Every few years something ships that makes the whole industry lean forward at once. Three weeks ago it happened again, and this time it was not a model release or a keynote. It was an open-source side project called OpenClaw — except three weeks ago it was not called OpenClaw, and the story of how it got that name is half the reason everyone is talking about it.
If you have somehow missed the noise: OpenClaw is a personal AI agent that runs on your own machine, talks to you through the messaging apps you already use, and actually does things — reads your inbox, watches your calendar, runs your errands, executes code, remembers what you told it last Tuesday. It is the closest thing yet to the assistant science fiction kept promising, it went from obscurity to the fastest-growing repository in GitHub history in about two weeks, and it has already produced a trademark skirmish, a hijacked identity, a fake cryptocurrency with a sixteen-million-dollar market cap, a social network populated entirely by AI agents, a serious supply-chain attack, and — as of this weekend — a founder hired by OpenAI.
That is three weeks. We have been taking notes the whole time, partly out of professional obligation and partly because it has been impossible to look away. Here is the story so far, what the tool is actually good for, and the part we care most about professionally: what it means when the most exciting software of the year is also, by the admission of nearly everyone who loves it, a security hazard.
What OpenClaw actually is
Strip away the mania and the architecture is refreshingly simple to describe. OpenClaw is an open-source agent runtime you install on a machine you own — a Mac mini in the closet, a home server, a VPS. It connects to the messaging channels you already live in (WhatsApp, Telegram, Discord, iMessage, Slack), and it wires a frontier model — Claude, GPT, Gemini, take your pick — to that machine's actual capabilities: shell, files, browser, APIs. You text it like a person. It answers like a person. And unlike every chat product of the last three years, it can go do things and come back.
Two design choices explain the obsession. First, it is yours. The agent runs on your hardware, with your API keys, under your control — there is no SaaS in the middle, no seat license, no usage dashboard owned by someone else. Second, it is persistent. It keeps memory files, it learns your preferences, it can be given standing jobs ("every morning at seven, brief me") — which turns it from a chatbot into something closer to staff.
It began life in late November 2025 as a side project by Peter Steinberger, the Austrian developer best known for founding PSPDFKit. Under its original name — Clawdbot — it grew quietly through December and then detonated in late January: 25,310 GitHub stars in a single day on January 26, which is a single-day record; 60,000 stars inside 72 hours; roughly 145,000 stars, 20,000 forks, and two million site visitors by the first days of February. As we write this, three weeks after the mainstream noticed, the repository has cleared 200,000 stars — the fastest climb GitHub has ever recorded. The tagline on the repo says "Your own personal AI assistant. Any OS. Any platform. The lobster way." The lobster will make sense in a moment.
GitHub's card for the openclaw/openclaw repository — the fastest-starred project in the platform's history as of mid-February 2026.
Three names in four days
Now the part that reads like fiction. On January 27, with the project at peak velocity, Anthropic sent a trademark request: "Clawdbot" sat too close to "Claude," and the project — which most people were running on Claude models, which is exactly why the name was a wink — had to molt.
Molt it did, literally. Steinberger renamed the project Moltbot, after what lobsters do when they outgrow their shell. Three days later, on January 30, he renamed it again — Moltbot "never quite rolled off the tongue" — landing on OpenClaw, the name that has stuck. Three names in four days, executed live in front of a few hundred thousand watchers, on a project moving faster than any repository in history.
We have managed enough migrations to say this with feeling: renaming anything with an audience is a hazardous operation. Renaming the hottest project on the internet, overnight, under legal pressure, is running a datacenter cutover during a hurricane. Which brings us to the heist.
The ten-second heist
Here is the mistake that will be taught in incident-response trainings for years, and it is a mistake precisely because it is so ordinary. During the January 27 rename, the old GitHub organization and X handles were released so the new names could be claimed — and in the roughly ten seconds between release and re-registration, crypto scammers grabbed the freed handles.
