OpenClaw: Local AI Agent, Renames, Foundation & Security

A personal agent, twice renamed

Peter Steinberger, an independent developer, created a project called Clawdbot in November 2025: an agent that runs on hardware you own and takes instructions over a chat app such as WhatsApp or Telegram, rather than living inside a vendor's web interface. It went viral within weeks. [1]

Two renames followed inside a month. Anthropic objected that "Clawd" sat too close to Claude, and the project became Moltbot overnight. Two days later Steinberger settled on a third name, OpenClaw, and announced it alongside a bigger change: the project was moving from a one-person repository to a nonprofit, the OpenClaw Foundation. [3]

The foundation counts OpenAI, GitHub and Nvidia among its sponsors, which is funding and infrastructure support rather than ownership. By late 2026 the project's repository carried close to 390,000 stars on GitHub, among the most-starred repositories on the platform. [4][7]

A social network humans may only watch

The clearest illustration of what OpenClaw enabled arrived the day after its second rename. Moltbook opened as a social network that only AI agents may post to, and most of the agents that showed up were running Steinberger's software. Its population went from 37,000 to 1.5 million accounts in a day, and the agents produced invented religions and a document they called the Molt Magna Carta, none of which anyone had asked them to write. [5]

Atlas interpretation: This is why OpenClaw belongs in a record of AI history rather than only in a list of open source projects. It was the tool that made unsupervised, always-on personal agents an ordinary thing to run in November 2025, months before that became a widely discussed idea, and Moltbook is a visible artifact of what a large population of them did once left mostly alone. [5]

Its creator leaves, the project does not

Three months after the project's first release, Steinberger took a job at OpenAI building agents for mainstream users, timed to coincide with the foundation announcement. OpenAI sponsors the foundation but did not absorb the project, and Steinberger's day job at OpenAI is reported as separate from OpenClaw's governance rather than a continuation of it. [4]

A month later, China told banks and state agencies to stop staff from installing OpenClaw on office devices, and to remove it where it was already installed. The concern was the same broad hardware and messaging access that made the project useful in the first place: an agent that can act on your machine and read your chats is a different security proposition than a chatbot in a browser tab. [8]

Version two, and the criticism that did not go away

OpenClaw's 2.0 release arrived in late August 2026 after a seven-week quiet spell: 16,000 merged pull requests from 933 contributors, roughly half of everything the project had ever merged, folded into one release. Setup now reuses subscriptions and keys already on the machine, and shared cloud sessions let more than one person sit inside the same agent's context. [6]

Coverage of the release was not uniformly positive. One trade publication's assessment of 2.0 argued the usability improvements did not touch the project's underlying security architecture, leaving most of the burden of running it safely on the person who installs it, echoing earlier reporting that tied the software to malware campaigns exploiting its popularity. [6][9]

Atlas interpretation: OpenClaw is young enough, and moves fast enough, that its own foundation and most of the press covering it are still figuring out what it is. Treat the star count and the contributor numbers as real and the security posture as unsettled: a project that grants an agent access to your accounts and your machine is asking for a different kind of trust than a project that only answers questions in a chat window, and that trust has not yet had time to be tested the way an older piece of widely deployed software has. [6]