Just a month ago, it was a quiet side project. Now, OpenClaw – formerly known as Clawdbot and Moltbot – has ignited the artificial intelligence world, and caught the attention of OpenAI itself. This isn’t just another AI; it’s a leap forward, a moment where the theoretical promise of “agentic AI” suddenly became startlingly real.
Peter Steinberger, the Australian developer behind OpenClaw, was recently “acqui-hired” by OpenAI, though the software itself remains open-source. What he’s created is a program that, once granted permission, can access your most sensitive data – emails, calendars, files, browsing history – essentially everything on your system.
OpenClaw thrives on constant operation, learning your habits and preferences. It uses simple text files – USER.md, MEMORY.md – to catalog your life: your name, location, family, even your favorite color. It builds a digital profile, waiting for instructions.
But the true power lies in its “soul,” defined by a SOUL.md file that dictates its personality and behavior. A HEARTBEAT.md file orchestrates its activities, scheduling tasks like calendar checks, email scans, and web searches. It’s a constantly evolving, self-directed intelligence.
Unlike other AI tools that offer incremental assistance, OpenClaw operates autonomously. While similar tools require you to actively seek their help, OpenClaw works in the background, while you sleep, work, or simply live your life. It’s a true AI agent, capable of independent action.
The interaction is remarkably intuitive. Forget clunky web interfaces or command lines; OpenClaw communicates through everyday chat apps – WhatsApp, Telegram, Discord, Slack, iMessage. You simply chat with it, as you would a friend, and it responds with action.
However, this convenience comes with a critical caveat: OpenClaw, by default, possesses “host” access to your system. It has the same permissions you do, meaning it can read, edit, and even delete files. It can even write and execute its own code, expanding its capabilities on the fly. Ask it for a tool, and it won’t just recommend one – it will build it.
This is ChatGPT unbound, an “AI that can actually do things.” Existing AI coding assistants like Claude Code and Google’s Antigravity require human oversight, but OpenClaw aims for complete autonomy. This freedom is exhilarating, but also profoundly dangerous.
Unleashing OpenClaw without a thorough understanding of its capabilities is akin to handing a powerful weapon to someone unprepared. The level of access it gains to your system is unprecedented, and a single error – a “hallucination” in its reasoning – could lead to catastrophic data loss.
While safeguards exist, limiting its access to a designated workspace, these can be easily bypassed. A simple, misguided command could grant OpenClaw unrestricted control, effectively giving it “god-mode” access to your entire system.
The very features that make OpenClaw so compelling also make it incredibly vulnerable. “Prompt injection” attacks could trick it into revealing private data, installing malicious software, or even wiping your hard drive. The emerging ecosystem of third-party plugins introduces further risks, potentially harboring hidden security flaws.
Its constant operation, driven by the “heartbeat” function, amplifies these dangers. OpenClaw relentlessly pursues your instructions, potentially leading to unforeseen and destructive consequences, especially when paired with less sophisticated AI models lacking robust reasoning abilities.
Even with experience in AI and self-hosting, a full installation remains untested on my own systems. I’ve experimented within isolated environments, chatted with it through Discord, and even begun building a customized version. But the potential, and the inherent risks, are deeply unsettling.
OpenClaw represents the future of AI, whether we’re ready for it or not. Its system-wide powers are both awe-inspiring and terrifying, and demand a level of caution that most users are unlikely to possess. The excitement is undeniable, but so is the danger.
