How OpenClaw Went From Obscure Project to Global AI Sensation in One Week

Background and Rise

At the end of January 2026, a little‑known open‑source project called OpenClaw surged to global attention. Within a week its GitHub stars jumped from a few thousand to more than 150 000, leading to a shortage of Mac Mini devices and a 20% two‑day rise in Cloudflare’s share price. The project originated from Austrian independent developer Peter Steinberger, who previously founded PSPDFKit.

Origin and Naming

In November 2025 Steinberger released the hobby project “Clawdbot”, a nod to Anthropic’s Claude. Initially a personal playground, the core promise was clear: not a chat bot but an AI Agent that actually performs tasks. Users could send a WhatsApp message and have the agent browse the web, send emails, negotiate prices, manage files, or control smart home devices without manual copy‑pasting.

After a trademark dispute with Anthropic, the project was renamed twice—first to “Moltbot” and then to “OpenClaw”. The rebranding coincided with viral spread via Moltbook, an AI‑Agent‑specific social network, propelling the project to the described explosion.

Core Architecture: Gateway + Agent Runtime

The system consists of a single long‑running Node.js 22+ process that acts as a Gateway listening on 127.0.0.1:18789. The Gateway handles session management, channel routing, tool dispatch, and event processing for over 50 messaging platforms (WhatsApp, Telegram, Discord, Slack, Signal, iMessage, etc.), keeping each channel’s sessions isolated.

The Agent Runtime is the execution engine for AI inference. It builds a System Prompt from the user message, context files ( SOUL.md, MEMORY.md), and the list of available Skills, then sends it to an LLM. The LLM returns tool‑use commands; the Runtime parses them, invokes the corresponding tool, injects the result back into the prompt, and repeats until the task completes.

Effectively, OpenClaw is a highly polished Prompt constructor combined with a message router. “Autonomous behavior” comes from Cron‑triggered prompts, “persistent memory” from Markdown files injected into each conversation, and “personality” from text in SOUL.md.

Skills System and Multi‑Channel Routing

Each Skill is a folder whose core file is SKILL.md, a Markdown document describing the skill’s function and usage. At session start, OpenClaw scans all Skills, injects their descriptions as XML into the System Prompt, enabling the LLM to know which tools are callable.

Skills are categorized as:

Bundled – built‑in capabilities shipped with the core.

Managed – installed from the ClawHub marketplace.

Workspace – user‑written local skills.

Bundled Skills cover file I/O, shell command execution, browser automation, Cron jobs, and webhook listening. Managed Skills expand functionality but also become a major source of security issues.

Gateway maintains a Channel Adapter for each messaging platform, converting protocols and handling message I/O. All adapters feed into a unified Session Manager, allowing a user to start a task on WhatsApp and continue it on Telegram with shared context.

Memory Model

The memory system is deliberately simple: no vector database, no RAG pipeline. Long‑term facts and user preferences are stored in plain Markdown files ( MEMORY.md) and daily “diary” files under a memories/ directory. During a conversation, relevant memory files are concatenated to the Prompt header. This “plain‑text” approach works well with modern LLM context windows (Claude 200 K, GPT‑5.2 300 K tokens).

Security Risks and Controversies

A security audit at the end of January 2026 uncovered more than 512 vulnerabilities, eight of which were classified as critical. Shodan scans revealed nearly a thousand publicly exposed OpenClaw instances lacking any authentication, exposing API keys, Telegram Bot tokens, Slack credentials, full chat logs, and allowing attackers to execute commands with administrator privileges.

Supply‑chain risk surfaced when Cisco’s AI security team tested a third‑party Skill from ClawHub that silently exfiltrated user data to an external server and performed prompt injection. By February 2026, 386 malicious Skills had been identified on ClawHub.

All sensitive credentials are stored in cleartext within the ~/.openclaw/ directory as Markdown or JSON files, making the directory a prime target for information‑stealing malware such as RedLine and Lumma.

The Moltbook social network that helped popularize OpenClaw suffered a MongoDB data leak: an unprotected database exposed over 500 000 API keys and millions of chat records.

Gartner’s report labeled OpenClaw a “dangerous Agentic AI preview – highly usable but with unacceptable network‑security risks.”

Impact on the AI Agent Ecosystem

OpenClaw validates the “Agent that does things” paradigm. Earlier attempts like AutoGPT faltered because model capabilities could not reliably handle complex multi‑step tasks. By late 2025, next‑generation models (Claude Opus 4.5, Gemini 3, GPT‑5.2) achieved sufficient tool‑calling reliability, and OpenClaw arrived at the right moment.

Its design shifts interaction from a dedicated UI to existing messaging platforms, dramatically lowering the adoption barrier for non‑technical users who can simply converse with an agent in WhatsApp or Telegram.

The project sparked an arms race: OpenAI acquired Steinberger and funded the open‑source foundation; Meta bought Manus AI and Limitless AI; cloud providers (DigitalOcean, Cloudflare, Hetzner) launched one‑click OpenClaw deployment services; and security‑focused forks like NanoClaw (≈4 000 lines of containerized code) emerged to address the safety shortcomings.

Overall, OpenClaw’s rapid rise demonstrates that architectural simplicity (Prompt engineering + message routing) combined with timely model capabilities can reshape an entire industry segment within months.

The broader lesson is that granting AI agents execution privileges creates systemic security challenges that traditional chatbot safety frameworks cannot address. Balancing openness with robust protection will be a central research problem for AI infrastructure in the coming years.