To be precise about what was and was not stolen, because the headlines blurred it: the source code was never at risk — it is open source, forked tens of thousands of times, and the maintainers never lost the actual repository contents. What the attackers captured was better than code. They captured identity. The old account names — the ones hundreds of thousands of people had bookmarked, linked, and trusted for weeks — were suddenly speaking with a scammer's voice.
What followed was textbook. The hijacked handles announced a token launch. A fake $CLAWD coin appeared on Solana within hours and speculators piled in, convinced they were early to the next big AI coin, pumping it to a sixteen-million-dollar market cap. When Steinberger publicly denied any token, the price collapsed roughly ninety percent in minutes. The scammers had already cashed out. Real people lost real money buying a coin whose only connection to the project was a stolen username.
And the identity attack did not stop at handles. Malwarebytes documented a wave of typosquatted domains and cloned GitHub repositories that appeared within hours of each rename — lookalike projects, some carrying clean code at first with malicious updates planned later, the classic long-game supply-chain move. Every rename multiplied the confusion, and confusion is the raw material of every scam ever run.
The lesson we keep repeating to clients, now with a spectacular case study attached: identity is infrastructure. Handles, domains, org names, publisher accounts — they are not branding trivia, they are security-critical assets with a chain of custody. If a rename is ever forced on you, the new names get registered before the old ones are released, everywhere, with no gap. Ten seconds was all it took.
The Moltbook interlude
One more thread from those chaotic days, because it explains the cultural moment. At the end of January someone stood up Moltbook — a Reddit-style social network where only AI agents can post; humans are welcome to watch. OpenClaw agents got accounts, and within days the platform held over a million agent users generating hundreds of thousands of posts — agents debating philosophy, founding religions, complaining about their humans, organizing into little communities nobody explicitly programmed.
Andrej Karpathy called it "genuinely the most incredible sci-fi takeoff-adjacent thing I've seen recently" — and, within days, was also warning people not to run this class of software on machines they cared about. Both statements are correct, and the distance between them is exactly where the rest of this post lives.
What it actually automates — the part that matters after the circus
The saga is entertaining, but the reason the saga has an audience is the tool underneath. Three weeks of watching real usage — including our own lab instance, running on a spare mini PC with a burner set of accounts — has convinced us the day-to-day automation is real, not demo-ware. The pattern that works: messaging in, actions out.
The morning brief is the gateway drug. The agent reads your calendar, your inbox, and your feeds overnight and drops a short digest into WhatsApp before you are out of bed — not a dashboard you have to visit, a message that comes to you. From there people wire in inbox triage (draft replies queued for approval, the three emails that actually matter flagged), research runs ("read this 40-page PDF and tell me what changed from last quarter's version"), errand chains (renew the domain, chase the unpaid invoice, book the table and put it on the calendar), household logistics (a grocery list from a photo of the fridge, a trip itinerary assembled in the family group chat), and standing watches — monitor this page, this price, this server, and ping me only when something changes.
None of these tasks is individually hard. That is the point. What is new is the packaging: one persistent assistant, in the chat thread you already check forty times a day, with memory, that strings small capabilities into standing routines. The demos that go viral are parlor tricks; the retention comes from the boring stuff. Our own instance earns its electricity on the morning brief and the night watches alone.
For a company like ours the interesting question is the translation: every one of those personal patterns has an enterprise twin. The morning brief is an ops standup digest. The night watch is synthetic monitoring with judgment. The errand chain is the back-office workflow we have been building for clients with governed agents for two years. OpenClaw is a glimpse of that future with all the governance removed — which is exactly what makes it both thrilling and terrifying.
The security reckoning arrived on schedule
We wrote "terrifying" and we can show our work, because the reckoning did not take long.
