OpenClaw: the personal agent that works over WhatsApp – and what to know before you install it

Few agent projects got as much attention in 2026 as OpenClaw. The idea is simple and compelling: a personal AI agent that runs on your own computer and that you control through the chat apps you already use – WhatsApp, Telegram, Slack, Discord, Teams, iMessage or Signal.

What OpenClaw is

OpenClaw is open source (MIT license) and "local first": memory and state stay with you. The intelligence comes from a model of your choice – Claude, GPT, DeepSeek or a local model. The software is free; you only pay for model usage.

Austrian developer Peter Steinberger started the project. After several renames – including Clawdbot and Moltbot – it has been called OpenClaw since late January 2026. In February 2026, Steinberger joined OpenAI; since then the project has been run by the nonprofit OpenClaw Foundation. Version 2.0 shipped at the end of August with simpler setup, a rebuilt browser app and shared sessions for several people.

What OpenClaw can do

• Chat control across more than 20 messengers and platforms, plus native apps for macOS, iOS, Android, Windows and Linux
• Persistent memory, stored locally
• Skills as its extension system, with a public directory called ClawHub
• Scheduled tasks and browser control
• Swappable models
• Use as a worker in multi-agent systems such as Paperclip

Typical uses: an assistant that keeps an eye on email, calendar and messages, handles recurring tasks or sends you a briefing in your messenger every morning.

The flip side: security

An agent that may read your email, write messages and launch programs is an attractive target. OpenClaw demonstrated that several times in 2026:

• CVE-2026-25253 (CVSS 8.8). A flaw allowed takeover with a single click on a crafted link – even when the gateway was only reachable locally. Fixed at the end of January 2026 in version 2026.1.29.
• Malicious skills. Auditing 2,857 skills on ClawHub, Koi Security found 341 malicious ones. Later counts from other sources are higher but less reliable.
• Exposed installations. Scans found tens of thousands of OpenClaw instances reachable directly from the internet.

Recommendations for running it

1. Stay current. Apply security updates immediately; back up before major upgrades such as 2.0.
2. Keep it off the open internet. Access only via VPN or a secure tunnel.
3. Vet skills. Install skills only from trusted sources and read the code before running it.
4. Minimize permissions. A separate email and calendar account beats full access to everything.
5. Content is not commands. Emails and web pages can contain hidden instructions (prompt injection). Critical actions should require confirmation.

Bottom line

OpenClaw shows how close personal agents are to everyday life: a chat window is enough of an interface. It also shows that running such an agent is more like running a server than installing an app. If you take that seriously, you get a very flexible assistant.