What Is OpenClaw? The Personal AI Agent, Explained for IT Teams

Updated: November 2026. Versions, defaults and detection indicators checked against the OpenClaw docs and source code, Microsoft Learn and the reports cited on 10 November 2026.

You've found an AI agent on a work laptop that takes orders over WhatsApp, runs commands as the user and keeps notes on everything it's told. Whoever set it up was trying to get through their week faster. If you're asking what is OpenClaw and what to do about it, here's what it reaches, who restricted it, how to find it and how to respond.

TL;DR

• What it is. OpenClaw is a free, MIT-licensed AI agent that runs on the user's machine and acts through its shell, files and browser when asked over chat.
• Why IT cares. It runs as the user with sandboxing off by default, so it reaches what they reach.
• Who restricted it. Korean tech firms, Chinese state agencies and Hong Kong's government restricted it in early 2026.
• How to find it. Look for ~/.openclaw, an OpenClaw Gateway service and port 18789.
• What to do. Block, contain or sanction it, and offer a managed option either way.

What Is OpenClaw?

OpenClaw is a free, MIT-licensed AI agent that runs on a user's own computer or server, connects a language model to the chat apps they already use, and acts through the shell, files, a browser and add-on skills. Its state, memory and credentials stay on that machine.

In plain terms, you message it on WhatsApp, Slack or Teams like a colleague, and it does the task on your computer. It sorts the inbox, fills in a form, sets a reminder. The model is swappable, from Anthropic or OpenAI to one running locally.

It started as Warelay in November 2025, became Clawdbot in January 2026, then Moltbot on 27 January after Anthropic raised a trademark concern, and OpenClaw on 30 January. Detection has to know the old names too.

Its creator, Peter Steinberger, joined OpenAI in February 2026, and a donation-funded OpenClaw Foundation now runs the project. Versions follow the calendar. OpenClaw 2.0 is v2026.8.1, shipped on 31 August 2026 (UTC), and the latest on 10 November 2026 was v2026.11.3, released that day.

How OpenClaw Works

One local process, the Gateway, is the control plane for sessions, tools, events and chat connections. By default it listens on ws://127.0.0.1:18789 on the user's machine.

Channels bring messages in from WhatsApp, Telegram, Slack, Discord, iMessage and others. The model decides what to do, and tools do it: shell commands, file edits, a browser, scheduled jobs and messages back out. Skills are folders with a SKILL.md file that teach it when and how to use its tools. Memory lives in plain files under ~/.openclaw/workspace.

The heartbeat is the part IT should notice. Scheduled nudges let it act with nobody at the keyboard.

It's a ready-made agent, so nobody has to write code to use it, unlike the agent frameworks for MSPs that need building first.

Our agentic AI explainer covers where chatbots end and agents begin.

How OpenClaw Gets Installed and Extended

Installing it takes one line, such as curl -fsSL https://openclaw.ai/install.sh | bash on macOS and Linux, iwr -useb https://openclaw.ai/install.ps1 | iex on Windows or npm install -g openclaw@latest. Then openclaw onboard --install-daemon adds the background service. Hunt for those strings in command-line logs.

A standard user can install it on macOS, Linux and Windows through at least one documented path, with no admin rights. The CLI installer puts Node and OpenClaw in ~/.openclaw, and Windows can fall back to a portable Node under %LOCALAPPDATA%\OpenClaw. On Windows, the boot-time scheduled task is the step that wants elevation, with a logon task or Startup-folder entry as the fallback. So application control does more than removing local admin.

Skills come from ClawHub, the public registry, with openclaw skills install @owner/<slug>. VirusTotal has scanned every ClawHub skill since 7 February 2026 and rescans active ones daily, though --force-install can still jump the scan for GitHub-backed skills. Writing skills is developer work, covered in our guide to building an AI agent.

What OpenClaw Can Reach on a Work Laptop

Its tools run on the host, and the docs state that sandboxing is off by default. So the agent inherits whatever the user can reach.

Early 2026 builds kept API keys and passwords in plain text, per Kaspersky and Token Security, and Kaspersky saw infostealers going after them. Current versions keep pairing and OAuth tokens in SQLite under ~/.openclaw, and the docs say to assume anything in that folder may hold secrets.

