In a few months, OpenClaw went from a side project to more than 390,000 GitHub stars, a non-profit foundation and its own editions from NVIDIA, Microsoft and Tencent. Plenty of people have heard of it. Few know what it actually is.
The short answer: OpenClaw is an agent harness. A harness is the code around the AI model, the part that builds the context, calls the model, runs the tools and decides when to stop. Here is our read of how it works inside, and what carries over if you want agents doing real work in your business.
Where this comes from
OpenClaw is open source under the MIT license, created by Peter Steinberger, founder of PSPDFKit, who joined OpenAI in February 2026. It went through four names before this one (Warelay, CLAWDIS, Clawdbot and Moltbot) and is now stewarded by a foundation.
An agent that lives in your chat and stays on
You install OpenClaw on your computer or a server and talk to it over WhatsApp, Telegram, Slack or other channels. Three things set it apart from a regular assistant.
- It does not wait for you. It wakes on its own every 30 minutes, reads a checklist and only speaks up if there is something useful. If not, it stays silent.
- It acts. It has a terminal, a browser, file read and write, a calendar and messaging.
- It remembers. Memory lives in plain text files on your disk, which the agent reads and updates itself.
The five layers of the harness
- Inputs. Channel messages, desktop and phone apps, and triggers like schedules and webhooks. All of it becomes the same kind of event.
- Gateway. A single always-on process that keeps conversations in order. Each conversation has its own queue, so three messages in a row become one turn, not a mess.
- Agent runtime. The loop that builds the prompt, calls the model and repeats until done. It can be OpenClaw’s own or be swapped for other executors, such as Codex, without touching the rest.
- Tools. Terminal, browser, web search, messaging, calendar, subagents. Each passes through several permission layers before it runs.
- Where commands run. By default, on the machine itself. A container sandbox exists, but it ships turned off.
The AI model is just one part, and it can be any of them: Claude, GPT, DeepSeek or a local model. What gives the agent its personality, context and limits lives in the harness, not the model.
Memory is a handful of files
The agent does not learn by changing the model. It learns by writing. One file holds its working rules, another its personality, another who the owner is, another what to check on waking, and another its long-term memory. Daily notes go into a search that blends meaning and keywords.
Memory that writes itself is the biggest win and the biggest risk. A malicious email, repeated often enough, can become something the agent “remembers”.
In version 2.0, released in August 2026, the agent started consolidating memory in the background and proposing new skills on its own. Handy for personal use. In a company, whatever becomes long-term memory needs human review.
One trust boundary per install
The most important line in the docs, if you are thinking about a company, is this: one install is one trust boundary. Inside it, the agent, plugins, skills and secrets can see everything. To separate clients or departments, the docs themselves say you need a separate install.
- In March 2026, more than 155,000 installs were open on the internet.
- A February scan by Snyk found a security flaw in 36.8% of the public skills it reviewed, and 76 that were malicious.
- Version 2.0 added session modes (read-only, guarded, workspace and full access) and approvals bound to the exact action, which helps a lot.
Who pays the bill
OpenClaw is free and earns nothing. The money around it goes to whoever sells the model tokens, the machines it runs on and the enterprise editions. An agent that wakes every 30 minutes runs 1,440 turns a month even if nobody asks for anything, and every turn costs.
That is why the community’s most-voted request in October is a per-agent cost cap. In a company, predictable cost is part of the design, not something to sort out later.
What this means in practice
OpenClaw showed the world what an agent that works on its own looks like: a queue per conversation, a routine that wakes up, silence when there is nothing to say, memory in files, rules at the tool and approval before anything sensitive. These ideas work for any company. What changes is the care around security, cost and proof of what was done.
- The AI Analyst picks which routines deserve an always-on agent and defines what it may and may not touch.
- The Forward Deployed Engineer builds the agent into your operations, with an isolated environment per client, least-privilege permissions, human approval and a cost cap.
- Training teaches your team to review what the agent has learned and to approve safely.
Inbox, calendar, reports, collections and data entry are just examples. If a task repeats, it can be automated, with the right harness around it.
OpenClaw proved that an always-on agent is possible. Taking it into a company is harness work: what it sees, what it is allowed to do and how it proves what it did.
Enjoyed this article?
Get the next one before it hits the blog.
A short email per issue with what actually matters about AI agents at work. No spam.