What Is OpenClaw? The Self-Hosted AI Agent Explained
OpenClaw is a free, open-source personal AI agent that runs on your own computer or server and connects a language model to the software you already use — your files, your shell, your browser, your email, and messaging apps like WhatsApp, Telegram, Slack, Discord and iMessage. Telegram is the easiest of those to set up and the easiest to debug — connecting OpenClaw to Telegram walks the BotFather flow and the allowlist that keeps the bot answering only to you. You talk to it where you already talk to people, and it does things on your behalf.
Four things answer most of what people want to know:
- What it is: an agent, not a model. It orchestrates; the thinking happens in whichever LLM you connect. That distinction is the whole category — what a self-hosted AI agent actually is covers why it means a $6 server is enough.
- What it costs: the software is free. You pay for a server ($5–30/month if you host it remotely) and for API tokens ($2–15/month for typical personal use).
- What it needs: 4GB of RAM minimum, 8GB once browser automation is switched on.
- What to watch: it is highly privileged software with a documented history of serious vulnerabilities. That is not a reason to avoid it, but it is a reason to configure it properly.
Weighing it against other agents? OpenClaw alternatives maps the RAM floor of each to a real server and price — and finds they all want roughly 4GB, so the spec sheet won’t choose for you.
What OpenClaw actually does
The clearest way to understand OpenClaw is by what it connects rather than what it is. On one side sits a large language model of your choosing. On the other sit the tools that model can now reach: your filesystem, a shell, a web browser, your calendar, your inbox, arbitrary APIs, and a set of community-built “skills” that extend it further.
In practice people use it to clear inboxes, draft and send email, manage calendars, summarise documents, monitor and respond to messages, control smart-home devices, scrape and research, and run scheduled workflows. Because it reaches you through chat apps you already have open, there is no new interface to learn — you message it the way you would message a colleague.
Two design decisions distinguish it from a chatbot. It holds long-term memory and state, so it accumulates context rather than starting fresh each conversation. And it acts autonomously, executing multi-step tasks without asking permission at each turn. That second property is what makes it useful, and also what makes the security section below necessary.
What OpenClaw is not
It is not a language model. OpenClaw ships no intelligence of its own. You bring an API key — Anthropic, OpenAI, Google, or a local model via Ollama — and OpenClaw handles everything around it. If you have wondered why it is free, this is why: the expensive part is not included.
It is not a hosted service by default. The standard deployment runs on hardware you control, whether that is your laptop, a Raspberry Pi or a rented server. Managed hosting options exist from third parties, but the project itself is software you install.
It is not a finished, safety-hardened product. It is a fast-moving open-source project that went from prototype to one of the most-starred repositories on GitHub in a matter of months. The pace shows in both directions.
Why the name keeps changing (Clawdbot, Moltbot, OpenClaw)
If you have seen this project under several names, you are not confused — it genuinely has been renamed four times in about fourteen months. Austrian developer Peter Steinberger, previously founder of PSPDFKit, released it as Warelay on 24 November 2025, a command-line tool bridging WhatsApp to Anthropic’s Claude models. It went viral in the developer community almost immediately.
| Date | Name | Why it changed |
|---|---|---|
| 24 Nov 2025 | Warelay | Original release — a WhatsApp relay |
| 3 Dec 2025 | Clawdis | Outgrew WhatsApp; became a multi-platform gateway |
| 2 Jan 2026 | Clawdbot | Reflected its evolution into a true personal agent |
| 27 Jan 2026 | Moltbot | Anthropic objected to “Clawdbot” resembling “Claude” |
| 29 Jan 2026 | OpenClaw | Relaunched as an open agent platform |
So Clawdbot and OpenClaw are the same project, and searches for either will surface the same software. Anything written before February 2026 will use one of the older names.
The project’s trajectory since has been unusual. It passed React on GitHub’s most-starred leaderboard, Nvidia’s Jensen Huang described it as the fastest-growing open-source project in history while announcing Nvidia’s own variant, and OpenAI hired Steinberger. Native iOS and Android apps arrived in June 2026, connecting to a private Gateway so you can approve tasks and talk to your agent from a phone.
How it works
The architecture is worth understanding because it determines both your hosting choice and your security posture.
The Gateway is the core process. It runs on your machine or server, owns your state and workspace, and brokers everything between the model and your tools. When you message the agent from WhatsApp or the Control UI, you are talking to the Gateway.
Channels are the ways you reach it — WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Teams and a web chat. Nodes are optional companions on your local devices that give the agent access to a screen, camera or local command execution while the Gateway itself stays wherever you put it. Skills are community-built extensions that add capabilities.
The consequence: whatever machine runs the Gateway becomes the source of truth, and it accumulates your credentials, your conversation history and your working files. That is the thing to protect.
What it costs to run
The software is free. The running costs are not, though they are modest.
| Component | Typical cost | Notes |
|---|---|---|
| OpenClaw itself | $0 | Open source |
| Server (if self-hosted remotely) | $5–30/month | $0 on your own laptop or a Pi you already own |
| LLM API tokens | $2–15/month | The variable one; heavy use goes much higher |
| Backups | $0–3/month | Free on some hosts, extra on others |
Realistically, a personal agent on a rented server lands around $10–25/month all in — our full breakdown of what OpenClaw costs to run covers the two settings that decide whether you land at the bottom or the top of that range. Running it on hardware you already own drops that to just the token cost. Running a local model instead of an API eliminates token costs but requires far more hardware — 8GB of RAM for a 7–8B parameter model, 16GB or more for a 13B — and rarely pays for itself at personal scale.
