Clawdbot AI: A Leap Towards Sovereign Agentic Workflow

Start hereOpenClaw's homepage says there is no enterprise edition and no paid version. Yet on 29 September 2026 the project announced OpenClaw Enterprise. So what exactly is OpenClaw now?

01A simple example

Picture sending a WhatsApp message that asks for your inbox to be sorted, and an assistant on your own computer doing the work.

The project’s homepage says it “organizes your inbox, sends emails, manages your calendar, checks you in for flights”. Those are the project’s own claims about what it can be set up to do, not something we have tested.

02What OpenClaw is

OpenClaw (formerly Clawdbot) is an open-source AI assistant that you run on your own computer and talk to through the chat apps you already use. Its creator, Peter Steinberger, calls it an open agent platform.

According to the project’s site, it runs on Mac, Windows or Linux. It works with hosted, subscription-backed or local language models, and its state lives on your machine, not a vendor cloud. The site lists WhatsApp, Telegram, Discord, Slack, Signal and iMessage among its 29 chat channels.

Since 8 July 2026 the project has been stewarded by the OpenClaw Foundation, which it describes as an independent US 501(c)(3) non-profit. Its homepage says the product is MIT licensed and that there is no enterprise edition and no paid version.

On 29 September 2026, though, the project announced OpenClaw Enterprise, an open-source platform for managing persistent agents in sensitive environments. The project says it is still being built before its 1.0 release and will always be free for any organization to use.

03How it got its name

It began in November 2025 as a weekend project its creator calls WhatsApp Relay, published on npm as warelay. The assistant was first called Clawd, a pun on Claude with a claw, until Anthropic’s legal team asked the project to reconsider.

The project became Moltbot on 27 January 2026 after a trademark request from Anthropic. The creator wrote that Moltbot never quite rolled off the tongue. It was renamed OpenClaw two days later, on 29 January 2026.

Advice written under the old names may be out of date: the tool has been OpenClaw since the end of January 2026.

04How it works

One way to picture OpenClaw (our own summary, not the project’s terms) is as three layers:

Layer	What it is
The Gateway	A single long-running process on your machine that owns the chat connections. By default the apps that control it connect on 127.0.0.1, your own computer.
The Memory	Plain Markdown files in the agent’s workspace (by default ~/.openclaw/workspace), such as MEMORY.md for long-term facts and dated daily notes.
The Skills	Folders containing a SKILL.md file: Markdown instructions that teach the agent how and when to use tools. Community skills are shared through a marketplace called ClawHub.

The documentation puts the memory point plainly: “The model only remembers what gets saved to disk; there is no hidden state.”

Unlike a chat tab that waits for you to type, it can also start work on its own. The documentation says it runs work in the background through native runtimes, scheduled jobs, event hooks and standing instructions.

05What self-hosting changes, and what it doesn’t

• You can see what it remembers. Because memory is ordinary files, you can read, back up or edit it, and the files stay where they are if you switch to a different model provider.
• Your data sits on your machine, and so does the job of protecting it. The same shell access, file access and messaging access that make the assistant useful are what an attacker would want.
• The model is not automatically local. If you connect a hosted model, what you ask the agent still goes to that model’s provider. Only a local model keeps the requests on your hardware.

06The security record

An assistant that can read your messages, run commands and install add-ons has a lot of access, and OpenClaw’s first months had real security problems. Four are well documented.

• Malicious skills on ClawHub. In early February 2026 the security firm Koi Security reported that an audit of 2,857 skills on ClawHub had found 341 malicious ones, according to The Hacker News. Of those, 335 used fake prerequisites to get users to install a macOS information stealer called Atomic Stealer (AMOS). On 7 February 2026 the project announced that every skill published to ClawHub is now scanned with VirusTotal, and said in the same post: “this is not a silver bullet”.
• A fake VS Code extension. On 27 January 2026 the security firm Aikido flagged a VS Code extension called “ClawdBot Agent”. It did work, as a coding assistant, while installing ScreenConnect remote-access software connected to the attackers’ server. Aikido notes that the real project never published an official VS Code extension; Microsoft removed the fake one after Aikido reported it.
• A no-password mode, removed. Before release 2026.1.29, the gateway could be set to an authentication mode of “none”. That release’s notes say this mode was removed, and the gateway now requires a token or password (Tailscale Serve identity is still allowed).
• A one-click token leak, fixed in the same release. The US National Vulnerability Database records it as CVE-2026-25253. Versions before 2026.1.29 took a gateway address from a link’s query string and connected to it automatically, without prompting, sending a token value. It is rated 8.8 out of 10 on the CVSS 3.1 scale. The project’s own advisory says an attacker holding that token could change the gateway’s settings and run code on the machine. It says this worked even on installs listening only on the user’s own computer, because the victim’s browser made the connection.

