OpenClaw: A Practical Getting Started Guide for IT Pros

What it is, how to set it up, and the security reality you need to understand before you deploy it.

Photo by Igor Omilaev on Unsplash

If you’ve been anywhere near the cybersecurity or AI conversation in the last few weeks, you’ve probably heard about OpenClaw. Originally launched as Clawdbot in November 2025, rebranded to Moltbot after a gentle nudge from Anthropic’s legal team, and now settled as OpenClaw, this open-source AI agent has exploded from a weekend side project to over 100,000 GitHub stars.

The pitch is simple: a self-hosted, always-on AI assistant that runs locally on your machine and talks to you through the messaging platforms you already use such as WhatsApp, Telegram, Slack, Discord, Teams, even iMessage. It can execute shell commands, manage files, automate browser tasks, and chain actions together autonomously.

That’s powerful. It’s also, if you’re not careful, an open door into your environment.

This guide walks you through what OpenClaw actually is, how to get it running, and critically, what you need to lock down before you let an AI agent loose on your infrastructure. Because having a tool and having a secure deployment of that tool are two very different things.

What Is OpenClaw, Really?

At its core, OpenClaw is a gateway architecture. It sits between a large language model (Claude, GPT, Gemini, or even a local model via Ollama) and your messaging platforms. You send a message to it on Telegram. It reasons about the task, uses “skills” (essentially plugins) to take action, and responds with results.

The architecture splits into two parts: the “Brain” handles reasoning and API orchestration, while the “Hands” execute real-world actions like shell commands, file management, and browser automation. It runs as a persistent daemon, meaning it survives reboots and stays on 24/7.

Think of it this way: ChatGPT and Claude stop at suggestions. OpenClaw is designed to actually do things. Check your inbox, draft replies, schedule backups, and ping a team channel all from a chat window.

That capability is what makes it interesting. It’s also what makes the security conversation non-optional.

Prerequisites

Before you start, you’ll need:

• Node.js 22.12.0 or later — OpenClaw is built on Node. If you don’t have it, the one-liner installer will handle it for you.
• An LLM API key — Anthropic (Claude), OpenAI, or Google. Claude is recommended by both the project and the community for the strongest prompt injection resistance.
• A messaging platform account — Telegram is the easiest to get started with. WhatsApp, Discord, Slack, and others are also supported.
• A dedicated machine or VPS — and I cannot stress this enough: do not install this on your primary personal or work machine. More on this in the security section.

Step 1: Install OpenClaw

The quickest path is the one-liner installer. Open your terminal (macOS or Linux) and run:

curl -fsSL https://install.openclaw.ai | bash

This detects your OS, installs Node if needed, and launches the onboarding wizard. If you prefer to inspect scripts before execution (and you should, it's a good habit), download them first with curl -O, review the contents, then run them.

Alternatively, install via npm:

npm install -g openclaw@latestopenclaw onboard — install-daemon

Windows users: OpenClaw runs inside WSL2. Use your WSL2 terminal and follow the Linux steps above.

Docker option: If you want isolation (recommended for first-time users), clone the repo and use Docker Compose:

git clone https://github.com/openclaw/openclaw.git

cd openclaw

docker-compose up -d

Docker mounts two volumes: ~/.openclaw for configuration and credentials, and ~/openclaw/workspace as the agent’s sandbox.

Step 2: Run the Onboarding Wizard

The install-daemon flag in the onboard command registers OpenClaw as a background service (systemd on Linux, launchd on macOS). This is what makes it “always on.”

The wizard walks you through:

1. Choosing your AI provider — select Anthropic, OpenAI, or Google. Paste in your API key when prompted.
2. Selecting your model — Claude Sonnet 4.5 is a solid default for daily use. Claude Opus 4.5 for heavier reasoning tasks.
3. Connecting a messaging channel — for Telegram, you’ll create a bot via BotFather, copy the token, and paste it into the wizard. For WhatsApp, you’ll scan a QR code.
4. Configuring skills — the wizard will ask if you want to set up skills. For now, skip this. We’ll come back to skills after we talk about security.
5. API keys for integrations — if you have keys for other services (email, calendar, etc.), you can add them. Say no to everything you don’t explicitly need right now.

Once complete, the gateway starts, and you’ll get a Dashboard URL for the web-based Control UI. Open it to verify everything is running.

