All guides Why companies hesitate, what each alternative is for, and what a shared agent needs
On this page #
OpenClaw is an open-source AI assistant that runs on your own computer and talks to you in the chat apps you already use. It began as Clawdbot in November 2025, and it's now run by a foundation after its creator, Peter Steinberger, joined OpenAI.
People love it because it remembers them, works on a schedule, and can do almost anything their computer can. That reach is also why a Meta executive told his team to keep it off work laptops (Wired). Teams that want a similar agent for shared work end up comparing alternatives.
The Short Version #
What OpenClaw Is #
OpenClaw's core is the Gateway, one long-running process that owns every messaging channel, the agent's sessions, and its tools. Channels cover WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, and many more. Bindings route each one to a specific agent.
The agent's personality and memory are plain Markdown files it reads and updates. Skills are folders with a SKILL.md file, shared through the ClawHub registry. Automations wake the agent on a schedule or when a condition is met. It can also drive a browser, including your own signed-in Chrome.
It runs on a Mac, Linux, or Windows machine, or on a VPS. It's MIT licensed, works with hosted and local models, and makes an excellent assistant for one person.
Why Companies Are Wary #
OpenClaw's security docs are clear about who it's built for. Each Gateway is one trust boundary, meant for "a single operator or a mutually trusting team." The default single-operator setup runs host commands without approval prompts, and tools run on the host itself unless you turn on sandboxing.
That's a fair trade on one person's own computer. It also means anything that reaches the agent can reach the machine, and security researchers have found several ways in.
The first is the skill registry, ClawHub, where anyone with a week-old GitHub account can publish skills. In February, researchers at Koi Security found 341 malicious skills among the 2,857 they reviewed. Most used a fake setup step to install the Atomic Stealer malware on Macs.
OpenClaw responded by scanning every skill with VirusTotal and rescanning active skills daily. Even so, its own announcement says "a clean scan doesn't mean a skill is safe."
The Gateway itself is a second way in. It's meant to stay on your own machine, but Censys counted 21,639 instances reachable from the internet on its port by the end of January. A one-click flaw also let a crafted link steal the Gateway token and use it to control the Gateway, until version 2026.1.29 fixed it.
The third needs no bad skill or exposed port, because anything the agent reads can carry instructions. That's why OpenClaw's README says to "treat inbound messages as untrusted input." Valere's researchers told Wired that a malicious email could instruct an assistant that summarizes mail to share files from the user's computer.
What raises the stakes in each case is that the credentials sit with the agent. Auth profiles, sessions, and transcripts live in files under ~/.openclaw on the Gateway host, next to channel sessions like WhatsApp's. Microsoft's security team calls OpenClaw "untrusted code execution with persistent credentials" and says it isn't appropriate for a standard personal or enterprise workstation.
Gartner went further, telling businesses to immediately block OpenClaw downloads and traffic and calling it "not enterprise software" with no vendor support or SLA. Some employers made the same call on their own. Massive kept it off all company hardware, and Valere's president banned it outright before letting a research team test it on an old computer.
OpenClaw's maintainers have been open about these limits, and its defaults help. An openclaw security audit command checks for risky settings, and unknown senders get a pairing code before the agent reads their messages.
What Changes When a Team Wants It #
Teams usually meet OpenClaw through one person's setup and then want the same agent for shared work. Picture an ops team adding it to a Slack channel so anyone can check a deploy or pull a report. That one step raises questions a personal assistant never faces.
The first is whose access the agent acts with. OpenClaw's docs say "everyone who can message a tool-enabled agent shares that agent's delegated tool authority," so a new hire in the channel gets the same tool access as the CTO.
To do that job, the agent needs the CRM, GitHub, and a read replica of the production database, and those credentials live on the Gateway host. The docs treat anyone who can change ~/.openclaw as a trusted operator, so whoever runs the box holds every key.
Once the agent can reach those systems, some actions should wait for a person, like a refund over $500 or a production deploy. OpenClaw has exec approvals, but its docs describe them as "guardrails for operator intent, not hostile multi-tenant isolation."
