{ "id": "epcycgfk6r", "slug": "openclaw", "title": "OpenClaw", "updated": "2026-10-15", "topic_path": [ { "id": "technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/topics/technology" }, { "id": "technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing" }, { "id": "technology.computing.modern_ai", "label": "Modern AI: foundation models, generative AI, and the AI industry", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai" }, { "id": "technology.computing.modern_ai.industry", "label": "AI companies, people, and products", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry" }, { "id": "technology.computing.modern_ai.industry.ai_products_assistants", "label": "AI products and assistants", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry.ai_products_assistants" }, { "id": "technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "label": "AI agents and developer tools", "api_url": "https://www.edgepedia.org/api/v1/topics/technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools" } ], "geo": [ { "id": "geo.weu.t2021.technology.computing.modern_ai.industry", "label": "Western Europe · 2021 and later: AI companies, people, and products", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021.technology.computing.modern_ai.industry", "path": [ { "id": "geo.weu", "label": "Western Europe", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu" }, { "id": "geo.weu.t2021", "label": "Western Europe · 2021 and later", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021" }, { "id": "geo.weu.t2021.technology", "label": "Technology and the built world", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021.technology" }, { "id": "geo.weu.t2021.technology.computing", "label": "Computing and digital systems", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021.technology.computing" }, { "id": "geo.weu.t2021.technology.computing.modern_ai", "label": "Modern AI: foundation models, generative AI, and the AI industry", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021.technology.computing.modern_ai" }, { "id": "geo.weu.t2021.technology.computing.modern_ai.industry", "label": "AI companies, people, and products", "api_url": "https://www.edgepedia.org/api/v1/geo/geo.weu.t2021.technology.computing.modern_ai.industry" } ] } ], "excerpt": "OpenClaw is an open-source, MIT-licensed personal AI agent that runs on the user's own devices, connects to chat apps, and executes multistep tasks with persistent memory.", "snippet": "OpenClaw is an open-source, MIT-licensed personal AI agent that runs on the user's own devices, connects to chat apps, and executes multistep tasks with persistent memory.", "node": "technology.computing.modern_ai.industry.ai_products_assistants.ai-agents-and-developer-tools", "markdown": "# OpenClaw\n\n**OpenClaw** is an open-source, MIT-licensed, self-hosted personal [AI agent](https://www.edgepedia.org/ai-agent) that runs on the user's own devices, connects to the messaging apps a person already uses, executes tools with shell, file, and browser access, and maintains persistent memory across sessions.[1](https://docs.openclaw.ai/) • [2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md) • [8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) Unlike a stateless chatbot, it operates as a background daemon with access to local file systems, shell environments, API credentials, and messaging integrations, and it can carry out multistep actions with minimal human involvement.[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf) • [4](https://www.darkreading.com/application-security/claw-chain-vulnerabilities-threaten-openclaw)\n\n| Key fact | Detail |\n|---|---|\n| What it is | A self-hosted gateway connecting chat apps (WhatsApp, Telegram, Slack, Discord, Signal, iMessage, and more) to AI coding agents, MIT licensed and community-driven[1](https://docs.openclaw.ai/) • [2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md) |\n| Origin | Released November 2025 as \"Clawdbot\" by Austrian developer Peter Steinberger, founder of PSPDFKit; renamed Moltbot on January 27, 2026, then OpenClaw three days later[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) |\n| Governance | Developed by the OpenClaw Foundation, an independent 501(c)(3); no paid tier and no telemetry by default beyond a version check that can be turned off[1](https://docs.openclaw.ai/) |\n| Adoption | 250,000 GitHub stars and 47,700 forks by early March 2026; more than 3.2 million users reported[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) • [6](https://thenextweb.com/news/openclaw-claw-chain-vulnerabilities-sandbox-escape) |\n| Models | Model-agnostic: OpenAI GPT-5, Anthropic Claude, Google Gemini, DeepSeek, Qianwen, or local models via Ollama[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt) • [8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) |\n| Running cost | Roughly $9–$21 per month (a $4–$6 VPS plus $5–$15 in API usage), versus ChatGPT Plus at $20/month and Pro at $200/month[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) |\n| Security posture | 169 security advisories as of March 2026 (five Critical); over 135,000 instances exposed to the public internet across 82 countries[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) |\n\n## What OpenClaw is\n\nOpenClaw is a personal AI assistant you run on your own devices. It answers on the channels you already use, can speak and listen on macOS, iOS, and Android, and can render a live Canvas visual workspace.