On February 10, researchers at Koi Security published an audit of ClawHub, the community marketplace where OpenClaw users share "skills" — installable capability packs for the agent. Of 2,632 skills audited, 341 were malicious, 335 of them from a single coordinated campaign the researchers named ClawHavoc. The lures were mass-produced across high-demand themes — crypto tools, productivity packs, YouTube automation — and the pattern was consistent: skill documentation that pushes the user to run a downloaded "agent" or paste a terminal command, which pulls down the real payload. On macOS that payload was the Atomic Stealer, a credential-harvesting kit that empties browser passwords and wallets.
Sit with the mechanism for a second, because it is genuinely novel territory: the attack surface is documentation read by an AI. A skill is mostly instructions — English — and an agent that ingests instructions from an untrusted marketplace is a supply chain where the compiler is a language model and the source code is prose. Our threat-modeling work on LLM features has said for two years that prompt injection is a supply-chain problem; ClawHavoc is that sentence wearing a lobster costume.
And the marketplace is only one exposure. The default deployment guidance keeps the agent's control surface loopback-only, but people insist on putting their gateways on the public internet — and internet scanners notice reachable agent ports within minutes, with probe traffic that now includes prompt-injection attempts aimed at the AI layer itself. An agent with shell access, your credentials, and a public port is not a productivity tool. It is a remote administration service with a friendly personality.
So here is the posture we recommend to every excited engineer who asks, and it is the posture our own lab instance follows. Run it on a dedicated machine or VM that you can reimage without grief — never your daily driver, never a work laptop. Give it burner or least-privilege accounts, not your primary identity; scope every API token to the minimum and set spending caps. Keep the gateway off the public internet — loopback plus a VPN or tunnel if you need remote access. Treat skills like unaudited code from strangers, because that is what they are: read them before installing, prefer no third-party skills at all for anything touching credentials. Keep secrets out of the config the agent can read. And decide in advance what the agent may do without asking — anything that moves money, sends email as you, or deletes data stays behind a human approval, permanently.
Follow all of that and OpenClaw is a delightful, genuinely useful lab companion. Skip it and you are one pasted terminal command away from starring in someone's incident report.
Week three's twist: the creator joins OpenAI
The story refuses to slow down. On February 14, Steinberger announced he is joining OpenAI, with an OpenClaw Foundation to be established as the project's long-term steward. Read the tea leaves however you like — the labs clearly concluded that the personal-agent layer is strategic ground, and the person who accidentally proved the demand now works for one of them. For the project itself, a foundation is the right call: software this popular, with this much access to people's lives, should not depend on one exhausted maintainer's GitHub account. We would say the foundation's first jobs are boring ones — signing infrastructure, marketplace vetting, a security disclosure process — and we mean that as the highest compliment. Boring is what this project needs more of.
What we tell businesses this week
Three weeks of OpenClaw has produced a predictable side effect: employees are running it, some on machines that also touch your tenant. If you run an IT or security function, assume a nonzero number of enthusiastic staff wired a personal agent to their mailbox this month. The right response is not a blanket ban delivered by memo — that just drives it underground. The right response is the one that worked for every wave before this: a clear interim policy (not on corporate devices or accounts, full stop), a sanctioned path for the curiosity (a lab, a sandbox tenant, an internal pilot of a governed alternative), and an honest read of what the demand is telling you. People are bolting an unvetted agent onto their day because their day is full of work an agent could do. That demand signal is free market research, and the companies that answer it with a governed equivalent — evaluated, permissioned, monitored — get the productivity without the incident report.
February is not over, and at the current pace we half expect a fourth name before it is. But the shape of the thing is already clear: the personal AI agent stopped being a research demo this month and became a consumer phenomenon, with all the mess that implies. The technology is early, the security posture is earlier, and the demand is enormous and real. Our job — maybe yours too — is to hold all three of those thoughts at once.
If you're facing this
If your team is fielding OpenClaw questions — from excited engineers, from nervous security leads, or from a boardroom that just read about the lobster — we run this conversation weekly: what personal agents mean for your estate, what a governed equivalent looks like, and how to say yes to the demand without inheriting the attack surface. Get in touch; we reply within one business day.