OpenClaw: a self-hosted AI assistant you message on Telegram/WhatsApp that does real work on your machine

In early 2026 an open-source project called OpenClaw gained GitHub stars at a rarely seen pace: according to Elestio, about 190,000 stars within two weeks and more than 250,000 by early March — overtaking React. The reason: it turns AI from a “chat window” into an assistant running on your own machine, taking orders via Telegram, WhatsApp, Slack… and doing real work: reading email, running commands, driving a browser, running scheduled jobs. This article explains what OpenClaw is and how it’s built — and, more importantly, the security problems that have actually happened.

Origins

• Created by Austrian developer Peter Steinberger (founder of PSPDFKit); the first prototype took about an hour.
• Originally named Clawdbot, renamed Moltbot after a trademark concern from Anthropic, then OpenClaw.
• MIT licensed. In February 2026 the author joined OpenAI; the project moved to an independent 501(c)(3) foundation that OpenAI sponsors but doesn’t own.

Architecture

The model is your choice: Claude via Anthropic’s API is a common setup, alongside GPT, Gemini, Mistral or local models via Ollama. Beyond chat, OpenClaw automates a managed Chromium browser, runs scheduled jobs (cron, webhooks) and supports voice on mobile.

Installation

# Option 1: npm (Node.js 22+, at least ~2 GB RAM)
npm install -g openclaw
# then run the onboarding wizard per the official docs (docs.openclaw.ai)

# Option 2: Docker Compose — mount config and workspace directories as volumes

Afterwards, run openclaw doctor regularly to catch misconfigured policies.

What people use it for

• Messaging from your phone: “summarise my unread email”, “remind me to review the PR at 4 pm”.
• A 7 am briefing: meetings, important emails, dashboard numbers.
• Monitoring websites, collecting reports, running periodic scripts.
• A personal assistant with long-term memory, independent of any single chat vendor.

The dark side: security incidents that happened

This is the most important part. An agent with shell access that reads email and takes orders from chat apps is a huge attack surface — and reality has proven it:

By default, OpenClaw’s main session has full host access. Combined with accepting messages from outside, that is exactly the “lethal trifecta”: untrusted input + private data + a way to send data out.

Minimum safe configuration

1. Bind to localhost only and enable authentication on the Gateway.
2. Run it on a VM or dedicated machine, not your main work laptop holding company credentials.
3. Sandbox untrusted sessions: set agents.defaults.sandbox.mode (e.g. "non-main") for group/channel sessions you don’t fully control.
4. DM policy = "pairing" so unknown senders can’t trigger the agent.
5. Read skills before installing — treat each one as code running with your permissions.
6. Update often and run openclaw doctor.
7. Never give a personal agent production credentials.

How to apply it

• Developers: To try it, set it up on a cheap VPS or dedicated VM, connect only your own chat channel, and skip community skills at first. Prove the value, then widen permissions.
• Tech Leads / security: Scan your network for OpenClaw instances staff may have set up with exposed ports. Add “self-hosted agents” to your company AI-usage policy.
• PMs: OpenClaw shows the “agent wherever you chat” trend. For internal products, the gateway + chat channel + skills architecture is worth learning — but design for least privilege and human approval of outbound actions from day one.