A file sent to a personal Telegram account never touches corporate email, so check that your DLP tooling covers chat apps.

Microsoft's Defender researchers put it plainly in February 2026: "It is not appropriate to run on a standard personal or enterprise workstation."

Why Companies and Governments Restrict OpenClaw

Who Restricted OpenClaw

OpenClaw's Security Record

On 31 January 2026, Censys counted 21,639 OpenClaw instances exposed to the internet by matching their control-page titles. Koi Security then found 341 malicious skills among 2,857 on ClawHub, 335 of them from one campaign, ClawHavoc, that installed Atomic Stealer on Macs. By mid-February the count was 824.

CVE-2026-25253 (CVSS 8.8) let one click leak the auth token and open the way to remote code execution, until version 2026.1.29 fixed it on 30 January.

Agents that read email and web pages also face prompt injection, where text they read carries instructions they follow. Defaults have improved since, with loopback binding, a token by default and pairing for unknown senders. Sandboxing is still off.

IBM Technology's Jeff Crume uses OpenClaw to walk through six risks of autonomous agents. It's from June 2026, before OpenClaw 2.0.

OpenClaw as Shadow AI

Shadow AI is AI used at work without IT's approval, and our shadow IT guide covers the pattern. A chatbot leaks what someone pastes in. An agent can go and fetch more.

Token Security reported in February 2026 that 22% of its customers had employees using Clawdbot, found within a week. The denominator is customer organizations, where one user counts the whole company, so it isn't a share of staff.

The project's FAQ lists briefings, drafting, reminders and form-filling as top uses. Ask the person what it does for them, because that's the spec for what you approve instead.

Kaspersky warns that flat bans push agent use underground, and a personal laptop signed in to work email still reaches work data. Your BYOD policy has to cover that.

For an MSP, the laptop and the data belong to a client, so agree the posture and who pays for cleanup in writing before the first find. An early r/msp thread landed on fundamentals: app allowlisting, browser policies, blocking consent to unknown apps and a contract clause for user-caused damage.

How IT Teams Find OpenClaw

Start with what you run: MDM and RMM inventories, EDR process data and DNS logs. Our post on AI agents for IT maps where agents leave traces.

OpenClaw Indicators

From the OpenClaw docs and source, cross-checked against Microsoft, CrowdStrike and Kaspersky on 10 November 2026.

Ports change with a flag, so a quiet 18789 doesn't clear a machine. Kaspersky also lists port 3000, which OpenClaw's docs only use as an example.

In r/cybersecurity, a member asked how others detect it. Upvoted answers start with MDM installed-apps lists and network scans, then correlate processes with unusual outbound traffic. Vendor accounts posted too.

Check With osquery

This query runs on macOS, Linux and Windows. It's a starting point written from documented names, so test it on one machine with OpenClaw installed before fleet-wide use. Our agent sprawl guide covers running osquery at scale.

sql
SELECT p.pid, p.name, p.cmdline, lp.port
FROM processes AS p
LEFT JOIN listening_ports AS lp ON lp.pid = p.pid
WHERE p.pid <> (SELECT pid FROM osquery_info)
  AND (p.name LIKE '%openclaw%'
   OR p.cmdline LIKE '%openclaw%'
   OR p.cmdline LIKE '%clawdbot%'
   OR p.cmdline LIKE '%moltbot%'
   OR p.cmdline LIKE '%clawhub%'
   OR lp.port IN (18789, 18791));

It only sees running processes. A stopped Gateway still leaves its folder and service.

Check With PowerShell

Run this from your RMM as an administrator or SYSTEM. It exits with 1 on a hit, and it's also a starting point to test on one machine first. On machines with the Windows Hub app, also run wsl.exe -l -q as the user and look for OpenClawGateway.

