The Register / Personal & desktop agents / OpenClaw

OpenClaw

Name: OpenClaw
Author: OpenClaw Foundation (created by Peter Steinberger)

OpenClaw runs a local Gateway on the user's machine or server and exposes an LLM agent through chat apps such as WhatsApp, Telegram, Slack, Discord, iMessage and Signal, plus a browser Control UI. The agent can read and write files, run shell commands, browse, call APIs and run scheduled tasks, and is extended through skills and plugins (including the ClawHub registry). It is MIT-licensed, stewarded by the OpenClaw Foundation, and version 2.0 (v2026.8.1, 30 Aug 2026) added shared cloud sessions and a rebuilt web UI. It has had a large number of published security advisories and a malicious-skills supply-chain campaign in 2026.

openclaw.ai Source repository Docs Pricing Add to compare

What reviewers and users praise

Broad reach into everyday tools; users report automating real business workflows (HN, Reddit)
Large, fast-moving open-source project with hundreds of contributors per release
Highly customisable: multiple agents, per-project threads, local or hosted models

What they criticise

Security exposure: repeated advisories, a 2026 malicious-skill campaign, and a trusted-operator default with sandboxing off
Upgrades frequently break installs; users report hours of repair work after 2.0 and 2026.7.x updates
Setup and maintenance are demanding for non-technical users
Newer safety limits removed capabilities some users relied on

Rating certificate · AW/26-09/22226 Sept 2026

63of 100

OpenClaw

OpenClaw Foundation (created by Peter Steinberger) · Personal & desktop agents

No. 2 of 3 in categoryhigh confidenceTrust BOpen source

Adoption98

Experts59

Crowd37

Experts vs the crowdcrowd cooler by 22

Experts59

Crowd37

Price	Free
Use it via	CLI, Desktop app, Web app, Mobile app, Chat apps
Runs on	macos, linux, windows
Licence	MIT
Updated	Evidence collected 26 Sept 2026

How the rating was worked out

Weights for Personal & desktop agents: adoption 30%, experts 35%, crowd 35%. Pillars without enough evidence are left out and the others re-weighted. The method.

Adoption & momentumweight 30%	98	GitHub stars `391k` → 100 · npm weekly downloads `2.8M` → 93 · `31` releases in 90 days → 100 reach × 0.7 + momentum × 0.3
Expertsindependent reviews · weight 35%	59	8 independent reviews (3 positive · 4 mixed · 1 negative), averaged toward 50 for small samples.
Crowdcommunity sample · weight 35%	37	25 dated posts from reddit, hackernews, x: 6 positive · 5 mixed · 14 negative (positive + ½ mixed) ÷ n, averaged toward 50 for small samples
Rating	63	high confidence (3 of 3 pillars, 25 community posts).

Evidence checks. 4 items could not be checked at the source (the page could not be fetched, or the quote is from a comment under the linked post); kept and marked “unverified”. How evidence is checked.

Editorial adjustment. Incident-history re-grade under methodology revision 2 (see the trust section).

Trust & safety

Seven dimensions graded A–D from documented facts. Overall: B.

Permission model

Exec approvals docs: an unconfigured node uses the same `full` / `off` (security full, ask off) baseline as the Gateway, i.e. trusted-operator auto-execution. Tool sandboxing (Docker/Podman/OpenShell) is opt-in via a documented 'minimal enable example'; an independent review notes sandboxing is off by default. source

Data access scope

Default trusted-operator model gives the agent broad host access; docs describe group allowlists, mention gating, root-bounded file operations and per-agent sandbox workspaceAccess settings. source

Data storage

Self-hosted; 'On a regular host install the Gateway binds to loopback.' State lives in ~/.openclaw on the host. Shared cloud sessions (2.0) are optional. source

n/e

Data retention & training

No vendor-hosted data store for the self-hosted product; retention/training depends on the model provider the user connects. No documented retention or no-training statement found for the optional cloud sessions. source

Incident history (24 months)

Repeated serious issues: CVE-2026-25253 one-click token exfiltration (CVSS 8.8, Feb 2026); ClawHavoc malicious-skill campaign on ClawHub (341+ skills, AMOS stealer); 722 published GitHub security advisories Jan–Sep 2026 including 14 critical (e.g. sandbox escape, node RCE via approval bypass), with 75 more published in Sep 2026. Fixes are released, but the pattern is ongoing. Regraded from D: Revision 2: serious issues that were each fixed and publicly disclosed grade C; D is kept for unresolved issues or slow or undisclosed fixes. source

