Why we like OpenClaw and what it means for AI assistants
OpenClaw is the most exciting thing to happen in the AI agent space this year. Originally launched as ClawdBot in November 2025, the project exploded to over 200,000 GitHub stars in under eight weeks, renamed itself twice after trademark disputes with Anthropic, and its creator Peter Steinberger just joined OpenAI. The community around it is massive and passionate.
We genuinely like what OpenClaw represents. Here's why, and where we think the conversation needs to go next.
What OpenClaw gets right
OpenClaw lets you run an autonomous AI agent locally on your machine. It connects to messaging platforms like Telegram, WhatsApp, and Discord, maintains persistent memory through a SOUL.md file, and has a skill marketplace called ClawHub for extending functionality.
The core idea is powerful: instead of switching between five different apps to manage your day, you talk to one agent that handles everything. Send emails, manage calendars, triage your inbox, do research, and automate repetitive workflows through natural conversation.
This is exactly the same problem we set out to solve with Prio. The vision is right.
What OpenClaw also gets right is the open-source approach. Anyone can inspect the code, contribute skills, and adapt the agent to their specific needs. The community has come up with over 25 documented use cases, from morning briefings delivered via Telegram to full sales operations pipelines.
The security problem nobody wants to talk about
Here's where things get complicated. Security researchers from CrowdStrike, Cisco, Trend Micro, and Sophos have published warnings about OpenClaw's architecture.
The issues are real and significant:
Remote code execution. A cross-site WebSocket hijacking vulnerability allows one-click RCE attacks on exposed OpenClaw instances. If your agent is accessible from the network, an attacker can potentially execute arbitrary code on your machine.
Plaintext credentials. API keys and OAuth tokens are stored unencrypted. If your machine is compromised, everything the agent has access to is exposed immediately.
Over-permissioning. Agents get broad access to email, calendars, messaging, and file systems. The permission model doesn't enforce least-privilege principles, making misconfigurations easy and common.
Supply chain risks. The ClawHub skill marketplace introduces attack vectors. Community-contributed skills run with the same permissions as the core agent, and vetting is limited.
Cost overruns. Users have reported spending $300+ in two days on basic tasks due to uncapped API usage. There's no built-in rate limiting or cost controls.
These aren't theoretical concerns. OpenClaw is already being deployed in healthcare, finance, government, and insurance contexts. The gap between adoption speed and security maturity is concerning.
How Prio approaches the same problem differently
We started building Prio before OpenClaw went viral, but we're solving the same fundamental problem: founders spend too much time on admin work and need an AI that can actually handle it.
Our approach diverges on a few key points:
Managed infrastructure, not self-hosted. You don't need to configure a local server, manage API keys, or worry about network exposure. Prio runs as a managed service with EU data residency and encrypted connections.
Approval gates on everything. When Prio drafts an email or creates a calendar event, it shows you the action inline with approve/edit/reject buttons. Nothing executes without your explicit consent. Auto-archive is the only exception, and it's limited to newsletters and marketing emails, never invoices, bills, or business-critical messages.
Rate limiting and cost control. Every user gets 50 AI requests per hour, and actions are bounded. No surprise $300 bills.
No training on user data. Your conversations, emails, and documents stay yours. We don't use them to train models. Period.
Smart model routing. Instead of burning expensive API calls on simple tasks, Prio routes requests to the right model size. Quick queries go to fast models, complex research goes to more capable ones.
The bigger picture
OpenClaw proves there's massive demand for AI agents that actually do things rather than just chat. The 200k stars aren't hype. People genuinely want an AI that can clear their inbox, schedule meetings, and handle the administrative overhead of running a business.
But the question isn't whether AI agents will become standard tools for knowledge workers. That's already happening. The question is whether they'll be built with security and user control as first principles, or whether we'll retrofit those later after incidents force the issue.
We think the answer should be obvious. And that's what we're building.
Prio is an AI chief of staff for founders. It handles email, calendar, tasks, and workflows through a single chat interface, with approval gates on every action. Try it free.