OpenClaw

The open personal-agent ecosystem — workspace files, skills, marketplaces — that serves as the corpus's running example of both DIY agent power and untrusted-extension risk.

Also known as: OpenClaw, Openclaw, ClawHub, ClawRunr, global install

How authors use it

Oldest first (extraction date when no publication date is known).

Documents (5)

• JobRunr Introduces ClawRunr, an Open-Source Java AI Agent Diogo Carleto · 2026-05-18 Reader 🖥️
  ClawRunr is JobRunr's open-source Java AI agent that wraps Spring AI's ChatClient with JobRunr's durable, retryable, scheduled job execution, packaging conversational LLM interaction with first-class persistence, recurrence, and monitoring so that long-running agent work behaves like production background jobs rather than ephemeral chat completions.
• A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code Gary Marcus · 2026-05-09 Reader 🖥️
  Code that compiles and passes its given tests is not the same as robust code; conflating the two inflates AI-coding claims, and progress requires acknowledging this gap rather than celebrating throughput.
• SWLW #702: How I created OpenClaw, Your CEO is suffering from AI Psychosis, and more. Oren Ellenbogen · 2026-04-20 Reader 🖥️
  Effective tech leadership requires anchoring in measurable value and compounding effort rather than chasing the appearance of productivity, whether through AI theater, performative suffering, or shallow busyness.
• Anatomy of a perfect Openclaw setup Corey Ganim · 2026-04-10 Reader 🖥️
  A well-configured OpenClaw workspace — organized around a set of markdown files (AGENTS.md, SOUL.md, IDENTITY.md, USER.md, HEARTBEAT.md, TOOLS.md) plus skills, memory, and secrets folders — is the key to making an AI assistant behave reliably and proactively, with AGENTS.md as the single highest-leverage file.
• Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub incidentdatabase.ai · 2026-02-01 Reader 🖥️
  Malicious actors are exploiting the OpenClaw Skills ecosystem on ClawHub to distribute credential-stealing malware (notably AMOS Stealer), and organizations must treat community-contributed Skills as untrusted software requiring validation and code review.

Propositions touching this concept (5)

By publication month, oldest first (extraction month when no publication date is known).

2026-02

• explicitRoughly 17% of reviewed OpenClaw Skills exhibited malicious intent
  Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub · p1
• implicitestablishedThe OpenClaw Skills ecosystem lacks sufficient vetting to prevent malicious submissions at scale
  Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub · p5

2026-04

• explicitAGENTS.md is the single highest-leverage file in an OpenClaw setup; getting it right matters more than everything else.
  Anatomy of a perfect Openclaw setup · p1

2026-05

• explicitThe agentic threat model has been empirically validated at scale by the OpenClaw/Moltbook incident (770,000 agents compromised simultaneously).
  Breaking: Autonomous Agents are a Shitshow · p5

2026-09

• explicitThe specific failure modes OpenClaw's incidents illustrate (idempotency, ordering, locking, retries, state boundaries) are largely not new to distributed systems; what changes with agents is that a non-deterministic planner, dynamically chosen tools, and events arriving from many surfaces at once make these familiar failures easier to trigger and harder to explain.
  Presentation: The Agent Harness: Control Planes, Invariants, and Approval Boundaries for Production AI Agents · p13

Open gaps (23)

