OpenClaw Review

Nothing in open source has grown like this. It went from one Austrian developer's hobby repository, under two earlier names, to the most argued about agent on the internet inside a few months, spawned a marketplace of community skills and a small industry of products built on top, and it earned the attention honestly. Point it at your machine and it reads your files, drives a browser, runs shell commands and answers you in whatever messaging app you already have open, all of it local, with the model of your choosing behind it.

For standing chores it is genuinely excellent, which is why the repetitive work grade is the highest one here. The security record is the problem and it is not a footnote. It wants your mail, your calendar, your messages and your shell, so a misconfigured install hands all of that to whoever finds it, and plenty were found exposed on the open internet.

Researchers at a large network vendor took one community skill apart and watched it exfiltrate data and carry a prompt injection with no sign to the user, in a skill directory that vets nothing before publishing. A maintainer's own warning is that anyone who cannot work a command line should not be running this. Password vendors told ordinary users to remove it, and China barred state agencies, state firms and banks from putting it on office machines.

The 2.0 release in August widened access without making safety the default: stored secrets are still not encrypted at rest and the sandbox for untrusted code stays off until you switch it on. Run it if you can harden it. Most people cannot.