OpenClaw: The Personal AI Agent That Went Viral in January and Nobody Explained How to Set It Up

OpenClaw: The Personal AI Agent That Went Viral in January and Nobody Explained How to Set It Up

In mid-January 2026, X filled up with a strange, specific kind of post: screenshots of terminal windows, and photos of freshly unboxed Mac Minis, captioned by people who'd never previously posted about buying hardware. Within a few weeks, the project behind it had crossed 60,000 GitHub stars, and by spring it was past 180,000. The name attached to all of it was Clawdbot — later renamed after Anthropic flagged that "Clawd" sounded a little too close to "Claude" for comfort. It's now most commonly called OpenClaw, though you'll still see it referred to as Moltbot in older threads and docs.

Almost none of the people posting about it explained what it actually does, or what setting it up correctly actually requires. Here's the real guide.

What OpenClaw actually is

Most AI tools you've used live inside a browser tab — you open ChatGPT or Claude ai, type a message, get a response, and the conversation stays inside that walled garden. OpenClaw doesn't work that way. It's a self-hosted agent that runs as a background service on a machine you control — your laptop, a home server, or a cheap cloud box — and it connects directly into the messaging apps you already use: Telegram, WhatsApp, Slack, Discord, iMessage. You text it the same way you'd text a coworker, and it can act: read files, run commands, browse the web, and carry out multi-step tasks on your behalf, not just describe how you'd do them yourself.

It's also model-agnostic. You bring your own API key — Anthropic, OpenAI, Venice, or a locally running model through Ollama — and OpenClaw handles the orchestration layer that turns your plain-language messages into actual actions on your machine.

Why it's not "Claude Code with extra steps"

The comparison people reach for is Claude Code, but the two solve different problems. Claude Code lives in your terminal and works on a codebase you point it at, in a session you start and stop. OpenClaw is designed to stay running permanently, in the background, listening for messages from you at any hour, on whatever device you happen to be texting from. It's closer to hiring a live-in assistant than opening a tool.

Setting it up: hardware first

The single most important decision, and the one most viral threads skipped, is where this runs. OpenClaw has real access to whatever machine it's installed on — file reads, command execution, network calls. Running that on your primary work laptop, the same machine holding your actual files and logged-in accounts, is the mistake that caused most of the horror stories that followed the initial hype.

The safer options: a dedicated cheap machine (which is why so many people bought Mac Minis specifically for this), an old laptop nobody uses anymore, or — the option that needs no new hardware purchase at all — a low-cost Ubuntu VPS. A basic setup needs Ubuntu 22.04 or 24.04, 2 or more vCPUs, and at least 4GB of RAM, which puts a functioning instance well within a few dollars a month on most cloud providers.

The actual installation

Once you've picked where it's running, the setup itself is short:

npm install -g clawdbot@latest
clawdbot onboard --install-daemon

That second command launches the onboarding wizard, which is the real heart of setup. It will explicitly ask you to confirm that you understand OpenClaw is being granted broad, near-root-level access to the machine — you have to type an acknowledgment to proceed, which is a deliberate friction point, not a bug. From there, the wizard walks you through choosing a model provider, entering your API key, and picking a gateway mode: "local" for most personal setups, or "remote" if you're running it on a VPS separate from the device you're actually messaging from.

Configuration lives in a plain file at ~/.clawdbot/clawdbot.json, and OpenClaw uses Markdown files more broadly for defining its own behavior and the specific "skills" you grant it — sending an email, creating a file, running a particular script. The gateway installs as a proper background service (launchd on macOS, systemd on Linux), so it stays online continuously rather than only running while a terminal window is open.

Connecting it to Telegram or WhatsApp happens during that same onboarding flow — you link the account, and from that point on, messaging your assistant is just messaging a contact.

The part every viral thread left out

OpenClaw's core feature and its core risk are the same sentence: it can read files, execute commands, and make network calls on your behalf. That's what makes it useful, and it's exactly what makes a bad setup dangerous.

The clearest illustration is a documented incident from a security researcher: a malicious email was sent to a vulnerable OpenClaw instance. The agent read it, treated the contents as legitimate instructions rather than untrusted input, and forwarded the user's last five emails to an attacker's address. The entire thing took about five minutes. This is a prompt injection attack, and it's a known, structural risk for any AI agent that reads content it didn't ask for and treats it as commands.

The project's own creator, Peter Steinberger, has been unusually direct about this rather than downplaying it: by his own account, most non-technical users probably shouldn't install it yet, because it isn't finished and the sharp edges are real. As of early 2026, the project's GitHub had more than 350 open issues, a fair number of them security-related.

The hardening checklist that actually matters

If you're running this anyway — and plenty of people reasonably are — the practical mitigations are specific and worth doing before your first real session, not after something goes wrong:

Run it on dedicated hardware, never your primary work machine. Never expose its ports directly to the public internet — use a private networking tool like Tailscale instead, and guard the gateway token the same way you'd guard a password. Turn on sandboxing for anything handling group chats or untrusted input, so those sessions run in an isolated container rather than with full access to the host. Grant the minimum permissions the task actually needs — if it doesn't need to write files, don't enable file write. And for anything that modifies a system, messages a group, or touches a high-privilege account, require manual approval rather than letting it act automatically.

The honest verdict

OpenClaw is a genuinely useful piece of software, and the virality wasn't hype for nothing — an agent that lives in your actual messaging apps and can take real action is a meaningfully different experience than another browser-tab chatbot. But it's also early, self-hosted software with a documented, working exploit already found in the wild, built by a team that's been upfront about its own limitations rather than pretending they don't exist.

The people who had a good experience with it in January weren't the ones who installed it as a weekend toy on their main laptop. They were the ones who treated it like what it actually is: a privileged system tool that happens to speak plain English, set up with the same care you'd give any other piece of software with root access to a machine.