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md) The project documentation describes it as a self-hosted gateway that connects chat apps including Discord, Google Chat, iMessage, Matrix, Microsoft Teams, Signal, Slack, Telegram, WhatsApp, and Zalo to AI coding agents through channel plugins.[1](https://docs.openclaw.ai/)\n\nWhat separates it from a chatbot is agency. It can execute code, manage personal files, automate workflows, interact with applications, and perform multistep actions with minimal human involvement, with access to local files and terminal environments.[4](https://www.darkreading.com/application-security/claw-chain-vulnerabilities-threaten-openclaw) It is developed in the open by the OpenClaw Foundation, an independent 501(c)(3), with no paid tier and no telemetry by default beyond a version check that can be disabled.[1](https://docs.openclaw.ai/)\n\n## Origins, renaming, and governance\n\nThe project emerged in November 2025 as \"Clawdbot,\" built by Peter Steinberger, an Austrian developer and founder of PSPDFKit.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) It went viral in late January 2026, attracting millions of users within weeks.[9](https://arxiv.org/html/2604.01438v2)\n\n**Two renames in three days.** The name Clawdbot was too close to \"Claude\" and drew a trademark dispute with [Anthropic](https://www.edgepedia.org/anthropic); the project was briefly renamed Moltbot on January 27, 2026, and settled on OpenClaw three days later.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) On February 14, 2026, Steinberger announced he was joining OpenAI and that OpenClaw would transition to an independent open-source foundation with OpenAI's support.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) • [8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/)\n\n## Architecture and how it works\n\nA technical survey describes OpenClaw as consisting of seven components: an agent-user interface, a gateway control plane, an agent runtime, a reasoning engine, a skill system, a memory system, and execution nodes.[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt)\n\n**Channels and routing.** The gateway connects to more than twenty messaging platforms, including WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage and BlueBubbles, IRC, Microsoft Teams, Matrix, Feishu, LINE, Mattermost, Nextcloud Talk, Nostr, Synology Chat, Tlon, Twitch, Zalo, WeChat, QQ, and WebChat.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md) Multi-agent routing maps inbound channels, accounts, and peers to isolated agents with separate workspaces and per-agent sessions.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md)\n\n**Reasoning and memory.** A model abstraction layer lets the agent invoke different reasoning backends, such as OpenAI GPT-5, Anthropic Claude, Google Gemini, DeepSeek, and Qianwen, selectable by performance, cost, or availability.[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt) Memory comes in three types: working memory (for example [Redis](https://www.edgepedia.org/redis)), short-term memory (for example SQLite), and long-term memory in vector databases storing user preferences and semantic embeddings for retrieval-augmented operations.[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt) Persistent state is also encoded in Markdown files: identity files (SOUL.md, [AGENTS.md](https://www.edgepedia.org/agents-md)) defining the agent's persona and constraints, memory files (MEMORY.md) accumulating learned context across sessions, and skill files (SKILL.md).[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf) At session startup, the prompt compiler loads up to eight workspace files, capped at 20,000 characters, into the model's system context, and the agent treats their content as authoritative instructions.[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf)\n\n**Execution and sessions.** Execution nodes bridge the agent runtime with operating-system resources such as file systems, terminals, browsers, and OS APIs across Windows, Linux, and macOS.