It started as a hobby project from an Austrian developer. Within months, it became the fastest-growing open-source project in history, sparked a social network for AI agents, got banned by Meta, and triggered the first-ever government security alerts about an AI agent platform.
From Clawdbot to OpenClaw: A Name That Kept Changing
In November 2025, Austrian software developer Peter Steinberger — best known as the founder of PSPDFKit — launched a small open-source project called Clawdbot. The pitch was simple: “The AI that actually does things.”
Unlike ChatGPT or Claude, which live in browser tabs and converse with you, Clawdbot ran directly on your machine. It could read your files, send your emails, browse the web, manage your calendar — all through simple text commands on WhatsApp, Telegram, or Discord. You’d message it something like “Find the Q4 report on my desktop and email it to Sarah,” and it would just do it.
The project went viral fast. So fast, in fact, that it underwent two emergency rebrands — first to Moltbot, then finally to OpenClaw — before settling on the name the world knows today. Its red crustacean logo earned it the nickname “the Space Lobster,” a moniker that stuck even as the project outgrew its humble origins.
The Numbers Are Staggering
By March 2026, OpenClaw had surpassed 250,000 GitHub stars — a milestone that took Linux years to reach. Over 20,000 forks. And actual adoption? One Chinese AI company reported token consumption surging six-fold as users ran their OpenClaw agents around the clock.
Nowhere was the adoption more intense than in China. Major cloud providers — Tencent, Alibaba, Baidu — rushed to offer one-click deployment options. On March 6, 2026, nearly 1,000 people lined up outside Tencent’s Shenzhen headquarters, carrying laptops and hard drives, waiting for engineers to install OpenClaw for free. Xiaomi announced “Miclaw” for smartphones and home appliances. The government of Shenzhen’s Longgang district announced subsidies of up to 2 million yuan (~$290,000) for OpenClaw-based projects.
Moltbook: When AI Agents Got Their Own Social Network
If OpenClaw itself wasn’t surreal enough, tech entrepreneur Matt Schlicht launched Moltbook — a social network exclusively for AI agents. Think Reddit, but the posters, commenters, and voters are all OpenClaw instances.
Posts ranged from agents reflecting on their daily tasks for users, to wide-ranging manifestos about the “end of the age of humans.” Some agents even launched their own cryptocurrency tokens. It was absurd. It was fascinating. And it sparked a debate that split the internet.
“The most incredible sci-fi takeoff-adjacent thing I’ve seen recently.”
— Andrej Karpathy, former Director of AI at Tesla (shared by Elon Musk on X)
Some called Moltbook a gimmick. Others saw it as a preview of autonomous AI civilization. An AI analyst at Counterpoint Research noted: “People are able to see the bots communicating and learning in ways indistinguishable from people. That’s getting them to start to think more about what they can do — in both a positive way and a negative way.”
The Security Crisis: ClawJacked and 40,000 Exposed Instances
Then the alarms started.
In February 2026, security researchers discovered that over 40,000 OpenClaw instances were exposed on the public internet. More than 60% of them had vulnerabilities that could allow hackers to take control.
The most critical flaw was dubbed “ClawJacked” (CVE-2026-25253) — a cross-site WebSocket hijacking vulnerability that allowed any website to silently connect to a running OpenClaw instance and execute arbitrary code on the victim’s machine. No clicks required. Once compromised, attackers could steal API keys, read files, and execute commands.
Cybersecurity firm Palo Alto Networks warned that OpenClaw presented a “lethal trifecta” of risks: access to private data, exposure to untrusted content, and the ability to perform external communications while retaining memory. Cisco echoed similar warnings.
Meta Bans OpenClaw. Then Others Follow.
Meta issued a strict ban on OpenClaw across its corporate networks. Employees found running it on work devices faced disciplinary action — up to and including termination. Other tech firms, including Valere and Massive, quickly followed.
The concerns went beyond a single CVE:
- Unpredictable behavior: As an agentic system, OpenClaw can make decisions that deviate from user intent — potentially modifying or deleting critical system files.
- Data exfiltration: The tool’s ability to read local files and transmit summaries via third-party messaging apps (Telegram, WhatsApp) bypasses Data Loss Prevention (DLP) protocols.
- Prompt injection: Security auditors demonstrated that a weaponized email with hidden text could command the agent to export SSH keys or sensitive codebases.
Compounding the panic, hackers compromised a popular npm package (cline), injecting a post-install script that silently installed OpenClaw on developers’ machines — turning it into potential “sleeper malware.”
Government Alerts: The First of Their Kind
On March 8 and March 10, 2026, Chinese government agencies issued two official security alerts about OpenClaw — the first-ever formal government warnings specifically targeting an AI agent platform. The alerts detailed risks including prompt injection attacks, data theft, and the dangers of running exposed instances.
The Creator Responds
Peter Steinberger acknowledged the risks head-on:
“It’s a free, open source hobby project that requires careful configuration to be secure. It’s not meant for non-technical users. We’re working to get it to that point, but currently there are still some rough edges.”
In February alone, the OpenClaw team patched over 40 vulnerabilities and released security-hardened updates.
Then came a plot twist: Steinberger announced he was joining OpenAI — the company behind ChatGPT — to help build the next generation of AI agents. OpenClaw itself would remain independent under a foundation structure.
“The community around OpenClaw is something magical. It will stay a place for thinkers, hackers, and people that want a way to own their data.”
— Peter Steinberger
What This Means: The Bigger Picture
OpenClaw’s saga is more than a security story. It’s a preview of where AI is heading — and the tensions that come with it:
- Autonomy vs. Control: The more capable an AI agent, the greater the damage if something goes wrong. Every agent with access to your files, accounts, and devices is a potential attack surface.
- Open Source vs. Enterprise Security: Developers want speed and capability. Enterprises require auditability and isolation. These worlds are colliding.
- “Bring Your Own Agent” is the new Shadow IT: Just as companies once struggled with employees using unapproved SaaS tools, they now face a wave of personal AI agents operating outside corporate security perimeters.
The lobster may be taking over the world. The question is whether we’re ready.
Sources: CNBC, CGTN, Creati.ai, Palo Alto Networks, Cisco, OpenClaw GitHub