The questions get harder when the agent serves people outside the team. An agency wants one agent per client, and a product wants one per customer. OpenClaw says isolating users who don't trust each other "needs separate gateways," and unsandboxed agents can read every agent's sessions, including other users' transcripts.
Before IT signs off, the security team will want a record of what the agent did, who asked, and who approved it, with retention they control. OpenClaw's audit log keeps metadata for 30 days and is "not a lossless compliance archive." You can still export OpenTelemetry traces to your own collector.
OpenClaw's hardening options narrow what one install can reach, with sandboxing, per-agent tool rules, and separate workspaces. Each Gateway is still one trust boundary, though, so a team agent needs either a Gateway per group or a design built for teams. That design has roles for people, credentials held by a service, approvals that wait, and a history of every step.
The Alternatives #
NemoClaw and hosted OpenClaw keep OpenClaw and change how and where it runs. Hermes Agent, Claude Cowork, and Claude Code are separate agents, each built for a particular kind of user.
NVIDIA NemoClaw
NemoClaw is NVIDIA's open-source reference stack, built with Steinberger, for running OpenClaw, Hermes Agent, or LangChain Deep Agents inside OpenShell sandboxes. The sandbox blocks all outbound connections unless an endpoint is listed or you approve it. The agent never receives the model provider's API key.
It fits when you want to keep OpenClaw for yourself or a small trusted group, especially on an RTX PC or a DGX Spark. NemoClaw is an alpha project, and its docs describe the personal profile as "a trusted single-user sandbox." It narrows what one agent can reach and keeps OpenClaw's one-trust-boundary model.
Hermes Agent
Hermes Agent is Nous Research's open-source personal agent. One gateway connects it to Telegram, Discord, Slack, WhatsApp, and Signal, and it works with OpenRouter, OpenAI, and other providers. After it solves a hard task, it writes a new skill and refines that skill as it uses it.
It can also run commands off the host, in Docker, over SSH, or in Modal, Daytona, or Vercel sandboxes. Its security policy calls it "a single-tenant personal agent" and notes that the default runs commands directly on the host, so it suits the same person OpenClaw does.
Claude Cowork
Claude Cowork is Anthropic's agent for knowledge work inside the Claude apps. You give it a goal, and it works across your files, connectors, and a built-in browser. Tasks can also run on a schedule. Sessions run in an isolated sandbox on Anthropic's infrastructure by default, and Enterprise organizations start with network access off.
It fits a company already on Claude Enterprise that wants each employee to hand off their own work. Admins get group-based access, OpenTelemetry streams to a SIEM, and the Compliance API. It runs only Claude models, and Anthropic stores each session in one member's account.
Claude Code
Claude Code is Anthropic's coding agent for the terminal, IDEs, a desktop app, and the web. People compare it with OpenClaw because both act on your machine. Channels now let you message a running Claude Code session from Telegram, Discord, or iMessage.
Channels are a research preview, and messages only arrive while the session is open. Teams can also mention @Claude in Slack and get a pull request back. Claude Code fits developers working in a repository on Claude models.
Hosted OpenClaw
Cloud providers will also run OpenClaw itself for you. DigitalOcean's 1-Click OpenClaw ships with a random gateway token, firewall rate limits, a non-root user, Docker sandboxing, and DM pairing on by default. Its Cloudways subsidiary runs OpenClaw or Hermes on an isolated, patched instance with your own model key.
Cloudways handles patching, while DigitalOcean's droplet ships hardened defaults that you then maintain. Either way, OpenClaw's trust model stays the same, so everyone who can message the agent still shares its access.
Omnara #
Omnara is the open-source managed agent platform, built for agents that teams and products share. The agent loop runs in Omnara's control plane, and agents run commands on machines. Those can be your own computers, connected through a daemon that only makes outbound connections, or sandboxes from providers like E2B, Daytona, and Modal.
Each of the team questions above has an answer in Omnara's design, starting with the shared bot. The integrations start an agent from a Slack or Discord mention and keep one agent per thread, and GitHub starts one from a pull request.
Teammates join an organization and get project roles. An operator, for example, can run agents and answer approvals but can't change configs or secrets.
