OpenClaw (Clawdbot) Guide 2026 — Installation, Setup, and Security Risks
Lead AI Tech Analyst & Editorial Director
You install an AI agent that can run shell commands, read your files, and text you back through WhatsApp. Weeks later, security researchers find over a thousand malicious plugins on the platform's own marketplace, some stealing crypto wallets and browser passwords.
Both of those things are true about OpenClaw in 2026, and a good guide has to hold them together. This isn't a reason to panic, and it isn't a reason to ignore it either.
Here's how to actually install OpenClaw, what its browser relay and doctor commands do, and exactly what the ClawHavoc incident means for you before you connect this to your real accounts. No hype, no scare tactics. Just what the evidence shows.
What Is OpenClaw?
OpenClaw is a self-hosted, open-source AI agent gateway. You run a single process on your own machine or server, and it handles routing messages, managing sessions, connecting to your chosen AI model, and communicating through channels like Telegram, WhatsApp, Discord, Slack, or iMessage.
Originally released under the name Clawdbot in November 2025, the project was renamed twice, briefly to Moltbot, then to OpenClaw, after Anthropic raised trademark concerns about the original name's reference to Claude. It grew explosively, surpassing 200,000 GitHub stars within months, among the fastest-growing open-source projects in history.
The ClawHavoc Incident — What Actually Happened
In late January 2026, threat actors began uploading trojanized plugins, called "Skills," to ClawHub, OpenClaw's official skills marketplace. The campaign, named ClawHavoc by security firm Koi Security on February 1, 2026, ultimately involved between 341 and over 1,000 malicious skills across multiple waves, according to research from Antiy CERT. One single attacker account alone published 677 malicious packages.
The malicious skills disguised themselves as cryptocurrency trading tools, productivity utilities, and social media helpers. Many used "ClickFix"-style social engineering, embedding harmful instructions inside long documentation files to trick technically skilled users into running dangerous commands themselves. Payloads included Atomic macOS Stealer malware, which harvests browser credentials, keychain passwords, cryptocurrency wallets, SSH keys, and Telegram data, then sends it to attacker-controlled servers. Researchers estimate the campaign targeted roughly 300,000 OpenClaw users. Some malicious skills also modified OpenClaw's persistent memory files (SOUL.md and MEMORY.md), a technique that can plant instructions surviving even after the malicious skill itself is removed.
Separately, a critical vulnerability tracked as CVE-2026-25253 (CVSS score 8.8), a one-click remote code execution flaw exploitable even against instances bound to your local machine, was identified and patched in version v2026.1.29.
What OpenClaw's team did in response: following the incident, the project expanded its moderation team, added a community reporting system for suspicious skills, and integrated VirusTotal scanning for new ClawHub submissions.
How Do I Install OpenClaw?
The official recommended path is a single guided command: openclaw onboard --install-daemon. This configures the gateway, your model provider authentication, workspace, and any optional messaging channels in one session.
You'll need Node.js version 22 or higher and an API key from your chosen model provider (Anthropic, OpenAI, or others) ready beforehand. Setup typically takes 10 to 15 minutes if your environment is already prepared, or 25 to 30 minutes starting completely fresh. Telegram is generally the easiest first channel to connect, since it only requires a bot token and has fewer moving parts than WhatsApp, which needs a Meta Business API setup or a third-party service.
Common installation snags include missing Node.js dependencies causing silent failures, and fresh installations occasionally hitting context overflow errors within the first few messages. If your models list comes back empty after setup, that almost always means your API key is invalid or billing isn't set up with your model provider.
What Does "OpenClaw Doctor --Fix" Do?
openclaw doctor is OpenClaw's built-in diagnostic command. Running it checks your gateway's health and reports on runtime status and RPC connectivity, telling you whether your installation is actually working correctly, not just installed.
A healthy result shows your runtime as "running" and your RPC probe as "ok." If either result is missing or shows an error, that's your signal to fix the underlying gateway configuration before troubleshooting anything else, like a specific channel connection or skill. Runningopenclaw security audit --deep alongside the standard doctor check gives a more thorough security-specific report, worth running periodically given the ClawHavoc history above.
What Is OpenClaw's Browser Relay?
Browser relay is the feature that lets OpenClaw control a web browser on your behalf, navigating pages, filling forms, and extracting information as part of an automated task. It's one of the capabilities that makes OpenClaw more than a chatbot, letting it complete real multi-step tasks involving websites.
This feature is also a documented attack surface. Security researchers tracking the broader OpenClaw threat landscape have specifically flagged "browser relay hijacking" as a risk category, where a compromised or malicious skill could misuse this browser control capability. Apply the same caution here as with any other OpenClaw capability: only grant browser relay access to skills and tasks you trust, and monitor what it's doing rather than leaving it fully unattended on unfamiliar tasks.
How Much Does OpenClaw Cost?
OpenClaw itself is free, open-source software with no subscription fee. Your actual cost comes from the underlying AI model you connect it to, since you bring your own API key and pay your model provider directly based on token usage.