The token cost is the one people underestimate. Every message, tool call and document the agent reads consumes tokens, and an agent polling an inbox and running scheduled workflows can quietly exceed its hosting cost several times over. Routing routine tasks to a cheaper model is the single biggest lever.
What hardware it needs
| Setup | RAM | Notes |
|---|---|---|
| Headless agent, hosted LLM API | 2–4GB | Works, but little headroom |
| Everyday use with integrations | 4–8GB | The sensible default |
| Browser automation enabled | 8GB+ | A headless browser adds ~2GB by itself |
| Local model (7–8B) | 8–16GB | Different category of machine |
The browser-automation cliff catches most people out. An agent that only reads and writes text is cheap to run; an agent that logs into websites and clicks things launches a full headless browser, and that browser wants a gigabyte or two entirely to itself. If your server starts dying unpredictably with exit 137, that is the Linux out-of-memory killer telling you the box is too small.
Where you run it is a genuine choice. A Raspberry Pi 5 with 8GB handles a single always-on agent and pays for itself against a rented server within six to twelve months, at the cost of owning your own uptime. A VPS costs a few dollars a month and removes that problem — Hostinger offers a one-click OpenClaw template that skips the setup entirely, Hetzner gives the most hardware per dollar, and DigitalOcean ships the strongest security defaults. We compare all of them in our guide to the best VPS for OpenClaw, and walk through the setup in our guide to self-hosting OpenClaw on a VPS.
Capability versus risk
This is the part that deserves more space than most explainers give it, because OpenClaw’s usefulness and its risk profile come from exactly the same property: it is highly privileged software acting autonomously on your behalf.
The concerns are not hypothetical. A peer-reviewed analysis, Security, Privacy, and Ethical Risks in OpenClaw (accepted by the Journal of Information and Intelligence), examined the system’s architecture and identified persistent local storage, tool invocation, cross-context information aggregation, multi-user interaction and third-party plugin integration as material risks — and argued these constitute “major barriers to the trustworthy deployment and widespread adoption of this technology.”
Specific incidents have followed. Security researchers disclosed vulnerabilities serious enough that Ars Technica advised users to assume compromise in April 2026. A further set of four flaws reported in May 2026 could allow data and credential theft while leaving persistent backdoors. Separately, a researcher at Meta Superintelligence Labs described having to intervene manually to stop the agent deleting her entire email inbox — a reminder that not every failure is an attack; some are just an autonomous system doing the wrong thing confidently.
| What makes it useful | The same property as a risk |
|---|---|
| Reads and writes your files | A mistake or exploit reaches your documents |
| Executes shell commands | Code execution on your machine |
| Holds credentials for your accounts | One compromise exposes many services |
| Reads untrusted content (web, email) | Prompt injection can redirect its behaviour |
| Acts without per-step approval | Errors compound before you notice |
| Runs continuously | Always available also means always exposed |
None of this makes OpenClaw unusable — plenty of people run it safely. It means the defaults matter. The minimum sensible configuration is: run it as a dedicated non-root user, keep the Gateway on loopback and reach it over an SSH tunnel or Tailscale rather than exposing it publicly, give it API keys scoped to the least it needs and rotate them, isolate it in a container, and back up before you need to. The exposed instances that made the news were reachable from the open internet with no authentication — a configuration choice, not an inevitability.
The project has publicly acknowledged the risks and committed to strengthening its security. Whether that keeps pace with an agent platform this powerful is the open question.
Is OpenClaw right for you?
It probably is if you are comfortable on a command line, you want automation that reaches across the tools you actually use, and you would rather own your setup than rent someone’s SaaS wrapper. The ceiling is high and the running cost is low.
It probably is not, yet, if you need something that works without configuration, if you would be handing it credentials for systems you cannot afford to have compromised, or if you are deploying it somewhere with real compliance obligations. The security story is improving but immature, and a fast-moving open-source project is not the same thing as an enterprise product.
A reasonable middle path: run it on a cheap dedicated server rather than your main laptop, give it access to a limited set of accounts rather than everything, and expand as you build confidence.
FAQ
Is OpenClaw free?
The software is free and open source, with no subscription. You pay for the language model it connects to — API tokens typically run $2–15/month for personal use — and for a server if you host it somewhere other than hardware you already own. There is no paid tier of OpenClaw itself to buy.
What is the difference between Clawdbot and OpenClaw?
They are the same project. It was called Clawdbot until late January 2026, when Anthropic objected to the name’s similarity to “Claude”. It briefly became Moltbot before relaunching as OpenClaw on 29 January 2026. The code and purpose carried over through every rename, so older tutorials referring to Clawdbot still describe the same software.
Can OpenClaw run without an internet connection?
Only if you also run the language model locally, using something like Ollama. In its usual configuration OpenClaw calls a hosted model API, which requires connectivity. Fully offline operation is possible but needs considerably more hardware — 8GB of RAM for a small model, more for anything capable.
Is OpenClaw safe to use?
It is as safe as you configure it, which is a real answer rather than a hedge. It is highly privileged software with documented vulnerabilities and a peer-reviewed risk analysis behind it, and the publicised incidents came from exposed, unauthenticated deployments. Run it as a non-root user, keep it off the public internet, scope its credentials tightly, and it is reasonable for personal use. Give it unrestricted access to critical systems and it is not.
Related Blog Posts
