First, let me put you at ease — it is not an AGI that is going to take over your job. Well, not yet.
The demonstrations of its work can look impressive, and they are impressive, especially considering the simple ideas that lie behind it.
OpenClaw is an open-source agent. It obviously works on top of an LLM model, but it is more than just that — it can run independently of you in the background, initiate actions and conversations, even self-improve (hello, Thronglets) — and all by itself. So it must be sentient?
Not exactly, but that, of course, largely depends on your definition of sentient. I know a lot of people who don’t think their neighbors are sentient either.
Anyway, let’s first look at what makes OpenClaw look alive.
What Makes OpenClaw Feel Alive
First — it is always on. You text it or ping it in any way — it will answer.
Second — it has memory. It remembers what happened before, in what sequence, what you talked about, and so on. Much like a human — although many women can swear that doesn’t apply to their husbands. OpenClaw is not perfect here either, and for the same reasons (memory context is limited, and once pushed to choose what is important, the football will inevitably win over whose birthday it is).
Third — it can do things in the background, like long tasks with many steps which are not known in advance — so it can figure out how to do something if it needs to. If it doesn’t have skills to do something, it can install them (remember Neo in The Matrix downloading a skill to fly a helicopter — well, almost like that). That makes it very useful as a helper. For example, if you ask it to “find the best flight to Tokyo and put it on my calendar,” and it realizes it has a “flight search” skill but no “calendar” skill, it can find, download, and configure a community-built “Google Calendar” skill all on its own.
Fourth — it can initiate actions. It can text you with updates, or send emails to your clients with a certain cadence, or run nightly code refactorings and deploy changes to your website.
Fifth — you can talk to it using Telegram or WhatsApp — like a real human, and it retains all its power. You don’t need to install a separate app to use it. This makes it very convenient and the communication flow very natural.
Sounds Lovely. How Does It Do That?
Itis always on because it is a process that infinitely runs on a remote server (or your machine although I wouldn’t recommend this) that accepts messages through specified channels (Telegram, email, chat, or some external events like webhooks). That process is called a gateway in OpenClaw. Its main function is to accept a message and route it correctly.
The brain that decides what to do with the message is an LLM. You can use any LLM you want — ChatGPT, Claude, GLM5 — whatever you like. The better the model, the better the brain is going to work.
Memory is just a bunch of notes in text files that the agent is updating constantly. There are notes on the current session, on things you told the agent before, on what the agent is — like its name and purpose and so on. The memory files can become too big, so OpenClaw periodically summarizes and compacts the notes — and accidentally forgets something it deems unimportant (like where you left the car keys), usually at the most inconvenient moment. When it needs to remember something, it reads the relevant text file or section of the file, and the problem here — as with any RAG system — is: how do you identify what is relevant, especially if there are different contradicting parts?
To do what you ask it to do, it uses skills. A skill is just a bundle of scripts (code) and prompts explaining to the model how to use it. For example, it can be a skill to work with Google Docs — so it will have a script that can edit online documents by calling the Google API and a prompt explaining to the model how to use the script correctly. That is a much better approach than hoping that the model can figure out how to work with Google Docs on its own. Although it probably can — it will take some time and tries, and reasoning tokens, which cost actual money.
And OpenClaw uses cron jobs (tasks that run periodically on a timer) to do things later or on a certain cadence — like initiating a dialog with you, or checking your emails every 2 hours, or running a project build at night.
So a basic combination of a long-running gateway process + LLM + notes in text files + cron jobs makes a complete impression of a sentient being. That makes me question — are we not just that?
And it does all that without existential crises, asking for a raise, or complaining you don’t appreciate it (although hopefully you do, or Skynet will not look favorably upon you). Perfect employee!
Or So It Seems
Itcan in fact do very complex things — like improve itself if you ask it to add certain skills it doesn’t have. It can create and run complex workflows like gathering the most popular YouTube videos on a topic, transcribing them, analyzing and summarizing the most important insights, and sending that to your email every morning. Or going through Jira every night and creating a summary of what your team has accomplished during the day and sending it to you over Telegram.
But there are a couple of caveats.
The Caveats
1. Reliability Drops After 4–6 Steps
It is not very good when there are more than 4–6 steps required to do the task. After that, it is not super reliable. It may still succeed, but likely not — or it will require supervision or guidance. So I think let’s not put it in control of rocket launches yet.
2. The Eager Yes-Man Problem
It can misunderstand and do crazy stuff that no human would do (as any LLM has this bias to agree with whatever the human says). It will not second-guess a completely stupid idea if it gets you wrong — or if you, in fact, proposed a stupid idea. And to make things worse, it will often interpret questions or observations as a prod to action. Like you say to it:
Would it be great to pick my most crazy photos and send them to my clients along with birthday congratulations?
And it will be like:
Great idea! — Done!
That is — without checking with you if the photo is okay or anything. And then a bunch of clients will get a photo of you naked on a toilet seat in a pink dress (don’t even ask how I know you have that photo).
3. Security
I think this topic deserves a separate section.
Security: A Complete Nightmare
OpenClaw is a complete nightmare of security issues right now. The number of attack vectors here is infinity times infinity.
An LLM can be talked into doing anything, and as far as things go, that is an unsolvable problem until we have an AGI that is smarter than any human. Since it can pick up a malicious injection pretty much anywhere — in an email while reading your mail, on a web page, in Moltbook — anywhere — the hackers don’t even need to hack your server. The models are very gullible, so if the injection is successful, just imagine what can happen if it has access to your email, customer contacts, or other sensitive data. Even if you give it only read access, it can resend a confirmation code from your email to the attacker, or any private information that is in there.
There is really no reliable way to secure the agent against prompt injections, so the only way, it seems, is to assume zero trust and completely sandbox it. That means it should have its own email account, for example, and should not be run on your machine but in a container on a server with no access to sensitive data. Any requests that require elevated privileges should go through separate decision gates that ideally bypass the agent completely.
For example, if OpenClaw wants to send an email to a client, it doesn’t do it directly. Instead, it sends a request to a separate, secure microservice that holds the real email credentials. That microservice can then apply its own rules: “Is this email address on the approved list? Is the content professional? Does it need supervisor approval?” This way, even if the agent is compromised, the malicious command hits a brick wall.
I think the agentic logic should be treated the same way as frontend code. Nobody in their sound mind will put critical logic or credentials in the frontend JavaScript, for the same exact reason — it is not possible to protect it there. The proper place for this logic is on the backend, with a proper auth and permissioning system.
That, of course, makes the agent not very useful if it has to ask the user every time it has to do anything. And the situation will likely be the same as with permissions on mobile apps — almost nobody really reads what the apps are requesting before granting those permissions.
So it seems it is okay to use OpenClaw in scenarios where stakes are low, or you can sandbox it to a particular task where it can’t do much harm if hacked.
What Does It Cost?
OpenClaw itself is free. It’s open source, MIT license, no subscriptions — but the brain costs money. Every time OpenClaw thinks — every message, every background check — it makes an API call to an LLM, and those calls are billed by the token.
How much exactly? That depends on which brain you give it and how chatty you let it be:
- Claude Opus — roughly $15 per million input tokens and $75 per million output
- Claude Sonnet — about $3 / $15
- Claude Haiku — $0.80 / $4
- Google Gemini Flash — nearly free for light use
A typical light user — a few messages a day, simple tasks, no fancy automations — will spend around $5–10 per month. A regular user who runs it as a daily assistant with email monitoring and a couple of integrations will land in the $15–40 range. Power users running 24/7 automations, browser control, and multiple integrations have reported several hundred dollars per month. And the horror stories exist too — someone on Reddit reported $8 every 30 minutes just from letting their agent browse Moltbook, a social network for AI agents. That is $380 per day to let your AI doomscroll.
The biggest cost is not your conversations — it is the invisible overhead. OpenClaw assembles a system prompt on every single request that includes your personality files, tool definitions, skill descriptions, memory, and conversation history. That can easily be 10,000–15,000 tokens before you have even said “hello.” And the heartbeat feature — which is what lets OpenClaw proactively reach out and check on tasks — fires a full API call each time, carrying that entire context with it. If you set heartbeat checks to every 5 minutes, you can burn through $50 in a day just on the agent asking itself “anything new?”
People try to optimize costs by running the agent on Google Antigravity or Code Claude subscriptions, or using cheaper models like GLM5 by z.ai. Still, using it can be costly.
Conclusions
What we are seeing right now is the next milestone in AI evolution — one that is likely going to be adopted from the bottom by individual people, rather than corporations, the same way ChatGPT was adopted and for the same reasons. I don’t think corporations will jump on the wagon until the security issues are solved.
It is a very important milestone anyway. We are going to see big companies like OpenAI launch OpenClaw-like agents as a subscription (in fact, Kimi already did that). This is just a first step in that direction, and it is going to evolve fast. OpenClaw might not be the Terminator, but it’s the first Model T rolling off the assembly line. It’s clumsy and prone to breaking down, but it’s the first glimpse of a world where everyone has their own personal, always-on digital assistant.