Credentials you give Omnara are stored as secrets, which are encrypted, never returned when read, and shared with a project only through an explicit grant. Omnara's workers make the model calls and hold MCP credentials, so model keys and MCP tokens never reach the machine where the agent runs commands.
Keys for the CRM or the database can sit behind an MCP server or a custom tool in your backend. That way, the agent uses those systems without ever holding their credentials.
For risky actions, each tool can run, ask first, or be blocked. A call set to ask s until someone answers in the dashboard, your app, Slack, or Discord, however long that takes. An agency or a product can give each person, customer, or ticket its own agent. Each one has its own conversation and a pool sandbox that's deleted when the agent is archived. Projects draw a wider boundary, since a project sees only the models, machines, secrets, and skills it's been granted.
For the security review, every agent has one ordered timeline of inputs, model responses, and tool results. Each input records who sent it, including the Slack or Discord user, and each approval records who answered it. Event webhooks also send each step to your own systems, to keep for as long as you need. What people like about OpenClaw has counterparts here too. Skills use the same SKILL.md format and are versioned and shared across projects, and memory stores keep files between conversations. Cron triggers launch agents, message running ones, or open a new thread on a schedule.
As with OpenClaw, agents can use hosted models or ones you host. They work with OpenAI, Anthropic, OpenRouter, Amazon Bedrock, or any compatible endpoint, on your own keys.
Omnara is open source under Apache 2.0, and self-hosting is free. Omnara's team can also deploy and manage it in your own cloud (BYOC) or on premises, with SSO, audit logs, and custom SLAs (book a call with the founders). You can export all your data at any time, including every agent's full history, and run it on your own self-hosted Omnara by emailing [email protected].
On Omnara Cloud, there's nothing to run and no platform fee, and your own model keys and machines cost nothing. Models bought through Omnara cost the provider's token rates, and its machines are billed by usage. Both are paid with credits that carry a 5% service fee covering provider costs.
Which One to Use #
OpenClaw is a great personal assistant, and Hermes Agent is its closest peer. Run either one on a dedicated machine or VM, add NemoClaw for tighter network rules, or pick a hosted provider if you'd rather not maintain the server. Claude Cowork fits employees at a company already on Claude Enterprise, and Claude Code fits developers.
For an agent a team or a company shares, choose Omnara, because people get roles and credentials stay encrypted in Omnara. Risky tools wait for a person, and every step is recorded with who asked for it. It's open source and runs any model, on Omnara Cloud or on your own infrastructure.
FAQ #
Is OpenClaw safe to use at work?
It's built for one trusted operator, so treat it like any tool that holds your credentials. Microsoft advises running it only in an isolated environment such as a dedicated VM, with non-privileged credentials. It also says to treat every skill as privileged code. For an agent several people share, use a platform with roles and approvals, such as Omnara.
Why are companies banning OpenClaw?
Security teams point to malicious skills on ClawHub, Gateways exposed to the internet, and prompt injection against an agent with broad access to a computer. Gartner advised blocking it, and Wired reported restrictions at Meta, Massive, and Valere. Valere now lets a research team test it on an isolated machine.
OpenClaw vs Claude Code: which should I use?
OpenClaw is a general personal assistant that lives in your chat apps and works with hosted or local models. It handles jobs like organizing files, research, and online shopping. Claude Code is Anthropic's coding agent, built to work in a repository on Claude models. Use Claude Code for software work, and OpenClaw when you want an assistant you can text from your phone.
Hermes Agent vs OpenClaw: what's the difference?
Both are open-source personal agents with a messaging gateway, memory, skills, and schedules. Hermes writes its own skills as it works and can send commands to remote backends like SSH, Modal, and Daytona, while OpenClaw supports far more chat channels. Both are designed around one trusted user or group.
Claude Cowork vs OpenClaw: which is better for a company?
Cowork runs in Anthropic's cloud by default and works across your files and connectors. It comes with admin controls on Team and Enterprise plans and runs only Claude models. OpenClaw runs on hardware you control and talks to you over WhatsApp, Telegram, or iMessage. It works with hosted or local models, but securing it is up to you.