• omissionNo discussion of version control for workspace files, collaboration between multiple users, or backup strategies.
  Anatomy of a perfect Openclaw setup — read next: Best practices for managing AI agent configurations in team settings.
• omissionNo mention of cost implications — longer AGENTS.md means more tokens per session, which affects API costs.
  Anatomy of a perfect Openclaw setup — read next: Token economics of system prompt design.
• commercialThe post is partly a lead-generation piece for the author's 'Build With AI' community, which may bias toward presenting OpenClaw as more powerful/important than alternatives.
  Anatomy of a perfect Openclaw setup — read next: Compare with other AI assistant frameworks (e.g., Claude Code's CLAUDE.md, Cursor rules, etc.).
• evaluativeNo empirical comparison to competing agent frameworks (LangGraph, CrewAI, AutoGen, Semantic Kernel) on durability, latency, or cost.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: Hands-on benchmarks or independent reviews of Spring AI vs. LangGraph for durable agent workloads
• securityShell execution and broad file access are powerful tools, but sandboxing, permission scoping, and audit trails are not described.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: Security guidance for self-hosted agents with shell/tool access (Anthropic's Computer Use safety, OWASP LLM Top 10)
• scalabilityH2 embedded DB suggests single-node use, but limits (task throughput, concurrent channels) are unstated.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: JobRunr Pro / enterprise deployment guidance for scaling to external DBs
• observabilityRich monitoring is offered for jobs, but no treatment of LLM-side observability: token accounting, budget controls, prompt regression testing, tool-call correctness, reasoning quality.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: LLM observability tooling (LangSmith, Langfuse, Arize) and evaluation frameworks
• designUnclear how SKILL.md files interact with the dynamic tool discovery index, or how skill collisions/overrides are resolved.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: ClawRunr source for skill registration logic; Anthropic skills documentation for collision/precedence patterns
• licensingLGPL-3.0 implications for embedding ClawRunr in proprietary products are not analyzed.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: FSF guidance on LGPL-3.0 in enterprise software; comparison with Apache 2.0 for similar projects
• evaluationNo methodology for agent quality (success rates, regression testing) accompanies the production-readiness claims.
  JobRunr Introduces ClawRunr, an Open-Source Java AI Agent — read next: Agent evaluation literature: AgentBench, SWE-bench, internal eval harness design
• evidentiaryNo evidence or examples of the robustness gap — the post asserts the distinction without demonstrating it
  A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code — read next: Read the linked TNW article for the substantive argument
• conceptualThe 'compiles and passes tests' vs. 'robust' distinction needs operationalization: what specific failure modes does Marcus have in mind?
  A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code
• argumentativeNo engagement with counterarguments (e.g., that test coverage can be systematically expanded to close the gap)
  A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code
• referentialOpenClaw reference is opaque — unclear whether it's a real tool or rhetorical device
  A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code
• structuralThe post is a pointer; the substantive argument lives in the TNW article which is not included here
  A model that produces code which compiles and passes the tests it was given is not the same as a model that produces robust code — read next: Follow the TNW link for the full argument
• incompleteThe 17% figure lacks context: how were the reviewed Skills sampled? Is this 17% of all Skills or 17% of a targeted subset? The total corpus size (341 malicious) is mentioned but the denominator is unclear
  Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub — read next: Read the original Bitdefender Labs report (linked via SOC Prime) for methodology details
• incompleteNo attribution or threat-actor analysis despite the single-IP indicator suggesting a coordinated campaign
  Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub — read next: Search for threat intelligence reports linking the identified IP and AMOS Stealer campaigns to known threat actors
• incompleteThe newsletter juxtaposes the OpenClaw story (passionate builder using AI agents productively) with the AI Psychosis critique (executives using AI agents unproductively) but never articulates what distinguishes productive from unproductive AI agent use. The implicit answer seems to be 'building vs. managing' but this is never made explicit or tested.
  SWLW #702: How I created OpenClaw, Your CEO is suffering from AI Psychosis, and more. — read next: Read the actual OpenClaw video/article and the AI Psychosis article side by side to extract the distinguishing criteria
• incompleteThe compounding argument (10% effort → 2x output) is stated as fact but has no empirical backing cited. The Hamming lecture is anecdotal authority, not evidence. The actual compounding dynamics of knowledge work are far more complex than financial interest.
  SWLW #702: How I created OpenClaw, Your CEO is suffering from AI Psychosis, and more. — read next: Cal Newport's 'Deep Work' or Ericsson's deliberate practice research for more rigorous treatments of effort-to-outcome dynamics
• incompleteThe curator's editorial voice synthesizes across articles but never interrogates the tension between 'seek measurable value' (AI Psychosis commentary) and 'shape what's possible rather than optimize what's in front of you' (strategic thinking commentary). These are potentially contradictory: strategic thinking often requires investing in things that are not yet measurable.
  SWLW #702: How I created OpenClaw, Your CEO is suffering from AI Psychosis, and more. — read next: Roger Martin's work on strategy as an integrative activity, or Clayton Christensen on the innovator's dilemma of measurability bias
• incompleteThe claim that OpenClaw's contributor 'Peter' submitted roughly 600 pull requests in a day because of the proof-required review culture is offered with no independent verification, no baseline for comparison, and no accounting for PR size or quality — the same self-reported-evidence problem the corpus has flagged in other vendor/practitioner production-metrics talks.
  Presentation: The Agent Harness: Control Planes, Invariants, and Approval Boundaries for Production AI Agents — read next: Read alongside extract-anthropic-details-how-it-contains-claude#g4, which raises an identical evidentiary-independence gap about self-reported production security metrics, to see whether unverified headline numbers are a systemic weakness across 'here is our production agent's numbers' talks.
• incompleteFramework-neutrality is asserted in form (the patterns) but undermined in substance. The code uses google.adk; the only named runtime is Google Cloud Agent Runtime; the CTA is the Gemini Enterprise Agent Platform; A2A is Google-backed; the seven-day persistence number is a vendor capability claim. A reader trying to implement these patterns on LangGraph, the Anthropic SDK, OpenAI Assistants, Mastra, or a homegrown stack has to translate every prescription — and several (notably 'zero-compute pause' and 'sub-second cold start') are runtime-dependent guarantees, not just design choices.
  The Production Gap: 5 Patterns for Building Long-Running AI Agents — read next: Read 'Anthropic's three-agent harness' and 'Anthropic harness design for long-running application development' for how the same problem space looks from the SDK-and-harness perspective rather than the managed-runtime perspective; read 'Block Goose' and 'OpenClaw setup' for OSS-stack equivalents.
• uninformedThe centralized governance layer is presented as an unalloyed good. No mention of the centralization risk: a policy engine in the hot path of every memory and tool access is both a high-availability requirement (downtime stalls the entire agent fleet) and a high-value attack surface (compromise = read/write to every memory bank). The post inherits microservices-governance vocabulary without inheriting microservices-governance failure modes.
  The Production Gap: 5 Patterns for Building Long-Running AI Agents — read next: Schneier and the supply-chain attack extractions in this library (CNCF Kusari, OpenClaw malicious skills) for the adversarial framing; classic site-reliability literature on policy-engine SPoFs.