OpenClaw for business: should you run your own AI agent?

OpenClaw is the open-source AI agent that took over GitHub this year: you install it on your own machine, connect it to your chat apps and accounts, and text it like a person. For a technical founder who enjoys tinkering, it is one of the most capable tools you can get for free. For most business owners, running it yourself means taking on hosting, model bills, updates and security that a hosted assistant handles for you. This guide covers what it is, what running it involves, the real risks, and who it suits.

What is OpenClaw?

OpenClaw describes itself as "the AI that really does things." It is a personal AI assistant that runs on your own computer and works through the chat apps you already use. It is MIT-licensed, free to download, and at the time of writing its GitHub page shows nearly 400,000 stars, which makes it one of the most popular open-source projects there has ever been.

It was created by Austrian developer Peter Steinberger, first released in November 2025 as Clawdbot, and later renamed Moltbot and then OpenClaw. In February 2026 Steinberger joined OpenAI to work on personal agents, and said OpenClaw would stay open source under a foundation, with OpenAI sponsoring the project.

At its centre is the Gateway, a program that runs on your laptop, a home server or a rented cloud server. The project says your state, memory and credentials stay on your hardware. The Gateway connects to the chat apps you choose: the repository lists WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Google Chat, Microsoft Teams and more than 20 others. It then connects to the AI model you choose, and the tools and accounts you give it.

What is OpenClaw genuinely good at?

Quite a lot, which is why so many people use it.

It goes where you already are. You do not open an app to use it. You send it a message on WhatsApp or Telegram, and it replies in the same thread, the same idea behind the wave of AI assistants you can text.

It does things, not just answers. It can run commands, work with files and use the services you connect. People use it to clear inboxes, sort their calendars, check in for flights and send themselves a daily digest.

It can act on its own schedule. OpenClaw has a proactive check that runs every 30 minutes by default and messages you when it finds something worth telling you, and stays quiet when it does not.

You choose the model. It supports Anthropic, OpenAI, OpenRouter, GitHub Copilot and local models through Ollama or LM Studio, among others. You can put a strong model on the hard work and a cheaper one on background tasks.

It is open. You can read every line, change it, and extend it with skills from ClawHub, its marketplace. For a developer, that freedom is the whole appeal.

What does running it yourself involve?

Free to download is not the same as free to run. Here is what you take on.

Hosting

You need somewhere for the Gateway to live, and it needs to stay on for the agent to be useful. The install guide covers macOS, Linux and Windows, Docker and Kubernetes, and cloud servers from providers such as DigitalOcean, Hetzner and Fly.io. You need a recent version of Node.js. None of it is hard for a developer. All of it is unfamiliar if you have never run a server.

iMessage needs a Mac

This is the part many people searching "OpenClaw iMessage" run into. OpenClaw talks to iMessage through a tool called imsg, which must run on a Mac signed in to Messages, with Full Disk Access granted. If your Gateway runs on a cloud server, it reaches that Mac over SSH. OpenClaw used to support BlueBubbles as a route into iMessage, but its docs now say that support was removed and imsg is the only path.

Basic sending and reading work as standard. Replies, tapbacks, effects, polls and group actions need what the docs call private API mode, which requires switching off System Integrity Protection, a core macOS security feature. The docs are frank about it: "Disabling SIP is a real security tradeoff," and they recommend a dedicated Mac or a separate bot user rather than your own machine.

API keys and model costs

OpenClaw is free; the AI model behind it is not. You bring your own API key, or in some cases an existing subscription, and you pay the provider for every message, every tool call and every scheduled check. OpenClaw tracks this with a /usage command that estimates cost per reply and per session. What you spend depends on the model, how often it checks in and how much it reads, so the bill is yours to watch.

Maintenance

The project moves fast. You update it, run its doctor check when settings drift, re-run the iMessage helper when a macOS update knocks it out, and keep an eye on security advisories. There is no support desk. When something breaks at 7am, you are the one fixing it.

What are the real risks?

OpenClaw's own team is open about this, and so should anyone recommending it.

It can send as you, without asking. In February 2026, Bloomberg reported on software engineer Chris Boyd, who set up OpenClaw to send him a daily news digest. After he gave it access to iMessage, it sent more than 500 messages to him and his wife and messaged random contacts too. "I realised it wasn't buggy. It was dangerous," he said. Steinberger told Bloomberg, "It's simply not done yet, but we're getting there," and that the project is aimed at technically skilled users. OpenClaw's security guide notes that an agent with message access can send across conversations and apps by default, unless you restrict it.

Skills can be malicious. Skills from ClawHub run with your agent's access. In February 2026, Koi Security audited all 2,857 skills on ClawHub and found 341 malicious ones, most from a single campaign that installed password-stealing malware aimed at always-on machines such as Mac minis. OpenClaw has since added VirusTotal scanning of skills.

Early versions had serious holes. A flaw tracked as CVE-2026-25253 let a single malicious link hand an attacker control of an OpenClaw gateway. It was patched in version 2026.1.29, which is a reminder that a self-hosted agent is only as safe as its last update.

It holds the keys to everything. Security researchers quoted by Bloomberg pointed out that OpenClaw combines access to private data, the ability to send messages out, and exposure to content from strangers. Any message or email it reads could carry instructions meant to trick it.

None of this makes OpenClaw bad software. It makes it powerful software that assumes a careful, technical operator.

How does it compare with a hosted assistant?

Details change quickly in this category, so check each product before you decide.

What should a business watch out for?

If you do run OpenClaw for work, the docs and the incidents above point to the same checklist.

• Keep the Gateway private. Its defaults bind to your own machine only. Do not expose it to the internet without following the security guide.
• Limit what it can send. Restrict which conversations and apps it can message before you connect a business number.
• Treat every skill as untrusted. Read what a skill does before you install it, and install as few as you can.
• Do not share one agent across people who do not trust each other. OpenClaw's security model assumes one trusted operator, or a team that fully trusts each other, per gateway.
• Use a dedicated machine for iMessage, not the Mac with your banking and passwords on it.
• Set a budget with your model provider so a looping agent cannot run up a surprise bill.
• Update often, and run openclaw security audit after changes.

If reading that list feels like a second job, that is a useful signal.

When does a hosted assistant suit a business owner better?

OpenClaw is the right choice if you are a developer, you enjoy building your own tools, and you want full control over every part of the system. It is a remarkable project and it has pushed the whole field forward.

If you run a business and want the work done rather than a system to look after, Mira is built for you. There is no server, no Mac to keep awake, no API keys and no updates to apply. You text it over iMessage or SMS, or use the web app, and connect your accounts once.

From there Mira works much like a well-set-up agent would, without the upkeep. It connects directly to your email, WhatsApp, Slack, LinkedIn, calendar and CRM, turns them into one universal inbox, and runs in the background around the clock. It reads every conversation, brings you only the ones that need you, and texts you first when something does.

The difference that matters most after the Bloomberg story: nothing is sent as you until you say yes. Mira is encrypted in transit and at rest, CASA Tier 2 certified, and never uses your messages to train AI models; the privacy policy has the detail. It is free for 30 days, with no card needed.