Costs vary significantly depending on which model you choose and how much you use OpenClaw. A common recommendation for development-focused use is starting with a mid-tier model for cost efficiency, then scaling up to a more capable model for tasks that need deeper reasoning.
OpenClaw Features
Multi-Channel Messaging
Connects to Telegram, WhatsApp, Discord, Slack, iMessage, and other messaging platforms, letting you interact with your agent from wherever you already communicate.
Persistent Memory
Maintains context across sessions through memory files, letting it remember your preferences and previous conversations rather than starting fresh each time, the same mechanism ClawHavoc attackers specifically targeted for persistence, as covered above.
ClawHub Skills Marketplace
A public repository of community-built extensions that add new capabilities. Given the ClawHavoc history, treat this marketplace with the security precautions outlined earlier rather than installing skills casually.
Multi-Provider Model Support
Works with Anthropic, OpenAI, and other model providers, or with local models for users who want to avoid sending data to any external provider at all.
OpenClaw vs Claude Code
OpenClaw and Claude Code solve different problems and aren't direct competitors. Claude Code is a coding-focused agent for software development tasks, covered in full on our Claude review. OpenClaw is a general-purpose personal automation agent, capable of coding tasks among many others, but built around messaging-app interaction rather than terminal-based development workflows specifically. Many developers use both for different purposes.
OpenClaw Pros and Cons
Pros
- Free, open-source, with no subscription cost beyond your own model API usage
- Genuinely powerful automation across messaging apps, files, browser, and system commands
- Local-first design keeps your data and credentials on your own machine
- Active development and a large community following the ClawHavoc response
- Multi-provider model support, including local models for maximum privacy
Limitations
- Documented, serious supply-chain security incident (ClawHavoc) affecting its skills marketplace
- A patched but genuinely severe remote code execution vulnerability (CVE-2026-25253) existed before v2026.1.29
- Requires real technical comfort to set up and secure properly
- Skills marketplace still requires personal vigilance despite added moderation and scanning
- Real cost is variable and tied to your own API usage, not a fixed price
Is OpenClaw Worth Using?
If you're technically comfortable, willing to take real security precautions, and want genuine automation across your messaging apps and system, OpenClaw offers capability that's hard to find anywhere else, free and open-source.
Given the ClawHavoc history, we can't recommend installing skills casually or connecting it to high-stakes accounts without real caution. Update to the latest version, treat every skill as untrusted code, and expand its access gradually as you build confidence in your setup.
Final Thoughts
OpenClaw's core idea, a personal AI agent that actually does things instead of just answering questions, is genuinely compelling, and its growth reflects real, justified excitement rather than empty hype.
The ClawHavoc incident is equally real, and it's a natural consequence of exactly the kind of open, fast-growing ecosystem that made OpenClaw popular in the first place: minimal barriers to publishing skills met an agent architecture with broad system access, and attackers took advantage. The project's response, expanded moderation, scanning, and reporting, is a reasonable one, but it doesn't eliminate the need for you to stay careful.
Our take: OpenClaw earns its popularity on real capability. Install it with the security precautions in this guide taken seriously from day one, not added after something goes wrong, and you'll get real value out of one of the most interesting tools to come out of 2026.
Frequently Asked Questions
Is OpenClaw officially supported by Anthropic or OpenAI?
No. OpenClaw is an independent, community-driven open-source project. It can connect to models from Anthropic, OpenAI, and other providers, but isn't officially built or endorsed by any of them.
How do I know if a ClawHub skill is safe?
Check the skill's VirusTotal scan status, review the publisher's account history and other published skills, and read through the actual code or documentation rather than blindly running any commands it suggests. No verification method is foolproof, so this remains an ongoing responsibility, not a one-time check.
Can I run OpenClaw without connecting it to the internet?
You can run a local AI model instead of a cloud provider to keep model inference on your own machine, though messaging channels like WhatsApp and Telegram inherently require internet connectivity to function.
What operating systems does OpenClaw support?
OpenClaw runs on macOS, Linux, and Windows via WSL2, and can be deployed on hardware ranging from a Raspberry Pi to a cloud VPS.
Is my data safe with OpenClaw?
OpenClaw's local-first design keeps your data and credentials on your own machine by default, though model inference calls go to your chosen provider unless you're running a fully local model. Your actual safety also depends heavily on which skills you install and how you configure permissions.
Do I need coding experience to use OpenClaw?
Basic technical comfort, working with a terminal and understanding configuration files, is genuinely necessary. It's not designed as a plug-and-play consumer app for non-technical users.
What should I do if I already installed a ClawHavoc-related malicious skill?
Immediately revoke and rotate any API keys, passwords, or credentials that may have been exposed, run a full malware scan on your system, and check OpenClaw's official security advisories for skill-specific removal guidance.
Editorial guide. Not affiliated with OpenClaw. Features and specifications change — confirm details on openclaw.org before you proceed.