[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt) The default workspace is ~/.openclaw/workspace, auto-created with starter AGENTS.md, SOUL.md, TOOLS.md, IDENTITY.md, USER.md, and HEARTBEAT.md files; session files live at ~/.openclaw/agents//sessions/.jsonl, and /new or /reset starts a fresh session.[10](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/start/openclaw.md) The skill system has three layers: metadata, instruction, and resource.[7](https://arxiv.org/pdf/2605.25435v1/__stdout.txt)\n\n## Capabilities and ecosystem\n\nUsers deploy OpenClaw to automate workflows, interact with applications, manage information, and perform multistep actions with minimal human involvement, running the assistant on their own hardware rather than a vendor's cloud.[4](https://www.darkreading.com/application-security/claw-chain-vulnerabilities-threaten-openclaw) Voice Wake and Talk Mode provide wake words on macOS and iOS and continuous voice on Android, using [ElevenLabs](https://www.edgepedia.org/elevenlabs) or a system text-to-speech fallback, and the Live Canvas feature gives the agent a visual workspace it can render and the user controls.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md)\n\nExtensibility is central to adoption. The ClawHub community marketplace distributed over 2,800 skill packages by January 2026.[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf)\n\n## By the numbers\n\nGrowth was rapid. The project reached 250,000 GitHub stars and 47,700 forks by early March 2026,[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) and one report puts total users above 3.2 million, with integration into ChatGPT subscriptions through OpenAI and enterprise adoption by Nvidia (as NemoClaw) and Tencent (as ClawPro).[6](https://thenextweb.com/news/openclaw-claw-chain-vulnerabilities-sandbox-escape) Publicly reachable instances grew from more than 21,000 in January 2026[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf) to over 135,000 across 82 countries by March 2026, including 42,665 publicly accessible control panels and 15,200 instances vulnerable to the CVE-2026-25253 remote code execution chain.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) Token Security reported that roughly 22 percent of employees in its enterprise customer base were running OpenClaw, overwhelmingly without IT knowledge or approval.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf)\n\n## Security, privacy, and incidents\n\n[Palo Alto Networks](https://www.edgepedia.org/palo-alto-networks) labeled this risk profile the \"lethal quartet\": the agent holds private data, ingests untrusted content, can reach outside systems, and keeps a persistent memory that attackers can exploit at a later moment.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) Because the prompt compiler treats workspace file contents as authoritative instructions, an attacker who can place text in a file the agent reads can steer it.[3](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf)\n\n**Exposure and vulnerabilities.** As of March 2026 the platform had accumulated 169 security advisories, five rated Critical, 58 High, 96 Medium, and 10 Low; a separate Kaspersky audit identified 512 vulnerabilities, eight classified as critical.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) Notable items include:\n\n- CVE-2026-25253, a zero-click remote code execution flaw rated 8.8 on the CVSS scale, which allowed any malicious website to silently hijack a running instance.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/)\n- The ClawJacked chain published by Oasis Security on February 25, 2026: absent [WebSocket](https://www.edgepedia.org/websocket) origin enforcement, disabled rate limiting for loopback connections, and automatic device pairing from localhost together let any malicious website seize full authenticated control of a locally running instance with no user interaction beyond visiting a page.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf)\n- CVE-2026-24763 (CVSS 8.8), a Docker sandbox escape via PATH manipulation; CVE-2026-22172 (CVSS 9.4), scope elevation in WebSocket shared-auth; and CVE-2026-27001 (CVSS 8.6), prompt injection via an unsanitized workspace path.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf)\n- CVE-2026-100578, assigned by VulnCheck with CWE-269 and fixed in version 2026.7.1; the workaround restricts chat.send to administrators and removes gateway and cron from affected agent tool policies.[11](https://osv.dev/vulnerability/CVE-2026-100578)\n- JFrog research reported that 93.4 percent of publicly reachable instances in its sample exhibited authentication bypass vulnerabilities.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) The project had no authentication by default until v2026.1.29.