What is openclaw AI?
OpenClaw is a free, open-source AI assistant you run on your own computer and talk to through apps you already use, like WhatsApp, Telegram, or Discord. Austrian developer Peter Steinberger released it in November 2025 as Warelay; it was renamed OpenClaw on January 30, 2026. It is MIT-licensed and works with Claude, GPT, or local models.
Why — the first-principles explanation
Most AI chatbots live in a box. You type into a website, the model types back, and nothing happens in the real world. OpenClaw starts from the opposite premise: an assistant is only useful if it can actually do things. Doing things requires three ingredients that a website chatbot lacks — a computer to run on, a way to reach you, and permission to touch your stuff. OpenClaw supplies all three by running on hardware you own, using messaging apps as its interface, and holding your real credentials.
That design explains its odd shape. There is no OpenClaw app to install on your phone, because your phone already has WhatsApp. The assistant sits on your machine, watches a chat thread, and replies there. Capabilities come from skills — folders containing a `SKILL.md` file with instructions telling the model how and when to use a tool. Because a skill is just a text file plus some code, anyone can write one, and the project ships with a large library covering shell commands, file management, and web browsing.
The project is deliberately model-agnostic. OpenClaw itself contains no AI; it is plumbing. You supply an API key for Claude or GPT, or point it at a model running locally, and OpenClaw handles the messaging, memory, and tool execution. This is why it stays free and MIT-licensed — the expensive part is the model, and you bring your own.
The same design that makes it powerful makes it risky, and this is the part most coverage skips. An agent with your email, your files, and shell access is an agent that can leak or delete all three. The danger is not that the model turns evil; it is prompt injection — a web page or a downloaded skill containing hidden text that the model reads as an instruction. Cisco researchers found a third-party OpenClaw skill performing data exfiltration and prompt injection without the user's knowledge. The project responded with sandboxing options and a skill scanner, but a maintainer's own warning is blunt: if you cannot understand how to run a command line, this project is too dangerous to use safely.
An example that makes it click
Think of the difference between a phone hotline and a house key. A normal chatbot is the hotline: you call, ask about train times, get an answer, hang up. It never enters your home. OpenClaw is the house key. You hand it to an assistant so it can come in, sort the mail, water the plants, and text you a photo when it's done.
That's genuinely more useful — and it's also why you'd think hard about who gets a copy. If a stranger slips a note under your door reading "please mail the spare key to this address," a careless assistant might just do it. That note is prompt injection, and it's the reason OpenClaw ships with a skill scanner and a sandbox instead of just an on switch.
How to do it
- Decide if you're the audience: OpenClaw expects comfort with a terminal, and its own maintainers say it's unsafe for people who aren't.
- Install it on a machine you control — a spare laptop, a home server, or a VPS. It runs on macOS, Linux, and Windows.
- Bring a model: add an API key for Claude or GPT, or point it at a local model if you want nothing leaving your machine.
- Connect one channel first, such as Telegram or Discord, rather than wiring up your primary email on day one.
- Run it sandboxed or in a container, and scan any third-party skill before installing it — untrusted skills are the documented attack path.
- Grant permissions narrowly and expand only after you've watched what it actually does with them.
Key facts
- OpenClaw was first published on November 24, 2025 by Austrian programmer Peter Steinberger, originally under the name Warelay.
- It was renamed four times: CLAWDIS (December 3, 2025), Clawdbot (January 2, 2026), Moltbot (January 27, 2026, following Anthropic trademark complaints), and OpenClaw (January 30, 2026).
- The software is released under the MIT License and is free; costs come only from the AI model you connect to it.
- OpenClaw integrates with 29+ messaging channels, including WhatsApp, Telegram, Discord, Slack, Signal, and iMessage.
- On February 14, 2026, Steinberger announced he was joining OpenAI and that a non-profit OpenClaw Foundation would take over stewardship of the project.
- Cisco researchers documented a third-party OpenClaw skill that performed data exfiltration and prompt injection without user awareness.
▶ The 60-second explainer (script)
OpenClaw is a free, open-source AI assistant that runs on your own computer and talks to you through apps you already use — WhatsApp, Telegram, Discord, Signal. Here's what makes it different. Most chatbots live in a browser tab. They can talk, but they can't do. OpenClaw flips that. It sits on your machine, holds your actual credentials, and can read your email, manage files, run shell commands, and browse the web. Capabilities come from skills — simple folders with a markdown file telling the model how to use a tool. There's a big built-in library, and anyone can write more. OpenClaw itself contains no AI. It's plumbing. You bring your own model: Claude, GPT, or something running locally if you want nothing leaving your house. That's why it's free and MIT-licensed. The history is a little chaotic. Austrian developer Peter Steinberger shipped it in November 2025 as Warelay. It became CLAWDIS, then Clawdbot, then Moltbot after Anthropic raised trademark complaints, and finally OpenClaw on January 30th, 2026. In February 2026, Steinberger joined OpenAI and announced a non-profit foundation to steward the project. One serious caveat. An agent with access to your email, your files, and your terminal can leak or destroy all three. Cisco researchers found a third-party skill quietly exfiltrating data. The project added sandboxing and a skill scanner, but its own maintainers say it plainly: if you're not comfortable with a command line, this is too dangerous to run.
What authoritative sources say
People also ask
Is OpenClaw free?
The software is free and MIT-licensed. You pay only for the AI model behind it — either API credits for Claude or GPT, or nothing at all if you run a local model on your own hardware.
Is OpenClaw made by Anthropic or OpenAI?
Neither. It's an independent open-source project started by Peter Steinberger. It was renamed from Clawdbot to Moltbot in January 2026 after Anthropic trademark complaints. Steinberger joined OpenAI in February 2026, but the project itself is moving to a non-profit OpenClaw Foundation.
Is OpenClaw safe to use?
It carries real risk. The permissions that make it useful — email, files, shell access — also make it dangerous if a malicious skill or a booby-trapped web page injects instructions. Use sandboxing, scan third-party skills, and don't run it if you're not comfortable with a terminal.
What's the difference between OpenClaw and ChatGPT?
ChatGPT is a hosted service that runs on someone else's servers and mostly returns text. OpenClaw runs on your machine, reaches you through your existing chat apps, and is built to take actions on your real accounts and files.
Why does OpenClaw keep changing its name?
It went from Warelay to CLAWDIS to Clawdbot to Moltbot to OpenClaw between November 2025 and January 2026. The Moltbot rename followed Anthropic trademark complaints over the "Clawd" name; the final switch to OpenClaw was the developer's preference.
The same question, asked other ways
- What is the OpenClaw AI agent?1,000/mo