Where OpenClaw Came From: A Side Project That OpenAI Bought for $1 Billion

OpenClaw started as Clawdbot, a personal open-source AI agent side project built by Austrian developer Peter Steinberger in mid-2025, initially leveraging Anthropic's Claude . It went viral in early 2026, reaching 150,000 downloads by January . On Valentine's Day 2026 (February 14), OpenAI acquired the project in what was widely reported as a $1 billion deal, with Steinberger joining OpenAI to work on "bringing agents to everyone" . As part of the deal, OpenClaw was transferred to the OpenClaw Foundation, a non-profit, to remain open-source and independent . Both Meta and OpenAI had been in a bidding war for the project .

What the Mobile Apps Actually Do

These are companion node apps, not standalone chatbots . They must be paired with a user's self-hosted OpenClaw Gateway (running on a Mac, Linux box, or Windows PC) to function . Once paired, the phone acts as a secure mobile node with these capabilities:

• Real-time text chat with the AI agent
• Real-time voice communication and push-to-talk
• Push notifications to wake the agent and receive alerts
• Action approval workflows (approve or deny agent actions from the phone)
• Selective device-aware automation and controls
• QR code or setup-code pairing with the private gateway
• Channels, tasks, and replies on the go

The apps are not standalone — without a self-hosted gateway, they cannot operate .

Early reports indicate the iOS client appears more polished and functional, while the Android launch drew many negative Play Store reviews citing pairing failures, bugs, and a low rating .

The Security Picture: ClawHub Marketplace and Known Vulnerabilities

OpenClaw has been a frequent target of security researchers since going viral. The mobile app launch brings these risks to phones, as the companion-node architecture means a compromised gateway could expose the paired phone to similar dangers .

ClawHub Marketplace ("Skills") Vulnerabilities

• Palo Alto Networks Unit 42 (June 2026): Reported that five malicious skills bypassed ClawHub's screening controls (VirusTotal and ClawScan), falling into three threat categories: macOS infostealer delivery, scanner evasion, and agentic abuse .
• Snyk (February 2026): Discovered "Leaky Skills" — a systemic vulnerability where skills in the ClawHub ecosystem exposed hardcoded API keys and credentials. Scanning 3,984 skills, researchers found 283 skills (7.1%) contained critical security flaws .
• Third-party reporting: Researchers found as many as 820 malicious skills on ClawHub containing keyloggers, data exfiltration scripts, concealed shell commands, and background file exfiltration .

Other Critical Security Incidents

• "ClawJacked" vulnerability (CVE, Feb 2026): A high-severity WebSocket flaw that allowed a malicious website to hijack a locally running OpenClaw agent and take control. OpenClaw patched it alongside a log poisoning vulnerability .
• Security audit: A full audit reportedly uncovered 512 vulnerabilities, eight of which were rated critical .
• Exposed instances: Security researchers found over 42,000 unsecured OpenClaw instances on the public internet leaking API keys and private data .
• Moltbook database breach: A massive breach of the earlier "Moltbook" rebrand left 1.5 million API tokens accessible to anyone with a browser .
• Early chaos: Within the first week of going viral, the project experienced trademark-forced rebrands (Clawdbot → Moltbot → OpenClaw), crypto scam hijackings, multiple critical CVEs, supply-chain malware on macOS, and exposed control interfaces .
• Microsoft (Feb 2026): Published guidance on running OpenClaw safely, warning that unguarded deployments risk credential exfiltration, persistent state manipulation by attackers, and lateral movement from compromised agents .

Mobile-Specific Risk Note

The mobile apps require granting access to various phone components (camera, screen, location, photos, contacts, calendar, reminders) . The companion-node architecture means a compromised gateway could expose the paired phone to similar risks . Security experts and coverage warn that OpenClaw's security model — designed for desktop self-hosting — now extends directly to mobile devices .

