Gmail message or a webhook. One install serves a whole team, and several agents hand tasks to each other.
If the idea of software that takes action on its own is new to you, this guide to agentic AI vs generative AI explains how agents differ from chatbots.
OpenClaw Timeline: From Clawdbot to Foundation
Key Moments in OpenClaw History
| Date | Event |
|---|---|
| November 2025 | Peter Steinberger publishes the first version as Warelay |
| January 2026 | Renamed Clawdbot, then Moltbot after a trademark complaint, then OpenClaw |
| February 2026 | Steinberger joins OpenAI, and the project moves toward a foundation |
| March 2026 | OpenClaw passes React as the most starred software project on GitHub |
| April 2026 | Claude subscriptions stop covering OpenClaw use, which moves to paid extra usage |
| July 2026 | The OpenClaw Foundation launches as a US non profit |
| August 2026 | OpenClaw 2.0 ships with simpler setup and shared sessions |
| September 2026 | Trail of Bits audit results, Microsoft Autopilot and OpenClaw Enterprise arrive |
The project moves at a wild pace: 106 releases in 230 days before 2.0, 933 contributors and more than 16,000 pull requests. That speed brings new features weekly, along with rough patches, such as a spring release that slows gateways and breaks channels.
OpenClaw Key Features
Chat From Any App
OpenClaw connects to 29 channels. The main ones are WhatsApp, Telegram, Discord, Slack, Signal, iMessage and Teams. LINE, WeChat, SMS and X work too. You give orders from the app you already use all day.
Bring Any AI Model
You pick the brain. OpenClaw works with Claude, GPT, Gemini, Mistral, DeepSeek, Grok and more. Routers like OpenRouter also plug in. For privacy or cost, local models run through Ollama, LM Studio, vLLM or SGLang. Version 2.0 also reuses an existing ChatGPT or Claude login.
Computer and Browser Control
The agent reads and writes files, runs shell commands and controls a browser, either its own, a remote one or your Chrome through an extension. Connected devices called Nodes add camera, media and screen control. You pick full system access or a sandbox through Docker, Podman, SSH or OpenShell.
Persistent Memory
OpenClaw remembers people, plans and likes from one chat to the next. Active memory keeps key facts close, and a Dreaming mode tidies older context in the background so long running agents stay sharp.
Automation and Triggers
Scheduled jobs, webhooks, Gmail and IMAP triggers and hooks let the agent work while you sleep. A daily briefing, a weekly report or an alert on a new support email all run on their own.
ClawHub Skills
ClawHub is the add on store, with more than 67,000 skills. Top picks include a self improving agent, Skill Vetter and skills for Google Workspace, WhatsApp and GitHub. Skill Workshop turns a finished task into a skill you reuse later. Skills work much like MCP connections, and these SEO MCP servers show the kind of tools agents plug into.
Apps for Every Device
Desktop apps run on macOS 15+, Windows 10 and 11 and Linux, with Android and iOS apps too. The Windows app comes from Microsoft, which builds its Autopilot product on OpenClaw.
Team and Enterprise Options
Version 2.0 adds shared sessions for teams. OpenClaw Enterprise comes from Red Hat and NVIDIA. It adds walls between teams, a sandbox and audit logs. It stays free and open source, but sits before version 1.0 and fits pilots only.
How to Install OpenClaw
Setup takes a few minutes on a modern machine:
- Run the one line installer:
curl -fsSL https://openclaw.ai/install.sh | bash. - Start the guided setup with
openclaw onboard. - Pick your AI model and paste an API key, or sign in with ChatGPT or Claude.
- Connect a chat app such as Telegram or WhatsApp.
- Choose sandbox or full access, and set approval rules for risky commands.
Developers also install it through npm i -g openclaw or from source. Node.js installs on its own.
OpenClaw Pricing
OpenClaw itself is free under the MIT license, with zero subscription, zero paid cloud plan and zero token. The real bill comes from the AI model and, if you use one, a server.
Typical Monthly OpenClaw Costs
| User Type | Monthly Cost |
|---|---|
| Personal use | About $7 to $15 |
| Power user | About $25 to $80 |
| Small team | About $60 to $200 |
| High volume | $500 to $1,500+ |
| VPS hosting | About $3 to $12 |
Costs climb fast. Every message sends the full conversation context, and the default 30 minute heartbeat alone burns about $85 a month on a top model. Users report bills of $50 and even $250 in a single day. Claude plans now leave OpenClaw out, so Claude users pay for extra usage.
OpenClaw Security
Security is the big worry. Here is the record so far:
- One click takeover: CVE-2026-25253 (score 8.8) lets a malicious link steal the access token and run code. A fix lands within days.
- Two more serious flaws: an SSH command injection in the macOS app and a Docker sandbox escape, both patched in the same release.
- Exposed installs: scans find 40,000+ installs open to the web. Over 12,800 let an attacker run code, since early builds listen on every network.
- Malicious skills: Koi Security finds 341 harmful skills out of 2,857, carrying a Mac password stealer and a Windows keylogger. ClawHub then pulls 2,400+ shady skills.
- Risky skills: Snyk finds at least one security issue in 36.8% of 3,984 skills.
- Memory poisoning: a researcher sends the same email again and again until the agent forwards private messages.
- Audit: Trail of Bits finds 27 issues, 2 high and zero critical, all fixed.
The team fights back. Every skill now gets a virus scan, and risky commands need approval. Installs that would open the gateway to the web with zero password now get blocked. Still, the sandbox stays off by default and secrets are stored unencrypted. Agents like OpenClaw also add to the wave of automated web traffic, as these bot traffic statistics show.