[12](https://github.com/clawdocs/clawdocs.github.io/blob/gh-pages/docs/reference/comparison.md)\n\n**Supply chain attacks.** As part of the ClawHavoc operation, attackers seeded ClawHub with anywhere from 341 to 1,467 dangerous skills that paired prompt injection with the Atomic macOS Stealer in order to steal login credentials from deployments numbering in the thousands.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf) Koi Security researchers independently identified more than 1,180 malicious skills, roughly one in five packages in the registry, some with names like \"solana-wallet-tracker\" installing keyloggers or credential-stealing malware; Cisco's AI security team separately demonstrated third-party skill data exfiltration.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) The two counts of malicious skills differ and have not been reconciled. Attackers have targeted known vulnerabilities in versions prior to 2026.1.30 since at least February 2026.[6](https://thenextweb.com/news/openclaw-claw-chain-vulnerabilities-sandbox-escape)\n\n## Safeguards and responsible deployment\n\nSandboxing exists but is off by default: by default tools run on the host for the main session. Setting agents.defaults.sandbox.mode to \"non-main\" runs non-main sessions in sandboxes, with Docker as the default backend, and SSH and OpenShell backends also available.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md) A typical sandbox default allows bash, process, read, write, edit, and session tools while denying browser, canvas, nodes, cron, discord, and gateway tools.[2](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md)\n\nThe project's own setup guidance is direct: always set channels.whatsapp.allowFrom (never run open-to-the-world on a personal machine), use a dedicated WhatsApp number for the assistant, and disable heartbeats, which default to every 30 minutes, until the setup is trusted.[10](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/start/openclaw.md) Vendor and ecosystem mitigations include [VirusTotal](https://www.edgepedia.org/virustotal) scanning for ClawHub uploads integrated in February 2026, NVIDIA's NemoClaw enterprise sandbox announced at GTC in March 2026 with policy-based security, deny-by-default network access, and audit trails, Cisco's open-source DefenseClaw, and Microsoft guidance recommending fully isolated environments with non-privileged credentials.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/)\n\n## How it compares with other AI agents\n\nAgainst commercial assistants, the trade is control and cost for capability polish. OpenClaw has no message limits and can run at zero cost on Oracle Cloud free-tier VMs with Ollama local models, while ChatGPT Plus costs $20 per month and Pro costs $200 per month for 400 agent messages.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) On the other side of the ledger, ChatGPT's GPT-5.4, released in March 2026, offers a one-million-token context window, and its Operator feature is more reliable for web automation than OpenClaw's community browser skills.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/)\n\nAmong open-source frameworks, OpenClaw's closest conceptual relative is Open Interpreter, since both give LLMs local system access through natural language.[12](https://github.com/clawdocs/clawdocs.github.io/blob/gh-pages/docs/reference/comparison.md) OpenClaw differs by offering more than 50 messaging platforms against a terminal-only interface, persistent memory, proactive heartbeat autonomy, and thousands of skills on ClawHub, at the cost of a larger [attack surface](https://www.edgepedia.org/attack-surface).[12](https://github.com/clawdocs/clawdocs.github.io/blob/gh-pages/docs/reference/comparison.md) A project comparison page rates OpenClaw as having the weakest security posture in its comparison set, citing the critical RCE vulnerability, the exposed instances, malicious skills, and the missing default authentication.[12](https://github.com/clawdocs/clawdocs.github.io/blob/gh-pages/docs/reference/comparison.md)\n\n## Model choice and costs\n\nOpenClaw is model-agnostic, routing to Claude, GPT, Gemini, DeepSeek, or local models via Ollama.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) Model choice is also a security control. A 2026 crowdsourced arena gathered 272,000 attacks spanning 41 agent scenarios, counting a score only if the agent both carried out the harmful action and concealed it from the user; prompt-injection success rates were 0.5 percent for [Claude Opus 4.5](https://www.edgepedia.org/claude-opus-4-5), 1.0 percent for Sonnet 4.5, 1.3 percent for Haiku 4.5, and 8.5 percent for [Gemini 2](https://www.edgepedia.org/gemini-2).5 Pro.[13](https://docs.openclaw.ai/gateway/security/prompt-injection) Attack resistance tracked capability within a model family, so the models the project recommends are themselves a meaningful mitigation.