OpenClaw Évaluer

agentsopen-sourcedeveloper-aiautomationassessaimay-2026openclaw

Overview

OpenClaw is an open-source, self-hosted AI assistant and agent gateway that connects LLMs to chat channels, local tools and a community skill registry (ClawHub) (OpenClaw).

The project started as Clawdbot, was renamed Moltbot on 27 January 2026 after trademark complaints from Anthropic, and became OpenClaw three days later (Wikipedia). Its creator, Peter Steinberger, joined OpenAI in February 2026, and the project moved to a foundation with continued OpenAI support (The Decoder). Assess after evaluating the security model, maintainer velocity, and overlap with Goose, OpenHands or Hermes Agent. Early adopters should pin releases and monitor the skill supply chain.

Adoption Signals

  • Scale of community interest: about 390,000 stars and 82,000 forks, MIT licence, stewarded by the OpenClaw Foundation (OpenClaw GitHub).
  • High release cadence with a pinnable line: 2026.9.7 shipped on 30 September 2026, and 2026.8.33 is a gateway-only "extended-stable" release that the project calls its LTS equivalent (OpenClaw releases).
  • Vendor ecosystem forming around it: NVIDIA announced NemoClaw at GTC in March 2026, adding the open-source OpenShell layer with kernel-level sandboxing and a privacy router that blocks sensitive data from leaving (CIO).
  • Security documentation has matured: loopback binding and DM pairing by default, a built-in openclaw security audit, hardened baselines and a threat model mapped to MITRE ATLAS (OpenClaw security docs).

Risks

  • Gateway compromise. CVE-2026-25253 (CVSS 8.8) let a single malicious link steal the gateway token and run commands, even on loopback-only installs; it was fixed in 2026.1.29 on 30 January 2026 (The Hacker News).
  • Exposed instances. SecurityScorecard found 40,214 internet-exposed OpenClaw instances in February 2026 and estimated 12,812 of them exploitable via RCE (Infosecurity Magazine).
  • Skill supply chain. Koi Security audited 2,857 ClawHub skills and found 341 malicious ones, 335 from one campaign (ClawHavoc) that delivered the Atomic macOS Stealer and a Windows trojan with keylogging (The Hacker News).
  • Advisory volume. The repository lists 722 published security advisories since January 2026, 14 of them critical, so patching has to be continuous (OpenClaw security advisories).
  • Single trust boundary. The project states that a gateway is not a hostile multi-tenant boundary and that agents with message tools can send across conversations by default (OpenClaw security docs).

Pros & Cons

Advantages

  • Very large and active open-source base: roughly 390,000 GitHub stars and 82,000 forks by September 2026, MIT-licensed, with date-based releases several times a month and an extended-stable (LTS-equivalent) gateway line for teams that need to pin.
  • One self-hosted gateway connects any major model provider to more than 20 chat channels (Slack, Teams, WhatsApp, Telegram and others) plus local tools, so personal and team assistants can be prototyped without building channel integrations.
  • Governance and security investment is increasing: the project moved to an independent foundation in 2026, ships an openclaw security audit command and hardened baselines, and NVIDIA released NemoClaw/OpenShell as a sandboxing and policy layer for enterprise use.

Disadvantages

  • Security track record is poor so far: a one-click token-exfiltration RCE (CVE-2026-25253), tens of thousands of misconfigured internet-exposed instances, and more than 700 published GitHub security advisories within nine months.
  • The ClawHub skill registry was used for a malware campaign (341 malicious skills out of 2,857 audited in February 2026), so community skills are an active supply-chain risk.
  • The documented trust model is one trusted operator per gateway; OpenClaw is explicitly not a boundary between mutually untrusted users, which limits shared enterprise deployments.

Recommendation

Keep OpenClaw in Assess. It is useful for understanding how personal and team assistants combine chat channels, tools and skills, but its security record does not yet support production use with company data or credentials. Evaluate it on isolated hosts with test accounts, the extended-stable release line, the hardened baseline, and a sandbox such as OpenShell, and run openclaw security audit before and after every configuration change.

Do not install ClawHub skills without code review and an internal allowlist, and do not connect a gateway to shared channels where users do not trust each other. Teams that need a governed coding or operations agent today should compare Goose, OpenHands or managed offerings first, and reassess OpenClaw when advisory volume falls and foundation governance, signed skills and multi-tenant isolation are documented.

Sources

Conseil

Du radar à la mise en œuvre

Vous avez évalué les technologies — nous vous aidons à les intégrer à vos systèmes de production de manière sûre et mesurable.

Agents IA

Agents IA

Des agents en production, pas seulement en prototype : RUBINLAKE AI Agents prennent en charge recherche, prévisions et veille de marché pour votre équipe. Sourcés et exploités par nous.

En savoir plus
Formations IA

Formations IA

Nous rendons vos équipes prêtes pour l'IA. Nos formations transforment le jargon en compétences applicables. Clair. Pratique. Pour les faiseurs.

En savoir plus