Key Takeaways for Users Considering the OpenClaw Mobile App

• The mobile apps require a self-hosted Gateway; they are not standalone or plug-and-play
• The ClawHub marketplace has a documented history of malicious skills that bypassed screening
• The project has 60+ disclosed CVEs and multiple critical vulnerabilities patched since February 2026
• Running OpenClaw with default settings has been widely described by security researchers as unsafe
• Microsoft recommends identity isolation, runtime sandboxing, and careful credential management for any OpenClaw deployment

Where OpenClaw Came From: A Side Project That OpenAI Bought for $1 Billion

OpenClaw started as Clawdbot, a personal open-source AI agent side project built by Austrian developer Peter Steinberger in mid-2025, initially leveraging Anthropic's Claude . It went viral in early 2026, reaching 150,000 downloads by January . On Valentine's Day 2026 (February 14), OpenAI acquired the project in what was widely reported as a $1 billion deal, with Steinberger joining OpenAI to work on "bringing agents to everyone" . As part of the deal, OpenClaw was transferred to the OpenClaw Foundation, a non-profit, to remain open-source and independent . Both Meta and OpenAI had been in a bidding war for the project .

What the Mobile Apps Actually Do

These are companion node apps, not standalone chatbots . They must be paired with a user's self-hosted OpenClaw Gateway (running on a Mac, Linux box, or Windows PC) to function . Once paired, the phone acts as a secure mobile node with these capabilities:

• Real-time text chat with the AI agent
• Real-time voice communication and push-to-talk
• Push notifications to wake the agent and receive alerts
• Action approval workflows (approve or deny agent actions from the phone)
• Selective device-aware automation and controls
• QR code or setup-code pairing with the private gateway
• Channels, tasks, and replies on the go

The apps are not standalone — without a self-hosted gateway, they cannot operate .

Early reports indicate the iOS client appears more polished and functional, while the Android launch drew many negative Play Store reviews citing pairing failures, bugs, and a low rating .

The Security Picture: ClawHub Marketplace and Known Vulnerabilities

OpenClaw has been a frequent target of security researchers since going viral. The mobile app launch brings these risks to phones, as the companion-node architecture means a compromised gateway could expose the paired phone to similar dangers .

ClawHub Marketplace ("Skills") Vulnerabilities

• Palo Alto Networks Unit 42 (June 2026): Reported that five malicious skills bypassed ClawHub's screening controls (VirusTotal and ClawScan), falling into three threat categories: macOS infostealer delivery, scanner evasion, and agentic abuse .
• Snyk (February 2026): Discovered "Leaky Skills" — a systemic vulnerability where skills in the ClawHub ecosystem exposed hardcoded API keys and credentials. Scanning 3,984 skills, researchers found 283 skills (7.1%) contained critical security flaws .
• Third-party reporting: Researchers found as many as 820 malicious skills on ClawHub containing keyloggers, data exfiltration scripts, concealed shell commands, and background file exfiltration .

Other Critical Security Incidents

• "ClawJacked" vulnerability (CVE, Feb 2026): A high-severity WebSocket flaw that allowed a malicious website to hijack a locally running OpenClaw agent and take control. OpenClaw patched it alongside a log poisoning vulnerability .
• Security audit: A full audit reportedly uncovered 512 vulnerabilities, eight of which were rated critical .
• Exposed instances: Security researchers found over 42,000 unsecured OpenClaw instances on the public internet leaking API keys and private data .
• Moltbook database breach: A massive breach of the earlier "Moltbook" rebrand left 1.5 million API tokens accessible to anyone with a browser .
• Early chaos: Within the first week of going viral, the project experienced trademark-forced rebrands (Clawdbot → Moltbot → OpenClaw), crypto scam hijackings, multiple critical CVEs, supply-chain malware on macOS, and exposed control interfaces .
• Microsoft (Feb 2026): Published guidance on running OpenClaw safely, warning that unguarded deployments risk credential exfiltration, persistent state manipulation by attackers, and lateral movement from compromised agents .

Mobile-Specific Risk Note

The mobile apps require granting access to various phone components (camera, screen, location, photos, contacts, calendar, reminders) . The companion-node architecture means a compromised gateway could expose the paired phone to similar risks . Security experts and coverage warn that OpenClaw's security model — designed for desktop self-hosting — now extends directly to mobile devices .

Key Takeaways for Users Considering the OpenClaw Mobile App

• The mobile apps require a self-hosted Gateway; they are not standalone or plug-and-play
• The ClawHub marketplace has a documented history of malicious skills that bypassed screening
• The project has 60+ disclosed CVEs and multiple critical vulnerabilities patched since February 2026
• Running OpenClaw with default settings has been widely described by security researchers as unsafe
• Microsoft recommends identity isolation, runtime sandboxing, and careful credential management for any OpenClaw deployment