powershell
$startup = 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
$paths = '.openclaw', '.clawdbot', 'clawd', 'AppData\Local\OpenClaw',
  "$startup\OpenClaw Gateway.cmd", "$startup\OpenClaw Gateway.vbs"
$found = @(
  Get-ScheduledTask -TaskName 'OpenClaw*' -ErrorAction SilentlyContinue |
    ForEach-Object { "Task: $($_.TaskName)" }
  Get-CimInstance Win32_Process |
    Where-Object { $_.ProcessId -ne $PID -and $_.CommandLine -match 'openclaw|clawdbot|moltbot|clawhub' } |
    ForEach-Object { "Process: $($_.Name) $($_.ProcessId)" }
  Get-NetTCPConnection -State Listen -LocalPort 18789, 18791 -ErrorAction SilentlyContinue |
    ForEach-Object { "Port: $($_.LocalPort) $($_.OwningProcess)" }
  foreach ($u in Get-ChildItem 'C:\Users' -Directory) {
    foreach ($p in $paths) {
      $f = Join-Path $u.FullName $p
      if (Test-Path -LiteralPath $f) { "Path: $f" }
    }
  }
)
if ($found.Count) { $found; exit 1 } else { 'No OpenClaw indicators found'; exit 0 }

Microsoft Intune Controls

Intune's properties catalog inventories local AI agents on Windows devices, and the first inventory can take up to 24 hours. Its Local AI Agent Baseline - OpenClaw (Preview) blocks outbound TCP from two node.exe paths and leaves WSL enabled. Microsoft warns it may not block every path and may block other processes.

Neither blocked path covers OpenClaw's own portable Node, and the Windows Hub's WSL distro sits outside both. Our AI governance tools roundup covers Defender's agent discovery.

Block, Contain or Sanction OpenClaw

Each posture has a credible backer. Pick one per environment and write it down.

To block, stop openclaw.ai, telemetry.openclaw.ai and clawhub.ai at DNS or a secure web gateway, then add application control for Node in user-writable folders, with exceptions for developers.

Warn people first. A blocked app message with no context sends them to a ticket or a personal laptop.

To contain, follow Microsoft's model and give pilot credentials the narrowest role-based access that works. NVIDIA's NemoClaw, announced on 16 March 2026, adds the OpenShell sandbox, now a backend in OpenClaw's docs, though NVIDIA hasn't stated a license or release date.

To sanction, the project now offers its own route. OpenClaw Enterprise, announced on 29 September 2026, is a free control plane for persistent agents with security boundaries and audit trails, developed with Red Hat and NVIDIA. It's pre-1.0 and meant for internal pilots.

Whichever you pick, put it in your AI acceptable use policy, with OpenClaw's old names, the posture and who approves exceptions.

A sanctioned agent should work where IT can see and approve it. OpenFrame, open AI-native infrastructure for IT and security, runs its agents inside the platform. Fae resolves support requests, Mingo runs IT operations, and sensitive actions wait for a technician's approval. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which makes it the sanctioned-agent example we know first-hand.

If You Find OpenClaw on a Work Device

Bitdefender treats any install as a potential incident, so run your incident response steps in this order.

1. Isolate the device. Cut its network access through EDR, so the agent stops acting and nothing else leaves.
2. Preserve, then remove. Copy ~/.openclaw as evidence and store it as secret material, then run openclaw uninstall --all.
3. Revoke its access. Remove the OAuth consents and API keys it used for mail, files, models and chat apps.
4. Rotate credentials. Change every password and token it could read, starting with privileged accounts.
5. Rebuild and talk. Reimage the laptop, as Microsoft advises, then ask the person what they used it for.

That conversation decides whether OpenClaw comes back. Someone with a working alternative has no reason to reinstall it at home.

OpenClaw vs Manus

Manus, a commercial agent from Butterfly Effect, comes up in the same conversations. Prices are from Manus's help center, read on 10 November 2026.

Manus announced on 29 December 2025 that it was joining Meta, with terms undisclosed. China's National Development and Reform Commission ordered the parties to withdraw on 27 April 2026. Manus announced its return to independence on 11 August 2026 and resumed independent operations on 1 September, so Meta doesn't own it today.

For IT, it comes down to where the work happens. OpenClaw is free and keeps data on a machine you manage, so the hardening is yours. Manus runs for you on a subscription, so review it like any SaaS vendor.

OpenClaw in One Page

OpenClaw is a free, self-hosted agent that works as the user, takes orders over chat and ships with sandboxing off. Find it by folder, service, port and DNS lookups, under all three of its recent names. Choose block, contain or sanction, write the choice into policy, and talk to the people who installed it. Next, our AI governance guide shows how to build the program that decision sits in.