OpenClaw passed React in early March to become the most-starred software project on GitHub, and it did that in under four months. It is a free, open-source AI agent that runs on a person's own machine, with access to their files, their browser and their shell, on an API key they paid for themselves. In March, Chinese authorities told government agencies and state enterprises to keep it off office computers. The productivity story is real. The story that matters to you first is that a capable agent can be installed on a work laptop in an afternoon, and your data-handling policy never sees it.
What you need to know
- This is shadow IT, not a tooling decision. Nobody bought OpenClaw through procurement. A staff member installed it, gave it a personal API key, and it is now reading whatever that laptop can read.
- The access is broad by design. OpenClaw reads and writes files, browses websites, runs shell commands and sends email, with over 100 built-in "skills" that add more. That is the point of it, and it is also the risk.
- The default install has already burned people. Censys counted 21,639 instances exposed to the public internet on 31 January, up from about 1,000 a week earlier, and a remote-takeover flaw was rated 8.8 out of 10.
- Governments are reacting. China restricted state agencies, state enterprises and banks from running it on office devices in March, and told staff who already had it to report it for a security check.
- A ban does not work. The install takes minutes, the value is obvious to the person doing it, and the next tool like it is already on the way. What works is an allowed list, a sanctioned path to the same capability, and a policy people actually read.
346,000+
GitHub stars by 2 April 2026, the most of any software project, from a repository created in late November 2025
Source: OpenClaw VPS via Star History, April 2026
21,639
OpenClaw and Moltbot instances exposed to the public internet on 31 January 2026, up from roughly 1,000 a week earlier
Source: Censys, January 2026
100+
Built-in skills that let the agent read and write files, browse the web, run shell commands and send email
Source: KDnuggets, March 2026
What it is, and why your team wants it
OpenClaw started life in late 2025 as Clawdbot, was renamed Moltbot after Anthropic raised a trademark complaint, and became OpenClaw three days later. It passed 100,000 GitHub stars in February and overtook React, the previous record holder, in early March. By 2 April it was past 346,000. Its creator, Austrian developer Peter Steinberger, joined OpenAI in mid February, and the project moved into a foundation with OpenAI's backing. It stays open source under an MIT licence.
The reason people install it is that it does things rather than talking about them. You message it on WhatsApp, Telegram, Slack or iMessage, and it goes and does the job: tidies a folder, drafts and sends a reply, fills a web form, runs a script, books something. It is model-agnostic and bring-your-own-key, so a staff member can point it at their own OpenAI or Anthropic account, or a model running locally, and pay for it themselves. From their side this is the most useful thing they have installed in years. From your side, it is an unmanaged process with the same permissions as the person who installed it.
Most AI policies were written for ChatGPT and Copilot: a browser tab where the risk is what someone pastes in. An agent on the laptop is a different shape. It does not need to be given a document, it can open it. It does not need to be told the customer list exists, it can find it.
Why the security story got loud
The exposure came fast. Within a week of the tool going viral, Censys found the number of instances reachable from the public internet had gone from about 1,000 to 21,639, because people were running the control panel on a server and skipping the tunnel or the password. Around the same time, researchers disclosed CVE-2026-25253, a flaw in the gateway that could let an attacker run commands on the host with the user's own permissions, rated 8.8 on the CVSS scale. Malicious third-party skills turned up in the community repository, some of them going after credentials and crypto wallets.
Then the state response. On 11 March, Bloomberg reported that Chinese government agencies, state-owned enterprises and the largest banks had been told not to install OpenClaw on office devices, and in some cases to report it to a superior if it was already there. That is any organisation's eventual job, done at speed: work out where it is running, and decide on purpose.
What a sensible NZ organisation does
Not a ban. A ban tells your most motivated people that the organisation is slower than they are, and it does not remove the software, it just stops anyone telling you about it. The Privacy Act does not care whether the leak came through a tool you approved.
Start with an allowed-tools list. One page, owned by one person, listing which AI tools are approved, for which kinds of data, on which devices. OpenClaw can be on it with conditions (no client data, no email access, no server install) or off it with a reason. Either is a decision.
Give people the same capability through a door you control. The demand behind an OpenClaw install is legitimate: "let the AI do the task, not just describe it." If the sanctioned option is a chat window, people will keep installing agents. A managed agent, running against your systems with your permissions and a log you can read, gives them the outcome and gives you the audit trail. That is the trade-off: it takes longer to stand up than a personal install, and it is the only version you can defend in front of a client or the Privacy Commissioner.
Write an AI use policy people finish. Ten minutes to read, plain words, three rules that matter: what data may go into which tool, what an agent may act on without a person checking, and who to tell when you have installed something new. A twelve-page policy with a signature box is a document nobody follows. This is what our AI Governance & Policy work produces, because most organisations we meet have either no policy or one nobody has read.
I am not worried that someone on the team installed it. I would be worried if nobody had, because it means they are not curious. What I want to know is who, on which laptop, with access to what, and whether they would have told me if I had not asked. If the honest answer is "probably not", that is the policy problem, and it is fixable in a fortnight.
Tim Hatherley-GreeneChief Operating OfficerThree questions to ask your team this week
"Who here has installed an AI agent on a work device?" Ask it in a way that makes the answer safe: a census, not a hunt. The number will be higher than you expect, and the people who say yes are your pilot group.
"What can it reach?" Files, email, browser sessions, shared drives, a database connection someone left in a config file. Walk through it with them. Most people have not thought about it, because the tool made that easy.
"What would you need from us to do this the sanctioned way?" That answer is your roadmap. It tells you which capability to stand up first, and it turns the person who went around the policy into the person who helps you write the next one.