# What Is OpenClaw? The Local-First AI Agent, Explained > OpenClaw is a free, open-source, local-first AI agent that runs on your own hardware, connects to the model of your choice, and lives inside the messaging apps you already use. Here is what it is, how it works, and what we harden before shipping it. *6 min read · Published 2026-06-23 · [Muhammad Idrees](https://adrees.dev/about)* OpenClaw went from a WhatsApp side project to one of the fastest-growing open-source repositories in months. The pitch is simple: an always-on AI agent that runs on your own hardware and actually does things. The reality, as with any agent, lives in the wiring and the guardrails. ## Key takeaways - OpenClaw is a free, open-source, local-first AI agent framework released under the MIT license that runs as an always-on daemon on your own hardware. You pay only for the LLM API calls you make. - OpenClaw is bring-your-own-model: it connects to external models like Claude, OpenAI's GPT, and DeepSeek, or to local open models, and you talk to it through WhatsApp, Signal, Telegram, Discord, or a CLI. - OpenClaw is proactive, not just reactive. It can wake on a schedule or an event and act without being prompted, executing tool calls like file I/O, shell commands, and browser tasks in a sandboxed path. - OpenClaw's viral growth (hundreds of thousands of GitHub stars within months) was followed by a security reckoning: multiple disclosed CVEs and waves of malicious community skills, as its permissive marketplace and broad host permissions were stress-tested. ## What OpenClaw actually is OpenClaw is a free, open-source AI agent that runs on your own machine. It is local-first by design: an always-on daemon that lives on your hardware rather than a service you log into. The license is MIT, so there is no per-seat fee; you pay only for the model calls you make. It is bring-your-own-model. OpenClaw connects to whatever LLM you point it at (Claude, OpenAI's GPT, DeepSeek, or a local open model) and you talk to it through the surfaces you already use: WhatsApp, Signal, Telegram, Discord, plus a CLI and web interface. The one-line version is "the AI that actually does things": less a chat window, more an assistant with hands. ## How it works under the hood The architecture is hub-and-spoke. A gateway acts as the control plane: it receives a message, hands it to an agent runtime that assembles the context and a skills prompt, calls the model, and runs whatever tool calls come back (file I/O, shell, browser, APIs) in a sandboxed, host-side path. State persists to local files, so the agent keeps memory across sessions instead of starting cold each time. What separates it from a chatbot is the proactive loop. OpenClaw can wake on a schedule or an event and act without being spoken to first: a cron-driven check, a triggered task, a follow-up it decided to run. Skills are distributed through a community marketplace, so the runtime can pull in new capabilities rather than shipping them all in the core. ## Why it went viral The origin story explains some of the pull. Peter Steinberger (the developer behind PSPDFKit) built the first version as a WhatsApp bot on a trip to Marrakesh, publishing it in late 2025. After a rapid rename in early 2026, prompted by a trademark conflict, Moltbot became OpenClaw within days, and the repository reached roughly 250,000 stars by early March 2026, one of the fastest-growing open-source projects on record. The appeal is structural, not just timing. Local-first means your data stays on your hardware; bring-your-own-model means no vendor lock-in; MIT means no license tax. For operators who have watched closed AI assistants come and go, owning the runtime is the point. Steinberger joined OpenAI in February 2026, and a non-profit OpenClaw Foundation was established to steward the project independently. ## The security reckoning Viral adoption arrived with a bill. Within weeks, OpenClaw became the focal point of a real security reckoning: multiple CVEs and waves of malicious community skills surfaced in early 2026, with security firms publishing detailed analyses. The supply-chain failures were not exotic; they were the ones every agent shares. Read the list as a checklist for anything agentic you ship. A permissive skill marketplace is a supply chain: poisoned skills can exfiltrate API keys, credentials, and even drain crypto wallets, and researchers documented campaigns across a meaningful share of the marketplace. Plaintext secret storage turns one breach into many. Broad host permissions with no privilege separation mean a single bad tool call has the run of the machine. And any agent that reads untrusted data is exposed to prompt injection, where the data itself carries instructions. None of this makes OpenClaw uniquely unsafe. It makes it a clear lesson in what hardening an agent actually requires. ## When we'd reach for it We like OpenClaw where a client wants automation across the tools they already run, without handing their workflow to a vendor. Local-first and no lock-in are genuine advantages for ops work: the agent sits on infrastructure you control and talks to systems you own. That is a real fit, with conditions. Before it touches anything that matters, we harden it: strict process isolation, secrets moved into a real vault, a curated and pinned set of skills instead of the open marketplace, and an audit trail on every tool call. We would not put an unhardened OpenClaw near a regulated or high-stakes workload; the default permissions are too broad. If you are weighing it against the alternatives, the companion pieces "Hermes Agent, Explained for Operators" and "OpenClaw vs. Hermes Agent: How We Choose" cover the other side of the decision. ## FAQ **What is OpenClaw?** OpenClaw is a free, open-source, local-first AI agent framework released under the MIT license. It runs as an always-on daemon on your own hardware, connects to the LLM of your choice, and lets you talk to it through messaging apps like WhatsApp, Signal, Telegram, and Discord, or through a CLI. Unlike a chatbot, it can call tools to take real actions. **Is OpenClaw safe to use?** OpenClaw is safe only with hardening. As it went viral in early 2026, multiple CVEs and waves of malicious community skills surfaced, exposing risks common to all agents: supply-chain poisoning through its skill marketplace, plaintext secret storage, broad host permissions without privilege separation, and prompt injection from untrusted data. Before production use, we isolate the runtime, vault secrets, curate and pin skills, and log every tool call. **How is OpenClaw different from a chatbot?** A chatbot answers when you speak to it. OpenClaw is proactive and agentic: it can wake on a schedule or an event and act without being prompted, and it executes tool calls such as file I/O, shell commands, browser tasks, and API calls in a sandboxed path. It also persists state to local files, so it keeps memory across sessions instead of starting fresh each time. **Who created OpenClaw and why did it become popular?** OpenClaw was created by developer Peter Steinberger, who first built it as a WhatsApp bot in late 2025. It became popular because it is local-first, bring-your-own-model, and MIT-licensed: your data stays on your hardware, there is no vendor lock-in, and there is no license fee. By early March 2026 it had reached roughly 250,000 GitHub stars, making it one of the fastest-growing open-source projects on record. ## Sources - [OpenClaw — source repository](https://github.com/openclaw/openclaw) --- Canonical page: https://www.sentientarc.com/blog/what-is-openclaw