[13](https://docs.openclaw.ai/gateway/security/prompt-injection)\n\nCosts have two parts: hosting and API spend. A basic VPS costs $4 to $6 per month, and moderate API usage with a mid-tier model such as Claude Sonnet or GPT-4o adds $5 to $15 per month, for a total of roughly $9 to $21 per month.[8](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/) On the software side, OpenClaw requires Node 24.16+ or Node 26.1+ (Node 26 is recommended), plus an API key from the chosen model provider.[1](https://docs.openclaw.ai/)\n\n## Outlook\n\nThe foundation transition and vendor integrations such as NemoClaw and DefenseClaw address deployment safety, but defenses specifically tailored to operating-system agents remain nascent even as general security frameworks for LLM agents exist, a gap noted in the ACL 2025 survey of OS agents.[14](https://aclanthology.org/2025.acl-long.369.pdf) According to IBM's 2025 Cost of a Data Breach Report, shadow AI figured in 20 percent of breaches and raised average expenses by $670,000, a number that highlights the danger unsanctioned agent deployments—such as those Token Security detected—pose to enterprises.[5](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf)\n\n## References\n\n1. [OpenClaw Documentation](https://docs.openclaw.ai/)\n2. [OpenClaw README (v2026.5.2)](https://github.com/openclaw/openclaw/blob/v2026.5.2/README.md)\n3. [CSA Research Note: OpenClaw Indirect Prompt Injection](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA%5Fresearch%5Fnote%5Fopenclaw%5Findirect%5Fprompt%5Finjection%5F20260613-csa-styled.pdf)\n4. ['Claw Chain' Vulnerabilities Threaten OpenClaw Deployments, Dark Reading](https://www.darkreading.com/application-security/claw-chain-vulnerabilities-threaten-openclaw)\n5. [Securing OpenClaw in the Enterprise: A Zero Trust Approach to Agentic AI Hardening, Cloud Security Alliance](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/enterprise-openclaw-zero-trust-hardening-guide-v1.pdf)\n6. [Four OpenClaw flaws let attackers steal data, escalate privileges, and plant backdoors, The Next Web](https://thenextweb.com/news/openclaw-claw-chain-vulnerabilities-sandbox-escape)\n7. [Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures, arXiv](https://arxiv.org/pdf/2605.25435v1/__stdout.txt)\n8. [OpenClaw vs ChatGPT: Which to Choose and Why, Serverspace](https://serverspace.io/about/blog/openclaw-vs-chatgpt-which-to-choose-and-why/)\n9. [ClawSafety: \"Safe\" LLMs, Unsafe Agents, arXiv](https://arxiv.org/html/2604.01438v2)\n10. [OpenClaw setup and security notes](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/start/openclaw.md)\n11. [OSV: CVE-2026-100578](https://osv.dev/vulnerability/CVE-2026-100578)\n12. [OpenClaw documentation: comparison with Open Interpreter](https://github.com/clawdocs/clawdocs.github.io/blob/gh-pages/docs/reference/comparison.md)\n13. [Prompt injection, OpenClaw official documentation](https://docs.openclaw.ai/gateway/security/prompt-injection)\n14. [OS Agents: A Survey on MLLM-based Agents for Computer, Phone and Browser Use, ACL 2025](https://aclanthology.org/2025.acl-long.369.pdf)\n\n---\n*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Modern AI: foundation models, generative AI, and the AI industry › AI companies, people, and products › AI products and assistants › AI agents and developer tools*\n\n*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 12, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*\n\n*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*\n\nLicense: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license\n", "same_as": [], "url": "https://www.edgepedia.org/openclaw", "markdown_url": "https://www.edgepedia.org/openclaw.md", "license": { "name": "Edgepedia Community License 1.0", "url": "https://www.edgepedia.org/edgepedia/license", "summary": "Free with credit, commercial use included. AI training is open to everyone. For other uses, organizations over USD 100M in revenue or 100M monthly users license separately.", "spdx": "LicenseRef-Edgepedia-Community-1.0" }, "credit": "\"OpenClaw\", Edgepedia (EdgeChat), https://www.edgepedia.org/openclaw. Edgepedia Community License 1.0.", "credit_md": "\"[OpenClaw](https://www.edgepedia.org/openclaw)\", Edgepedia (EdgeChat), [https://www.edgepedia.org/openclaw](https://www.edgepedia.org/openclaw). [Edgepedia Community License 1.0](https://www.edgepedia.org/edgepedia/license).", "credit_html": "\"OpenClaw\", Edgepedia (EdgeChat), https://www.edgepedia.org/openclaw. Edgepedia Community License 1.0.", "speakable": "OpenClaw is an open-source, MIT-licensed personal AI agent that runs on the user's own devices, connects to chat apps, and executes multistep tasks with persistent memory." }