OpenClaw Pros
- Free and open source under the MIT license.
- Works inside 29 chat apps you already use.
- Works with almost every big AI model, plus local ones.
- Real actions: files, shell, browser, email and calendar.
- Long term memory makes it feel like a real helper.
- Huge skill store and a busy, helpful crowd of users.
- Backed by a non profit foundation, OpenAI, Microsoft, NVIDIA and Red Hat.
OpenClaw Cons
- API costs spiral fast unless you set limits.
- Weak security defaults, with the sandbox off out of the box.
- Malicious and risky skills on ClawHub.
- Fast releases bring bugs and breaking changes.
- Setup and safe use need command line skills.
OpenClaw Limitations
- Response times grow as context piles up, from about 2 seconds to nearly 2 minutes in one test.
- Shared sessions are a handy shortcut, but they keep zero real wall between users.
- OpenClaw Enterprise is pre 1.0 and suited to pilots only.
- ClawHub has zero checks on who publishes a skill.
- Claude plans now leave OpenClaw out, which adds cost for Claude fans.
- Some regions restrict it, with Beijing barring state firms and banks.
OpenClaw Feature Ratings
OpenClaw Ratings by Feature
| Feature | Score out of 10 |
|---|---|
| Integrations and channels | 9.5 |
| Model flexibility | 9.5 |
| Automation | 9.0 |
| Community and skills | 9.0 |
| Memory | 8.0 |
| Documentation | 7.5 |
| Setup | 6.5 |
| Ease of use | 6.0 |
| Cost control | 6.0 |
| Security | 5.5 |
| Final score | 7.7 |
The final score is the average of the ten scores above. OpenClaw wins on reach and flexibility and loses points on safety and cost.
OpenClaw User Reviews
Views split hard. Fans love the power, and critics worry about risk and cost.
- MacStories: Federico Viticci runs it on a Mac mini with Claude through Telegram and praises how personal it feels, from smart home control to voice and features it adds to itself.
- Toms Guide: Amanda Caswell calls it ground breaking but adds that it is a poor fit for her. It finishes a hotel research and email task, yet makes mistakes and needs broad access.
- Platformer: praises the flexibility and open license, yet calls it too complex and risky for casual users.
- Hacker News users: complain about API bills and call it a security mess, and some switch to local models to cut costs.
- LeBigData: calls the setup unstable and points to plain text credentials and slow replies, and points pro users to other tools.
- A project maintainer: warns it is far too dangerous for people who struggle with the command line.
Who Should Use OpenClaw?
OpenClaw fits developers, tinkerers and technical founders who want a strong assistant they control and who know how to lock down a server. It also fits teams testing agent workflows, such as sales follow ups, reports or SEO automation.
Skip it if you want a set and forget tool, handle sensitive client data with zero security know how or need fixed monthly costs. A managed agent or a dedicated AI sales assistant fits those needs better.
Best OpenClaw Alternatives
1. NanoClaw
NanoClaw is a free agent that runs each task inside a sealed box by default. That narrow boundary limits the damage a bad skill or prompt injection does. Pick it if you like the OpenClaw idea but want stronger isolation from day one.
2. Hermes Agent
Hermes Agent is a lean, MIT licensed agent with clearer security boundaries. Its skill library is far smaller, so it fits people who want a tidy core over endless add ons.
3. Claude Cowork
Claude Cowork is a managed desktop agent from Anthropic, included in Claude Pro at $20 a month and Max plans at $100 or $200. You give up some local control, but skip server setup, security hardening and surprise API bills.
4. Perplexity Computer
Perplexity Computer is a cloud agent focused on research tasks, priced from $20 to $325 a month. It fits people who want strong web research and a managed setup over full system access.
5. TrustClaw
TrustClaw copies the OpenClaw idea but limits what each app is allowed to touch and runs tasks in a sandbox. It fits businesses that want agent power with tighter guardrails.
6. ZeroClaw and PicoClaw
ZeroClaw packs an agent into a small Rust binary, and PicoClaw targets low power and edge devices in Go. Both fit developers who want a light, fast agent on small hardware.
For AI tools that search and answer on your behalf, see this list of AI search engines.
Final Verdict on OpenClaw
OpenClaw is the strongest free personal AI agent around today. It lives in your chat apps, works with almost any model and actually gets things done. The community, the foundation and backing from OpenAI and Microsoft give it a strong future.
The price of that power is risk. Weak defaults, a messy skill store and fast rising API bills mean you need to treat it like a server you manage, beyond an app you install. With a sandbox, spending limits and vetted skills, it earns its 7.7 out of 10.
OpenClaw Review FAQs
Is OpenClaw Free?
Yes. The software is free under the MIT license. You pay for the AI model you connect and any server you run it on.
Is OpenClaw Safe to Use?
It is safe enough with care: turn on the sandbox, keep the gateway off the open internet, set spending limits and install only vetted skills. Default settings leave real gaps.
What Was OpenClaw Called Before?
It starts as Warelay, then becomes Clawdbot and Moltbot before taking the OpenClaw name.
Which AI Models Work With OpenClaw?
Claude, GPT, Gemini, DeepSeek, Mistral, Grok, Bedrock models and local models through Ollama, LM Studio, vLLM and SGLang.
How Much Does OpenClaw Cost Each Month?
Light personal use costs about $7 to $15 a month in model fees. Heavy use runs $25 to $80, and high volume setups pass $500.
Find more tool reviews:
