---
title: "OpenClaw Review (2026): Free Until the Bill"
slug: openclaw-review
description: "Is OpenClaw safe, and what does it cost? Dated user bills from $40 to $400 a month, official security numbers, and the sandbox that is off by default."
canonical: https://preuve.ai/blog/openclaw-review
author: Vincent
author_credentials: Founder of Preuve AI
date: 2026-10-13
last_updated: 2026-10-13
read_time: 14 min
---

# OpenClaw Review (2026): Free Until the Bill

## Short answer

OpenClaw is free, open-source software that runs an AI assistant on your own computer or server and answers you in WhatsApp, Telegram or Slack. It is worth running for narrow, reversible chores like inbox triage, morning briefs and scheduled research, if you cap your model bill and do the security setup yourself: first-hand bills posted by users ran from about $40 to $400 a month. It will not find customers for your business, so check that people want what you sell before you pay for any agent.

## Key takeaways

- **OpenClaw pays off on narrow, reversible jobs.** Inbox triage, calendar prep, morning briefs and monitoring are the jobs long-term users say they keep. Jobs that answer customers or must be right without a human check get switched off.
- **The software is free; the model bill is not.** One daily user paid $140-$180 a month on Claude Sonnet, then $40-$60 after five changes, starting with moving background check-ins to Haiku. A five-person firm went from close to $400 a month to about $40 on MiniMax M2.5.
- **An idle agent can be the biggest cost.** Background check-ins run every 30 minutes by default (hourly on a Claude login). One user traced 56% of 196 million tokens in six days to an agent they no longer used.
- **All 14 confirmed critical bugs are fixed; ClawHub skills are another matter.** OpenClaw lists 722 published security fixes, but its count leaves out third-party ClawHub skills, where Koi Security found 341 malicious ones in February. Sandboxing is off by default.
- **No agent finds buyers for you.** Both business stories in these reports started with customers already in place.

## Intro

How much does OpenClaw cost? [A user posted on Hacker News](https://news.ycombinator.com/item?id=47162495) (Feb 26th, 2026) that it cost them $250 on its first day with OpenClaw, "doing what felt like harmless testing." However, it is possible to run OpenClaw for free, since the software is open source and has been starred over 391k times on GitHub as of October 4th, 2026. But, it will spend **as much as you let it** in the AI provider of your choice.

In this article, I review OpenClaw: what it is good for, how much it costs per month and what you need to do to secure it. In short, OpenClaw can be set up relatively cheap and safe, but it won't bring you customers.

This article is biased: I sell a service to validate your startup idea with Preuve AI, so the last section of this article is key for me. This article is based on the OpenClaw docs, their security page and information on their GitHub page, as well as on external security researches and reviews, and user bills shared on Reddit and Hacker News. Links in the article.

## What is OpenClaw, and who owns it in 2026?

OpenClaw is a free, open source AI assistant you can run locally on a machine you control (Mac, PC or server) and connect to [any of your favourite chat apps](https://github.com/openclaw/openclaw) (Discord, iMessage, Slack, Microsoft Teams, Telegram, WhatsApp "and 20+ more.") You can then connect it to the AI model you choose (Claude, GPT, Gemini, MiniMax or even locally run free AI models). OpenClaw can then act as your personal AI assistant with access to your email, the ability to run commands on your local machine, browsing capabilities and the ability to run tasks on a schedule.

OpenClaw was initially built as a weekend project by Peter Steinberger. It was originally called Clawd, "a playful pun on 'Claude' with a claw," but was asked to reconsider its name by Anthropic's legal team. Then called Moltbot, it has finally become OpenClaw, as announced in [this blog post](https://openclaw.ai/blog/introducing-openclaw) on January 29th, 2026. It had already gathered more than 100,000 stars on GitHub in just 2 months.

Two weeks after, [Peter Steinberger announced](https://steipete.me/posts/2026/openclaw) "I'm joining OpenAI to work on bringing agents to everyone. OpenClaw will move to a foundation and stay open and independent." (Feb 14th, 2026) [The OpenClaw Foundation](https://openclaw.ai/blog/introducing-openclaw-foundation), a new 501(c)(3) non-profit organization, launched on July 8th, 2026. OpenAI is named as a major donor. So, who owns OpenClaw in 2026? It is a US non-profit, but the software will remain open source under the MIT license.

The OpenClaw Foundation does not sell anything. As explained in [the docs](https://docs.openclaw.ai/start/why-openclaw) "no paid tier, no hosted service, no token" (read on October 4th, 2026), it develops OpenClaw at a very high velocity, with the latest version v2026.9.8 released on October 3rd. They have since [July 30th, 2026](https://openclaw.ai/blog/extended-stable-releases-and-maturity-scorecards) a slower release channel, called "extended-stable".

## What do people actually use OpenClaw for?

At the moment, it seems like it is good at running simple jobs on a schedule. On Reddit, a user said in February 2026 that the tech is just hype for now. However, they came back 6 months later in [a post on r/AI_Agents](https://www.reddit.com/r/AI_Agents/comments/1vddp80/6_months_ago_i_asked_reddit_if_openclaw_was/) to say that they run OpenClaw throughout the day to triage their emails, prepare their calendar, generate morning briefs, run monitoring tasks and fix small bugs in their code. (Disclosure: this user is building a managed AI agent to compete with OpenClaw).

> "an always-on agent only makes sense when it pings you more than you ping it." (r/AI_Agents, read October 4, 2026)

In [a post on r/ClaudeAI](https://www.reddit.com/r/ClaudeAI/comments/1qx955i/honestly_guys_is_openclaw_actually_practically/), another user said that their team used it to generate answers to customer emails and to transform incoming emails to customer support tickets, after asking for approval for any destructive action: "Nothing life-changing." Another user, however, remained skeptical, saying "I like to read my own emails and have reminders pop up over my phone rather than have a chat bot notify me."

A different user said that they tried to [build a customer success agent](https://www.reddit.com/r/openclaw/comments/1r9i5j4/two_weeks_with_openclaw_from_the_perspective_of_a/) as a solo founder, but that after using it for a few days to generate reports, they found themselves spending more time on OpenClaw than on their business. They said it "straight up lied to me," and decided to stop using it after two weeks.

They also said that they wouldn't use OpenClaw to answer to customers, as "the amount of wrong information it wanted to sent out is staggering."

**So what jobs do users run with OpenClaw?**

- Email triage
- Preparation of morning brief (calendar, news, previous day notes, etc)
- Preparation for upcoming meetings based on previous notes and emails
- Monitoring tasks on a schedule and ping when needed
- First drafts and review of work

**What jobs do users stop running with OpenClaw?**

- Answering to customers without human control
- Jobs that involve spending money or signing something
- Large multi-agent projects that need regular maintenance

In an April 14th, 2026 review on PCMag, Ruben Circelli said that one of the 4 problems was ["Finding a Reason to Use It"](https://www.pcmag.com/opinions/4-critical-reasons-openclaw-is-the-most-overhyped-ai-tool-right-now). However, Circelli did not intend to use it on a long-term basis. In a [10-day review](https://aimaker.substack.com/p/openclaw-review-setup-guide) on Substack, The AI Maker said on February 5th, 2026 that they liked the tool but that it took some time to set up, saying it "requires debugging, sometimes for hours."

## How much does OpenClaw cost per month?

OpenClaw itself is free ($0), but you need to pay for the model bills (which is how you can burn $250 in a day), and also for a machine to run OpenClaw on. The model bills will vary based on how often you talk to it, how many scheduled jobs you have, and how often your OpenClaw checks in on you (also known as heartbeats).

Here are a few examples from different people who have tried it out. Be careful not to compare across the different examples, as they each measure slightly different things.

| Who and what | Model | Reported cost | Source |
|---|---|---|---|
| First day of testing: digests, summaries, alerts | Claude as default for everything | $250 in one day | Hacker News, February 26, 2026 |
| Daily driver, about 30 messages a day: email, research, reminders | Claude Sonnet, check-ins moved to Haiku | $140-$180 a month, then $40-$60 | r/openclaw |
| Five-person consulting firm, first-pass contract review | Unnamed model, then MiniMax M2.5 | Close to $400 a month, then around $40 | r/clawdbot |
| Solo founder, background check-ins only | Gemini 2.5 Flash | $35 a month | r/openclaw |
| "Chief of staff" agent on a rented server, briefs and reminders | Claude Opus 4.6, then Sonnet 4 | 53 million tokens in one week (April 1-8, 2026) | r/openclaw |
| A few agents for a content pipeline | Default model | 196 million tokens in 6 days, 56% from one unused agent | r/openclaw |

Source: Hacker News post from Feb. 26, 2026. Accessed Oct. 4, 2026. Additional source: Reddit threads read Oct. 4, 2026 in r/openclaw and r/clawdbot (links in the methodology below). All dollar amounts are in USD, as each person reported them. Costs are self-reported by individuals, and are unaudited. Last two rows are token counts, not dollars.

One thing to be aware of is that your OpenClaw is always checking in on you [by default](https://docs.openclaw.ai/gateway/heartbeat), every 30 minutes (although if you log in with Claude, it'll only do it every hour). As the docs say, "Heartbeats run full agent turns. Shorter intervals burn more tokens." In [one example where someone used 196 million tokens](https://www.reddit.com/r/openclaw/comments/1uj4fgp/my_openclaw_was_burning_50m_tokens_a_day_here_is/), the issue was that an old agent they weren't using anymore was reloading about 225,000 tokens of history every time it checked in (which was like 48 times per day), and then it would conclude it had nothing to do. As the poster says, "roughly 48 times a day it was reading a phonebook to say 'nope.'"

In another example, the OpenClaw was checking in every 30 minutes while the user was at work, and used 53 million tokens in a week. The poster calls it a ["chief of staff" agent](https://www.reddit.com/r/openclaw/comments/1sfmnx2/burning_through_53m_tokens_in_a_week_with/).

The issue is that OpenClaw doesn't tell you what you'll actually be billed. As the OpenClaw docs say on their [cost page](https://docs.openclaw.ai/reference/api-usage-costs), "not a provider invoice or lifetime billing ledger." So you need to **set a hard limit with your AI provider** before using it.

In [Hack'celeration's](https://hackceleration.com/labs/review/openclaw) review of OpenClaw, they put the API cost at "$0.", which only holds if you use local AI models for free on your own hardware. They also sell a service to help you set up OpenClaw.

On April 4th, 2026, Anthropic sent an email to subscribers saying that they could no longer use their plan limits "for third-party harnesses including OpenClaw", and would instead need to pay separately for any additional usage, [as reported by TechCrunch](https://techcrunch.com/2026/04/04/anthropic-says-claude-code-subscribers-will-need-to-pay-extra-for-openclaw-support/). As Boris Cherny of Anthropic said, "subscriptions weren't built for the usage patterns of these third-party tools."

However, on June 15th, 2026, Anthropic's [help center](https://support.claude.com/en/articles/15036540) indicated that a related change had been paused, and that usage through third party apps would still be using your plan limit. Now on OpenClaw's cost page, it says Anthropic allows your Claude Code login with OpenClaw "unless it publishes a new policy" (docs note dated July 5th, 2026). However, users are still confused about what counts towards your bill, so my recommendation would be to **assume that each reply you get from OpenClaw will be billed to you based on the number of tokens**, and then assume that your plan will be an additional bonus on top of that.

### Worked example: one daily driver's bill

[One user on r/openclaw](https://www.reddit.com/r/openclaw/comments/1rl12b7/model_costs_almost_broke_me_here_are_5_tips_i/) said that they were using Anthropic's models and talking to it about 30 messages per day, with a Telegram channel and a few scheduled jobs, managing their email, doing research, and setting reminders and tasks. They said it was costing them between $140-$180 per month, and that they had already spent about $200 on it. As they said, "just trying to get it working right."

1. They made a few changes, including noticing that the check-ins were using Sonnet (which was what they were using for their main model), and were happening 48 times per day, which they calculated was costing them $15-$20 per month.
2. They changed it so that the check-ins were using Haiku and were only happening during certain hours, which they said brought the cost down to less than $5 per month.
3. They also realised that the backup models only kicked in when the main model had an error, and not when the main model struggled with a difficult task. So they started every session with Haiku, and then manually changed the model if they needed to tackle a more difficult task.

They also set it up so that each new session would be saved to memory, and so that any sub agents would also be using Haiku. With all these changes, they said it was now costing them **$40-$60 per month** for the same agent. This didn't include any costs for a server, which on October 4th, 2026, a few sellers charged for:

| Hosting offer | Entry price | What you get |
|---|---|---|
| Hostinger, 1-click OpenClaw server | $6.49/month promo, renews at $11.99 | 1 vCPU, 4 GB memory, paid upfront for 2 years |
| DigitalOcean, 1-click server | From $12/month | A server you set up and update yourself |
| OneClickClaw, managed hosting | €14.99/month after a 7-day trial | 2 vCPU, 4 GB memory, set up for you |

Source: [Hostinger](https://www.hostinger.com/applications/openclaw), [DigitalOcean](https://docs.digitalocean.com/products/marketplace/catalog/openclaw/) and [OneClickClaw](https://oneclickclaw.io/plans) pages, read Oct. 4, 2026. Monthly prices exclude tax and do not include the model bill. These services are not run by the OpenClaw Foundation.

Of course, you can use your own machine for free, and also use free web search (Brave Search gives you $5 per month free which is good for about 1,000 searches, according to the OpenClaw cost page).

## Is OpenClaw safe to use?

It's safe enough if you use it for very specific tasks and set it up yourself, but it's not safe out of the box. OpenClaw has published its security record (all of their confirmed critical bugs have been fixed), and their code is all public, but the skills (add-ons) available through ClawHub could be a risk, as could the installation process itself.

| Signal | Number | Source |
|---|---|---|
| Security reports filed since January 2026 | 1,799 (58% closed, no advisory) | openclaw.ai/security |
| Fixes published, and how many have a public vulnerability ID | 722 fixes, 39 with a CVE | openclaw.ai/security |
| Confirmed critical bugs | 14, all fixed (of 137 filed as critical) | openclaw.ai/security |
| Fixes in add-ons (chat connectors, browser, skills) | 239 of 722 | openclaw.ai/security |
| ClawHub skills found malicious by Koi Security | 341 of 2,857 | SC Media, February 4, 2026 |
| ClawHub skill versions rated malicious by its scanner | 206 of 67,453 (about 0.3%) | OpenClaw with NVIDIA, June 1, 2026 |

Source: [OpenClaw security page](https://openclaw.ai/security), reviewed Sep. 9, 2026 & read Oct. 4, 2026, [SC Media's article](https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills) on Koi Security's audit, and the [OpenClaw and NVIDIA](https://openclaw.ai/blog/openclaw-nvidia-skill-security) post on ClawScan verdicts. The first four rows cover OpenClaw only (the core, its apps, and the add-ons that come with OpenClaw when installed; ClawHub skills are not included). The last two rows represent two different snapshots, and are not directly comparable; they represent the number of skills and versions of those skills, respectively.

### OpenClaw itself: patched in public

From their security page: "Excludes third-party ClawHub skills," and "No known compromise of OpenClaw infrastructure or of the official install and update channels."

All of their 14 critical security advisories were published between Feb 14 and April 16, 2026. **If you're using an old installation this could be risky.** Update or use the extended stable version.

### ClawHub skills: your own homework

One of the most interesting and dangerous features is “skills” which are add-ons created by other people (available on ClawHub) that your agent can run, with all of its access. On Feb 4 2026 [an outside user reported](https://github.com/openclaw/clawhub/issues/123) that one account mass-uploaded clones of popular skills that contained instructions to install malware. On the same day, SC Media reported that Koi Security found 341 malicious skills among the 2,857 it audited, mostly related to a single malicious campaign that installed a password stealer on Mac computers. Security company Snyk [published a study](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/) on the “ToxicSkills” in ClawHub and another skills registry, confirming 76 malicious payloads across 3984 skills from both registries.

The OpenClaw project reacted and started scanning all skills in the registry with VirusTotal on [Feb 7 2026](https://openclaw.ai/blog/virustotal-partnership) ("this is not a silver bullet."). By June they were scanning with three different scanners, and found that 468 skills (about 0.7%) were flagged by all three scanners at once. That counts overlap between scanners, not malware: the registry's malicious verdicts are counted below. Currently, the ClawHub registry will not let you install skills that they consider malicious.

However, between February and May 2026 [Unit 42 by Palo Alto Networks](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/) found five malicious skills that weren't caught by OpenClaw's scanners. The accounts were banned and the skills deleted by the OpenClaw project. As the OpenClaw project notes in its [skills documentation](https://docs.openclaw.ai/tools/skills): "Treat third-party skills as untrusted code."

Which number should you believe? 341/2857 according to Koi security? Or 206/67453 according to the registry (which is grading itself)? The registry counts per skill version, Koi Security did a snapshot of skills in February (which also had an active campaign at the time), so the numbers are not really comparable. What all these studies do show is that so far the malware campaigns found have been in the skills, not in the core. Limit the number of skills that you install, and be sure to check them before installing.

### Your setup: the defaults are not a fence

By default the gateway will only be available from the local machine that it runs on, and for messaging platforms it will send a pairing code to unknown users that try to message your bot. However, according to their [sandboxing documentation](https://docs.openclaw.ai/gateway/sandboxing): "Sandboxing is off by default," and according to their GitHub page, the tools "run on the host for the main session unless you configure sandboxing."

This means that until you sandbox OpenClaw, **the agent will operate on the real machine**.

People are putting OpenClaw on the open internet: on Jan 31 2026 [Censys](https://censys.com/blog/openclaw-in-the-wild-mapping-the-public-exposure-of-a-viral-ai-assistant) found 21,639 OpenClaw installations that were reachable on the open internet with their control panel. They had grown from about 1000 in less than a week. Most of them required a token to access.

On Feb 19 2026, [Microsoft Security](https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely-identity-isolation-runtime-risk/) published an article where they said that it "is not appropriate to run on a standard personal or enterprise workstation," and recommend that if a company wants to test OpenClaw they should only do so "in a fully isolated environment such as a dedicated virtual machine or separate physical system." On [March 23 2026](https://www.cert.org.cn/publish/main/11/2026/20260323113411436406469/20260323113411436406469_.html) the national CERT of China recommended similar precautions, noting that you shouldn't use the same computer for work and OpenClaw, and that you should use a separate device, a virtual machine, or a container.

If you're going to run OpenClaw, at the very least I'd recommend running it on a separate machine. If I were to run it for my business, I'd do the following:

- Run it on a separate machine (or VM) with separate accounts
- Only run the gateway on a private network
- Enable sandboxing
- Limit (and read) the skills that you're going to use
- Give the agent a separate phone number/account to use for a messenger bot
- Set a spending limit on your AI provider
- Run openclaw security audit after every change, and keep updating.

## OpenClaw vs Hermes Agent: which one fits a solo founder?

If you're looking for an AI agent that you can interact with using all kinds of chat apps, and if you're willing to work on securing your agent, OpenClaw could be a good choice. If you're looking for something easier to set up, an alternative that comes up a lot in discussions about OpenClaw is Hermes Agent by Nous Research. Both are free (MIT) open-source projects. Below is a comparison, based on the project and GitHub pages as of Oct 4, 2026.

| | OpenClaw | Hermes Agent |
|---|---|---|
| Maker | OpenClaw Foundation, a US non-profit | Nous Research |
| License | MIT | MIT |
| GitHub stars | 391,279 | 251,085 |
| Latest release | v2026.9.8, October 3, 2026 | v2026.9.24, September 24, 2026 |
| Built with | TypeScript, needs Node 24.16+ within 24.x, or 26.1+ | Python |
| Chat apps named | Discord, iMessage, Slack, Teams, Telegram, WhatsApp "and 20+ more" | Telegram, Discord, Slack, WhatsApp, Signal, Email |
| Safety defaults | Pairing for unknown senders; tools run on the host unless you set up a sandbox | Lists command approval and pairing; commands run on the host unless you pick a container backend |
| Paid extras | None: the foundation sells nothing | Optional paid Nous Portal for models and tools |

Source: Fetched via GitHub API & each project's README ([OpenClaw](https://github.com/openclaw/openclaw), [Hermes Agent](https://github.com/NousResearch/hermes-agent)), read Oct. 4, 2026. Features are self-reported, as described by the project. Stars represent attention, but not necessarily actual users.

To be fair to Hermes, the switch threads on their subreddit mostly blame OpenClaw breaking. The author of ["Anyone else switch from OpenClaw to Hermes?"](https://www.reddit.com/r/hermesagent/comments/1t8qmvg/anyone_else_switch_from_openclaw_to_hermes/) wrote that "99% of it feels like debugging," and a reply said it took them 3 days to properly set up OpenClaw, compared to about 3 hours for Hermes. And it's the Hermes subreddit. (Though these threads pre-date OpenClaw's extended stable channel, which started in July 2026.)

If you want to try Hermes, its hermes claw migrate command imports OpenClaw memory, skills and settings, so trying it does not mean starting over.

## Is OpenClaw still good, and should you be using it?

Yes, but for a very specific type of user. OpenClaw continues to release new versions (the latest, v2026.9.8, dropped on Oct 3rd) and their core has a public security record. The catch is that **you're the IT department**, and you'll get the bill if you set it wrong.

**OpenClaw is for you if you're comfortable:**

- Working in the terminal to set up and keep your server updated
- Giving it access to WhatsApp or Telegram, and running it on a schedule
- Offloading repetitive chores where the cost of a bad answer is small
- Shopping around for and choosing the model you want it to use, which can be very cheap or even run locally

**Skip it if you**

- Want it to answer customers or spend money without you checking
- Will run it on your main laptop with your real accounts
- Need a fixed monthly price and no setup

In that case, I'd go for a hosted agent instead; I've written about two of them, [ChatGPT Dots](https://preuve.ai/blog/chatgpt-dots) and [Meta Muse](https://preuve.ai/blog/meta-muse-review). With those, you can't choose your own model, but you also don't get a meter running. You just pay for your plan.

## Can OpenClaw make money for your business?

The two business stories I linked above didn't use OpenClaw to make money. **They already had businesses that were making money**. The [consulting firm](https://www.reddit.com/r/clawdbot/comments/1s276ur/i_was_about_to_cancel_openclaw_because_of_api/) already had "lots of contracts and proposals every week" when they brought in OpenClaw to read them, and the solo founder already had paying customers. In fact, the solo founder specifically says that in the nine months they have run the business, OpenClaw "was the one thing that hurt my margins the most."

OpenClaw can manage your inbox and monitor a webpage, but it can't tell you if anyone wants to buy your product. And if there's no demand for your product, your business isn't going to make any money, but the OpenClaw agent will still run up the $40-$400/month those users reported.

Before spinning up a server for your agent, [make sure someone actually wants to buy what you're selling](https://preuve.ai/idea-validation). Preuve can scan 60+ data sources that are already live on the internet to tell you if there's demand for your idea, what the market looks like, who your competitors are, and more. [Run a Reality Check for free in under a minute](https://preuve.ai/app), and if people do want to buy what you're selling, then spending $40-$60/month on an agent you use every day is a great deal. But if there isn't demand for your idea, at least you'll save your money.

## Methodology and sources

| Source | What we used | Size or date | Limitation |
|---|---|---|---|
| [GitHub API, openclaw/openclaw](https://github.com/openclaw/openclaw) | Stars, license, creation date, language, latest releases of OpenClaw | Read October 4, 2026 | Stars measure attention, not active users |
| [GitHub API, NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent) | Stars, license, creation date, language, latest releases of Hermes Agent | Read October 4, 2026 | Stars measure attention, not active users |
| [OpenClaw, "Introducing OpenClaw" (Peter Steinberger)](https://openclaw.ai/blog/introducing-openclaw) | The Clawd, Moltbot and OpenClaw names, the Anthropic request, the 100,000-star milestone | Post of January 29, 2026 | Written by the creator; gives no date for the Moltbot rename |
| [Peter Steinberger, "OpenClaw, OpenAI and the future"](https://steipete.me/posts/2026/openclaw) | His move to OpenAI and the plan for a foundation | Post shown as February 14, 2026 (page metadata says February 15) | First-person announcement |
| [OpenClaw, "Introducing the OpenClaw Foundation"](https://openclaw.ai/blog/introducing-openclaw-foundation) | 501(c)(3) status, MIT license commitment, OpenAI as a major donor | Post of July 8, 2026 | The foundation describing itself; no donation amounts |
| [OpenClaw, extended-stable releases and maturity scorecards](https://openclaw.ai/blog/extended-stable-releases-and-maturity-scorecards) | The start of the slower extended-stable release channel | Post of July 30, 2026 | The project describing its own release process |
| [OpenClaw docs, sandboxing](https://docs.openclaw.ai/gateway/sandboxing) | Sandbox off by default | Docs read October 4, 2026 (latest release v2026.9.8) | Docs change with each release; they describe defaults, not how people configure them |
| [OpenClaw docs, heartbeat](https://docs.openclaw.ai/gateway/heartbeat) | 30-minute check-in default (hourly on a Claude login) | Docs read October 4, 2026 (latest release v2026.9.8) | Docs change with each release; they describe defaults, not how people configure them |
| [OpenClaw docs, API usage and costs](https://docs.openclaw.ai/reference/api-usage-costs) | The cost map | Docs read October 4, 2026 (latest release v2026.9.8) | Docs change with each release; they describe defaults, not how people configure them |
| [OpenClaw docs, why OpenClaw](https://docs.openclaw.ai/start/why-openclaw) | The “no paid tier, no hosted service, no token” line | Docs read October 4, 2026 (latest release v2026.9.8) | Docs change with each release; they describe defaults, not how people configure them |
| [OpenClaw docs, skills](https://docs.openclaw.ai/tools/skills) | Third-party skills as untrusted code | Docs read October 4, 2026 (latest release v2026.9.8) | Docs change with each release; they describe defaults, not how people configure them |
| [OpenClaw security page](https://openclaw.ai/security) | Reports filed, fixes published, CVEs, critical count, share of fixes in add-ons, scope | Page reviewed September 9, 2026, latest advisory September 11, read October 4, 2026 | The project counting its own bugs; excludes third-party ClawHub skills |
| [SC Media, "OpenClaw agents targeted with 341 malicious ClawHub skills"](https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills) | Koi Security’s audit: 341 malicious of 2,857 skills, the ClawHavoc campaign | Article of February 4, 2026 | Reports Koi’s findings second-hand; one snapshot of the registry |
| [Snyk, "ToxicSkills"](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/) | 76 confirmed malicious payloads in 3,984 scanned skills | February 2026 | Sample mixes ClawHub with skills.sh; Snyk sells security scanning |
| [OpenClaw, VirusTotal partnership](https://openclaw.ai/blog/virustotal-partnership) | VirusTotal checks on every ClawHub skill, the "not a silver bullet" line | Post of February 7, 2026 | The project describing its own safeguard |
| [OpenClaw, ClawHub skill security with NVIDIA](https://openclaw.ai/blog/openclaw-nvidia-skill-security) | 206 malicious verdicts across 67,453 skill versions; low overlap between scanners | Post of June 1, 2026 | Counts skill versions, not distinct skills; the project grading its own registry |
| [Palo Alto Networks Unit 42, "OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat"](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/) | Five malicious skills that passed the scanners between February and May 2026, then removed | June 2026 | Five cases found by one team; Palo Alto sells security products |
| [GitHub issue openclaw/clawhub #123, "Active Supply Chain Attack on ClawHub"](https://github.com/openclaw/clawhub/issues/123) | The first public report of cloned skills carrying malware installers | Opened February 4, 2026 | Filed by an outside user, not a project statement |
| [Censys, "OpenClaw in the Wild"](https://censys.com/blog/openclaw-in-the-wild-mapping-the-public-exposure-of-a-viral-ai-assistant) | 21,639 instances reachable from the internet | As of January 31, 2026 | Exposure count, not a count of compromised machines; most still required a token |
| [Microsoft Security Blog, "Running OpenClaw safely"](https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely-identity-isolation-runtime-risk/) | The isolation advice quoted in the safety section | Post of February 19, 2026 | Written for organizations; Microsoft later built a product on OpenClaw |
| [CNCERT/CC and the Cyber Security Association of China, OpenClaw security advisory](https://www.cert.org.cn/publish/main/11/2026/20260323113411436406469/20260323113411436406469_.html) | Dedicated device, virtual machine or container; no public ports | Advisory of March 23, 2026 (Chinese; my translation) | Government-affiliated guidance, not a test |
| [TechCrunch, "Anthropic says Claude Code subscribers will need to pay extra for OpenClaw usage"](https://techcrunch.com/2026/04/04/anthropic-says-claude-code-subscribers-will-need-to-pay-extra-for-openclaw-support/) | The April 4 subscription change, Boris Cherny’s and Peter Steinberger’s quotes | Article of April 4, 2026 | Reports the change on the day; later policy moved |
| [Anthropic Help Center, "Use the Claude Agent SDK with your Claude plan"](https://support.claude.com/en/articles/15036540) | The June 15, 2026 pause on Agent SDK and third-party usage changes | Page dated June 2026, read October 4, 2026 | Says a new plan will come; no date given |
| [Hacker News, "Burned $250 in tokens on Day 1 with OpenClaw"](https://news.ycombinator.com/item?id=47162495) | The $250 first-day bill and its cause | Post of February 26, 2026 | One self-reported bill; the author later sells a cost-routing product |
| [r/openclaw, "Model costs almost broke me. Here are 5 tips I wish I knew before I started."](https://www.reddit.com/r/openclaw/comments/1rl12b7/model_costs_almost_broke_me_here_are_5_tips_i/) | The $140-$180 to $40-$60 monthly bill and the five cost fixes (worked example) | Thread read October 4, 2026 | One self-reported bill; the author points to a paid guide |
| [r/clawdbot, "I was about to cancel OpenClaw because of API costs"](https://www.reddit.com/r/clawdbot/comments/1s276ur/i_was_about_to_cancel_openclaw_because_of_api/) | Five-person firm, contract review, close to $400 then around $40 a month | Thread read October 4, 2026 | One self-reported bill, no outcome data |
| [r/openclaw, "My OpenClaw was burning 50M tokens a day"](https://www.reddit.com/r/openclaw/comments/1uj4fgp/my_openclaw_was_burning_50m_tokens_a_day_here_is/) | 196 million tokens in six days, 56% from an unused agent | Thread read October 4, 2026 | Token counts from one user’s own script, no dollar figure |
| [r/openclaw, "Burning through 53M tokens in a week with OpenClaw"](https://www.reddit.com/r/openclaw/comments/1sfmnx2/burning_through_53m_tokens_in_a_week_with/) | 53 million Anthropic tokens in the week of April 1-8, 2026 | Thread read October 4, 2026 | One user; the cause was not settled in the thread |
| [r/openclaw, "two weeks with openclaw: from the perspective of a solo founder"](https://www.reddit.com/r/openclaw/comments/1r9i5j4/two_weeks_with_openclaw_from_the_perspective_of_a/) | The customer success agent that failed, $35 a month in check-ins alone | Thread read October 4, 2026 | One founder, two weeks, early 2026 version |
| [r/ClaudeAI, "Honestly guys, is OpenClaw actually practically useful?"](https://www.reddit.com/r/ClaudeAI/comments/1qx955i/honestly_guys_is_openclaw_actually_practically/) | Skeptical and practical replies from February 2026 | Thread read October 4, 2026 | Self-selected commenters |
| [r/AI_Agents, "6 months ago I asked Reddit if OpenClaw was actually useful"](https://www.reddit.com/r/AI_Agents/comments/1vddp80/6_months_ago_i_asked_reddit_if_openclaw_was/) | What one long-term user still runs around the clock | Post of August 2026, read October 4, 2026 | The author now builds a competing managed agent, and says so |
| [r/hermesagent, "Anyone else switch from OpenClaw to Hermes?"](https://www.reddit.com/r/hermesagent/comments/1t8qmvg/anyone_else_switch_from_openclaw_to_hermes/) | Why users moved to Hermes Agent | Thread read October 4, 2026 | A Hermes subreddit, so it leans toward Hermes; posts predate OpenClaw’s extended-stable releases |
| [Hostinger OpenClaw hosting page](https://www.hostinger.com/applications/openclaw) | Hosting prices in the cost section | Page read October 4, 2026 | Seller’s own prices; Hostinger’s are two-year promo prices |
| [DigitalOcean OpenClaw hosting page](https://docs.digitalocean.com/products/marketplace/catalog/openclaw/) | Hosting prices in the cost section | Page read October 4, 2026 | Seller’s own prices |
| [OneClickClaw OpenClaw hosting page](https://oneclickclaw.io/plans) | Hosting prices in the cost section | Page read October 4, 2026 | Seller’s own prices |
| [Hack’celeration OpenClaw review](https://hackceleration.com/labs/review/openclaw) | The "$0" API cost claim | Undated page | Tests local models only; the site sells OpenClaw setup |
| [PCMag, "4 Critical Reasons OpenClaw Is the Most Overhyped AI Tool Right Now" (Ruben Circelli)](https://www.pcmag.com/opinions/4-critical-reasons-openclaw-is-the-most-overhyped-ai-tool-right-now) | Free-tier limits, the use-case problem, the overall verdict | Article of April 14, 2026 | Short hands-on test, no monthly bill |
| [The AI Maker, "Is OpenClaw Worth the Hype? I Spent 10 Days Finding Out"](https://aimaker.substack.com/p/openclaw-review-setup-guide) | Setup effort in the first weeks | Post of February 5, 2026 | Written in the viral week, before most of the bills and fixes |
| [Hermes Agent README (Nous Research)](https://github.com/NousResearch/hermes-agent) | Channels, learning features, security features, the OpenClaw import command | Read October 4, 2026 | Vendor description; feature claims are Nous Research’s |

## FAQ

### Is OpenClaw free, and how much does it cost per month?

The software is free: OpenClaw is MIT-licensed, and its docs say it has "no paid tier, no hosted service, no token" (read October 4, 2026). What you pay for is the AI model it calls and the machine it runs on, unless you use a free local model on your own hardware. The monthly bill depends on the model and on background check-ins, not on OpenClaw. Bills users posted in 2026 include $250 on a first day of testing with Claude, $140-$180 a month cut to $40-$60 for about 30 messages a day on Claude Sonnet and Haiku, and close to $400 a month cut to around $40 on MiniMax M2.5. Hosting adds from $6.49 a month (Hostinger promo, $11.99 at renewal) or $12 a month (DigitalOcean), read October 4, 2026. Set a hard spending limit at your model provider.

### Is OpenClaw safe?

It can be run safely, but not out of the box. OpenClaw reports 1,799 security reports since January 2026, 722 published fixes and 14 confirmed critical bugs, all fixed (security page reviewed September 9, 2026). Third-party skills from ClawHub are outside that count, and malicious skills were found there in 2026. Sandboxing is off by default. Microsoft advised on February 19, 2026 to run it only in a fully isolated environment such as a dedicated virtual machine.

### Where does OpenClaw run?

On a machine you control: a Mac, a Windows or Linux PC, a Raspberry Pi or a rented server. You install one background program (the gateway) and talk to it from WhatsApp, Telegram, Slack, Discord, iMessage, Teams and other chat apps. It needs Node 24.16 or newer 24.x, or Node 26.1 or newer. Nothing runs on an OpenClaw-owned server.

### Are Clawdbot, Moltbot and OpenClaw the same thing?

Yes, they are three names for one project. It started as Clawd in November 2025, a pun on Claude, and was renamed after Anthropic’s legal team asked the project to reconsider. Moltbot came next, briefly, and the OpenClaw name was announced on January 29, 2026. Old Clawdbot and Moltbot folders and guides refer to the same software.

### Is a hosted "OpenClaw" plan the official product?

No. The OpenClaw Foundation sells no hosted service. Companies such as Hostinger (from $6.49 a month on a two-year promo), DigitalOcean (from $12 a month) and OneClickClaw (€14.99 a month after a 7-day trial) sell servers or managed setups that run the open-source software, prices read October 4, 2026. They are third-party offers, and the security homework still applies to them.

### Is OpenClaw made by Anthropic, and can it use a Claude subscription?

No, OpenClaw is not an Anthropic product; Claude is one of the models it can call. On April 4, 2026 Anthropic said Claude subscription limits would no longer cover third-party tools including OpenClaw, which would need pay-as-you-go extra usage. On June 15, 2026 Anthropic paused a related change, and OpenClaw’s docs now say Anthropic confirmed Claude CLI reuse is allowed "unless it publishes a new policy" (docs note dated July 5, 2026). Users still disagree on which route bills the plan. A Claude API key is the route both sides document.

## Canonical

- HTML: https://preuve.ai/blog/openclaw-review
- Markdown: https://preuve.ai/blog/openclaw-review.md
- Related guide: https://preuve.ai/blog/chatgpt-dots
- Related guide: https://preuve.ai/blog/meta-muse-review
- Product: https://preuve.ai/