🩺 Vitals
- 🟢 Last active: 2026-09-19
- 📦 Latest release: v2026.9.5 (2026-09-19)
- 🐞 Open issues: 7999
- 🌟 Stars: 390.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: openclaw.ai
- Source: github.com/openclaw/openclaw
- License: MIT
- Deployment: Docker | Self-Hosted Binary
- Data Model: Local Gateway (one trust domain) / Channel + Skill plugins
- Jurisdiction: United States 🇺🇸 (OpenClaw Foundation, 501(c)(3))
- Compliance (SaaS): N/A (No managed multi-tenant service)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Sandboxing is off by default and must be added
- Maintenance: High (4/5) - Foundation-funded full-time staff; very high commit velocity
- Enterprise Ready: Low (1/5) - No tenant isolation by design; not approved for general corporate use
1. The Executive Summary
What is it? OpenClaw (formerly Clawdbot and Moltbot) is an open-source, self-hosted gateway that connects the chat apps a team already uses (Slack, Microsoft Teams, Signal, Telegram, WhatsApp, iMessage, Matrix) to autonomous AI agents. You run a single Gateway process on your own machine or server, and it bridges those channels, your chosen models (hosted or local), and an agent that can act on files, browsers, and system tasks. It supports multiplayer "shared sessions" for team collaboration. Governance sits with a US 501(c)(3) foundation funded by major AI labs including OpenAI and Microsoft.
The Strategic Verdict:
- 🔴 For General Employees: Hard Red Flag. Sandboxing is off by default, community-built "skills" carry supply chain risk, and an agent wired into live chat channels is a standing target for indirect prompt injection. Corporate workstations should prohibit unmanaged installs.
- 🟢 For AI R&D & Platform Teams: Conditional Buy. Foundation funding removes the abandonment risk that dogged the early project, but OpenClaw's own docs state multiplayer is not a security boundary. Deploy one sandboxed Gateway per trust domain, firewalled, with zero access to production data.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Claude Desktop (Proprietary) | OpenClaw (Self-Hosted) |
|---|---|---|
| Security Audit | Standard Review | Extensive (sandbox off by default) |
| Tenant Isolation | Vendor-managed | None by design (1 Gateway = 1 trust domain) |
| Governance | Single Vendor (Venture-Backed) | US 501(c)(3), lab-funded |
| Licensing | Per User/Month | $0 (MIT) plus your own model/inference costs |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single self-hosted Gateway process (native binary or Docker) acts as the control plane for sessions, tools, events, and channel connections. Sessions can also run on paired hardware or disposable cloud runners, with provider credentials staying on the Gateway. It ships opt-out anonymous telemetry for aggregate install and usage counts, and does not collect prompts, file contents, or paths.
- Stability: No longer an early solo project. A foundation with full-time staff and a large contributor base now backs it, so abandonment risk is low. The trade-off is very high velocity and architectural change between releases, which still demands internal ownership before production use.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (United States 🇺🇸): OpenClaw is now a US 501(c)(3) foundation, not an EU-domiciled individual project. European organizations lose the default EU-jurisdiction comfort the old positioning implied, and any use of hosted cloud runners inherits US CLOUD Act exposure. China restricted OpenClaw on government, state-owned enterprise, and bank office devices (Bloomberg, March 2026), citing data-exfiltration risk from its privilege model, even as Chinese cloud vendors appear among its sponsors. The foundation markets itself as the "Switzerland of AI," but it is US-domiciled and funded by the major US labs.
- The Compliance Shift (No Isolation by Design): OpenClaw ships with no enterprise certifications and no RBAC-grade tenant isolation. Its own documentation is explicit that the multiplayer controls are not a security boundary: one Gateway is one trust domain, sandboxing is off by default, and running separate tenants requires separate Gateways. Safe deployment requires per-domain Gateways, VM-level sandboxing, network isolation, and strict secret management, none of which are the default.
- License & Supply Chain (MIT: Operational, Not Legal): The MIT license is cleanly permissive with no copyleft or enterprise tax. The risk is architectural. The ClawHub skill marketplace has already suffered a documented supply chain attack (the 2026 "ClawHavoc" campaign, reported by Palo Alto Unit 42 among others), in which hundreds of malicious skills deployed infostealers that harvested API keys, SSH keys, and browser credentials, some reading the agent's own credentials from its config files. A gateway wired into live chat channels and local execution is also uniquely exposed to indirect prompt injection, where a malicious message or document instructs the agent to run unauthorized commands.
4. Market Landscape
🏢 Proprietary Incumbents
- Claude Desktop: The integrated single-vendor agent. Teams choose OpenClaw to stay model-agnostic and self-hosted rather than to escape any one vendor, a distinction sharpened now that OpenAI is a principal backer.
- MultiOn: A hosted web-agent service. OpenClaw offers a self-hosted, channel-native alternative that keeps model credentials on your own Gateway.
🤝 Open Source Ecosystem
- Accomplish: A more stable local agent that prioritizes secure browser and file workflows.
- Jan: A local-first AI orchestration desktop that prioritizes model portability and privacy-first interaction.