OpenClaw Review 2026: Renamed Twice, Now Run by a Nonprofit

OpenClaw (github.com/openclaw/openclaw) is an open-source AI agent gateway — a persistent background service, not a chat window you visit — that runs on your own machine and reaches you through messaging apps you already use. Its own description states it plainly: "The AI that really does things. Any OS. Any Platform." At its center is the Gateway, a daemon that manages connections to messaging channels, routes incoming messages to agent sessions, and handles scheduling.

OpenClaw did not start as OpenClaw. Austrian software engineer Peter Steinberger, founder of the PDF-tooling company PSPDFKit, built a personal AI assistant for himself named "Clawd" — a playful nod to Anthropic's Claude — and open-sourced a more capable version on GitHub in November 2025 under the name Clawdbot.

On January 27, 2026, Anthropic's legal team sent a trademark notice: "Clawd" was judged phonetically too close to "Claude." Steinberger leaned into the project's lobster mascot — lobsters molt to grow — and renamed it Moltbot that same day, with the agent persona becoming "Molty." Three days later, on January 29, 2026, he renamed it again to OpenClaw, saying "Moltbot" never quite rolled off the tongue. The second rename, executed with deliberate secrecy and coordinated timing to avoid a repeat incident, referenced both the project's open-source nature and its lobster heritage.

The transition was not clean. When Steinberger attempted to rename the GitHub organization and the project's X/Twitter handle simultaneously, crypto scammers seized the briefly-abandoned handles within roughly 10 seconds and promoted a fake "$CLAWD" token on Solana that reached a reported market capitalization above $16 million before Steinberger publicly denounced it as a scam. Typosquat domains and a cloned GitHub repository also appeared in the following days.

In February 2026, Steinberger announced he was joining OpenAI and that a nonprofit foundation would take over stewardship of the project. The OpenClaw Foundation formally launched with 501(c)(3) nonprofit status, a first full-time team of ten across engineering and operations, and is chaired by entrepreneur and investor Dave Morin. OpenAI committed to sponsoring the foundation while OpenClaw remains open source under the MIT license.

OpenClaw's architecture centers on the Gateway: a persistent daemon that manages every messaging-channel connection, routes incoming messages to the right agent session, and handles scheduled or background tasks. Within a single session, messages are processed one at a time through a Command Queue rather than in parallel — the project's own documentation explains this is deliberate, to prevent tool conflicts and keep session history consistent. Conversation transcripts are indexed into a local SQLite database with vector search, and the agent runs a memory-search query against that index before answering, rather than relying only on the current conversation's context window.

OpenClaw's security history is unusually well-documented, and unusually large, for a project of any age. Per GitHub's own security-advisories API, the project published 647 advisories between January 31 and June 30, 2026: 14 rated critical, 219 high, 350 medium, and 64 low. No new advisories had been published between July and this review's September 2026 snapshot, though that gap reflects this review's data pull, not a guarantee the pace has permanently slowed — check the repository's live advisory feed for the current count.

The most serious disclosed issue was reported by security researcher Chinmohan Nayak: three high-severity vulnerabilities (GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, both CVSS 8.8; GHSA-575v-8hfq-m3mc, CVSS 8.4) that together formed an unauthenticated remote-code-execution chain triggerable by a single WhatsApp message. It affected versions through 2026.6.1 and was patched in 2026.6.6.

Separately, in the days after the January 2026 rename, security firm Malwarebytes and other researchers reported over 1,000 publicly exposed OpenClaw instances leaking API keys, private chat histories, and system credentials — a configuration and deployment problem (unsecured public exposure) rather than a code vulnerability in OpenClaw itself.

Yes, actively. The repository was pushed to within hours of this review's research, and OpenClaw ships new versions roughly every few days — the five most recent tags at review time were v2026.9.1, v2026.8.2, v2026.8.1, and two beta releases, spanning less than two weeks.

Governance changed hands in February 2026: creator Peter Steinberger joined OpenAI, and stewardship passed to the nonprofit OpenClaw Foundation (501(c)(3) status, chaired by Dave Morin, a first full-time team of ten across engineering and operations, sponsored by OpenAI). The project remains MIT licensed under that arrangement. As of this review, the foundation had not published detailed public governance documents, so exactly how technical and roadmap decisions are made day-to-day is not fully transparent from the outside.

The right fit depends heavily on your tolerance for a young, fast-moving, and unusually security-scrutinized project having real access to your accounts, files, and shell.

OpenClaw's combination of messaging-channel reach and full machine control does not have an exact peer in this directory. The closest comparisons split across two different axes: other broad personal-agent gateways, and narrower single-purpose agents that trade OpenClaw's reach for a smaller attack surface.