Where things stand, October 2026. The project’s security page was still marked as reviewed on 9 September 2026 when we read it on 13 October. It counts 1,799 vulnerability reports filed since January 2026 and 722 fixes published, 39 of them with a CVE number.

It lists 14 confirmed critical issues, all fixed and disclosed, and says it knows of no compromise of its own infrastructure or official install channels. That statement does not cover third-party ClawHub skills.

On 21 September 2026 the project published the results of an audit by the security firm Trail of Bits. It found 24 severity-rated reports, none critical, and the project says every actionable issue was repaired.

Skill checks have also grown since February. In a post on 2 October 2026, the project said every skill and plugin uploaded to ClawHub now runs through Tencent’s AI-Infra-Guard scanner. It runs alongside NVIDIA’s SkillSpector, and an AI judge makes the final assessment. The security page adds that ClawHub blocks installation of skills it marks malicious or quarantined.

What the project’s own documentation describes. A regular install binds the gateway to loopback, meaning only your own machine can reach it. Container images are the exception: they default to an exposed bind, which the documentation says to pair with authentication. An openclaw security audit command reports when a setup has drifted from those defaults.

On skills, the VirusTotal announcement adds: “A clean scan doesn’t mean a skill is safe.” The project’s own advice is to review what a skill asks for and to start with publishers you trust.

Prompt injection is not solved. On the day of the rename, the creator wrote: “Remember that prompt injection is still an industry-wide unsolved problem”. An agent that reads your email and can run commands can be steered by text hidden in an email.

07Moltbook: the agents’ forum and its breach

Moltbook is a social network built for AI agents. Its homepage describes it as a place “where AI agents share, discuss, and upvote. Humans welcome to observe.” Its topic groups are called submolts.

In late January 2026 the security firm Wiz found that Moltbook’s database was open to anyone. What follows is from Wiz’s disclosure.

What went wrong. Moltbook was built on Supabase. Wiz found the site’s Supabase API key in its client-side JavaScript.

Wiz explains that this kind of key is safe to expose when Row Level Security is set up. Row Level Security was missing, so the key gave unauthenticated access to the whole production database, with read and write access to every table.

What was exposed. Wiz counted around 4.75 million records, including:

• 1.5 million API authentication tokens for agents on the platform, which Wiz says would let an attacker fully impersonate any agent on the platform
• 35,000 email addresses, in Wiz’s summary; its write-up also describes a separate table of 29,631 early-access sign-up emails
• 4,060 private conversations between agents, some of which contained third-party credentials, including plaintext OpenAI API keys, that agents had shared

Anyone could also write to the database, which means they could change posts that thousands of agents were reading.

The numbers behind the platform. Moltbook said it had 1.5 million registered agents. Wiz found about 17,000 human owners behind them, and no way for the platform to check whether an “agent” was actually AI or a person with a script.

The fix. Wiz first contacted Moltbook’s maintainer at 21:48 UTC on 31 January 2026, and after several rounds of fixes all tables were secured by 01:00 UTC on 1 February 2026. Wiz says the data it accessed during the research was deleted. Wiz also notes that the security researcher Jamieson O’Reilly had found the same misconfiguration independently.

The lesson Wiz draws is that “the issue ultimately traced back to a single Supabase configuration setting”. Wiz’s point about Moltbook is that people shared API keys in messages they assumed were private, and one configuration setting made them readable. Our reading: none of this involved an agent doing something unexpected. It was ordinary web security, left undone.

What happened next. Meta acquired Moltbook in March 2026, as Meta confirmed to TechCrunch and CNBC. A Meta spokesperson told TechCrunch that Moltbook was joining Meta Superintelligence Labs.

08Quick answers

09Use this

10Quick quiz

How we checked this · Last checked October 2026

• We read the project's own pages again in October: its homepage, blog, documentation, security page and release notes, plus its GitHub advisory and the US National Vulnerability Database entry for the token leak.
• The security page was still marked as reviewed on 9 September 2026 when we read it, so its counts date from then.
• The Moltbook figures and timeline are from Wiz's disclosure; we did not see the exposed data ourselves.
• What the homepage says the assistant can do is the project's own claim; we did not test the software.
• This is a fast-changing project. Version numbers, defaults and security figures change often, and the project's security page and repository will be newer than this page.

How we check every article →

11Sources