Compliance

No SOC 2 / ISO 27001 attestation found; community open-source project run by a non-profit foundation. source

Transparency

MIT licence (Copyright OpenClaw Foundation); public GitHub releases and per-version release notes on docs.openclaw.ai; public security advisories. source

The experts

8 named independent reviews found; dated reviews from the last 12 months are scored.

mixed
Given the inherent risk of prompt injection against this class of software it’s my current pick for most likely to result in a Challenger disasterSimon Willison (simonwillison.net) · 30 Jan 2026 · simonwillison.net
positive
It's leagues better than any other 'agent' experience I've triedDan Cleary (PromptHub newsletter) · 17 Feb 2026 · danjcleary.substack.com
mixed
Sandboxing is off by default, and the Gateway plus native plugins remain outside it.Omid Saffari · 8 Aug 2026 · omidsaffari.com
positive
OpenClaw 2.0 is a meaningful usability leap for one of the most capable open personal-agent systemsThe Rundown AI · 31 Aug 2026 · therundown.ai
negative
Is OpenClaw ready for mainstream UX work? The honest answer is not yet. The friction is too high.Yuval Keshtcher (UX Writing Hub) · 30 Jan 2026 · uxwritinghub.com
mixed
Right now, OpenClaw feels built by developers, for developers. The power is there—honestly, it’s so good.Wyndo (The AI Maker newsletter) · 5 Feb 2026 · aimaker.substack.com
mixed
The gap between "this technically works" and "I trust this with my actual data" is still too wide for me.Likhit Kumar V P (DEV) · 8 Feb 2026 · dev.to
positive
So. Would I recommend OpenClaw? Yes. But with conditions.Radek Sienkiewicz (VelvetShark) · 26 Feb 2026 · velvetshark.com

The crowd

25 coded posts from reddit, hackernews, x.

6 positive5 mixed14 negative

positive
Hey everyone, I love OpenClaw. It’s probably my favorite piece of software I’ve ever used.r/openclaw · 24 Sept 2026 · reddit.com
negative
I just had to nuke and start my openclaw install fresh after none of the AIs could walk me through fixing it.r/openclaw · 22 Sept 2026 · reddit.com
negative
Now, if i send credentials, my agent keeps saying that he is not allowed to save them in a file or even use them to login!r/openclaw · 20 Sept 2026 · reddit.com
positive
Openclaw works better for my use case. It lets me use telegram "threads" for each separate projectr/openclaw · 20 Sept 2026 · unverified · reddit.com
mixed
If I could start all over again, I would start with Hermes. It's much more reliable.r/openclaw · 20 Sept 2026 · unverified · reddit.com
negative
Don't do it folks. Just wait. Torched my 2026.7.x install.r/openclaw · 31 Aug 2026 · unverified · reddit.com
negative
The frustrating part is that I’ve had to dedicate one agent solely to OpenClaw maintenance because of recent issuesr/openclaw · 16 Aug 2026 · unverified · reddit.com
mixed
I think openclaw is useful, loop, memory, agents, integrations, but after a week a testing, honestly I don't need it much.r/LocalLLaMA · 22 Feb 2026 · reddit.com

Pricing

As published, checked 26 Sept 2026.

Plan	Price	Notes
Open source (self-hosted)	Free	Homepage states: "No subscription. No hosted tier. No token." Users pay for model access, hardware and any connected services.

Recent changes

23 Sept 2026
v2026.9.6: adds Claude Opus 5.5, GPT-6 Sol/Luna and Grok 4.7 model choices, managed update results, conversation recovery after restarts. source
19 Sept 2026
v2026.9.5: atomic updates that check the next version before switching, plugin hot reloading, conversation sharing. source
30 Aug 2026
OpenClaw 2.0 (v2026.8.1): shared cloud sessions, rebuilt browser Control UI, guided setup using existing subscriptions, session permission modes; after a ~7-week release pause. source
23 Jun 2026
Palo Alto Unit 42 publishes analysis of continued malicious skills on ClawHub (Feb–May 2026). source

Ranked alongside

Other ranked entries in Personal & desktop agents.

Compare with the top two

Hermes AgentNous Research69

ZeroClawZeroClaw Labs61

Sources

Every figure above traces to one of these, observed up to 26 Sept 2026.