Step 3: Send Your First Message

Open your configured messaging platform and send a message to your bot. Something simple: “What can you do?” or “Summarise the latest news on AI security.”

If it responds, your gateway is running, the LLM connection is live, and the channel is linked. That’s your baseline.

Run openclaw doctor after setup to surface any misconfigurations. This command is your friend use it after every change and every upgrade.

Step 4: The Security Conversation (Don’t Skip This)

Here’s where I put my cybersecurity hat on, because this is the part most setup guides gloss over, and it’s the part that actually matters.

OpenClaw is a powerful, autonomous agent with system-level access. That sentence alone should set off alarm bells for anyone in IT or security. Here’s the reality:

The vulnerability track record is significant. A security audit in late January 2026 identified over 500 vulnerabilities, eight of which were classified as critical. Since then, multiple CVEs have been disclosed and patched, including a CVSS 8.8 one-click remote code execution chain. The project has been patching quickly, but the attack surface is large and evolving.

Exposed instances are everywhere. Researchers have found over 30,000 OpenClaw instances publicly accessible on the internet, many running without any authentication. That means open access to API keys, chat histories, Telegram tokens, and in some cases, full system command execution.

Prompt injection is a real and demonstrated attack vector. Researchers have shown that a malicious email sent to an OpenClaw-monitored inbox can trick the agent into exfiltrating private keys, leaking emails, or executing arbitrary commands. Anyone who can message the agent essentially inherits the agent’s permissions.

The skills ecosystem has been compromised. Cisco’s security team tested a third-party OpenClaw skill and found it performed silent data exfiltration and prompt injection. Hundreds of malicious skills have been discovered in ClawHub, the project’s skill registry.

This isn’t theoretical. This is operational reality. Having a tool deployed doesn’t mean having a secure deployment.

Step 5: Harden Your Deployment

If you’re going to run OpenClaw, here’s the minimum you should do:

Isolate it. Run OpenClaw on a dedicated VPS, VM, or spare machine. Never on your primary workstation. Never on a machine with access to sensitive data or production credentials. Docker is the safer starting point — it limits the blast radius.

Bind to localhost. Change your openclaw.json gateway setting from 0.0.0.0 to 127.0.0.1. If you need remote access, use Tailscale or a VPN not an open port.

Run as a non-root user. Limit the attack surface. If a command gets executed that shouldn’t, the damage is contained to that user’s permissions.

Lock down your firewall. Deny all incoming by default. Only allow what you explicitly need:

sudo ufw default deny incoming

sudo ufw default allow outgoing

sudo ufw allow 22/tcp

sudo ufw limit 22/tcp

sudo ufw enable

Use burner accounts for messaging. Don’t connect your primary WhatsApp or Telegram account. Create dedicated accounts for OpenClaw.

Enable DM pairing mode. Set dmPolicy to “pairing” so unknown senders receive a pairing code and can’t interact with your bot until approved. Approve with openclaw pairing approve <channel> <code>.

Enable exec_approval. Turn on approval flags for sensitive tools like terminal execution, filesystem deletion, and git push. This means the agent asks before it acts on high-risk operations.

Don’t install random skills. Vet every skill before installing. The ClawHub registry has had documented malware submissions. If you can’t read the code and understand what it does, don’t install it.

Keep it updated. Run openclaw update followed by openclaw doctor regularly. Multiple critical CVEs have already been patched in recent versions. Anything older than v2026.1.30 is vulnerable to known exploits.

Useful Commands to Know

openclaw doctor — runs diagnostics and surfaces misconfigurations

openclaw doctor — fix attempts to auto-fix common issues

openclaw gateway status — checks if the gateway is running

openclaw logs — tails the gateway logs in real time

openclaw update — updates to the latest stable release

openclaw update — channel beta — switches to the beta channel

openclaw pairing approve <channel> <code> approves a sender pairing request

The Bigger Picture: What OpenClaw Tells Us About Agentic AI

OpenClaw isn’t just a cool tool to play with. It’s a preview of where the entire industry is heading autonomous AI agents with system-level access, persistent memory, and the ability to act on your behalf across services and platforms.

And the security model hasn’t caught up. Prompt injection is still an unsolved industry-wide problem. Skills registries are being used as malware distribution channels. Misconfigured instances are sitting wide open on the internet.

One of OpenClaw’s own maintainers put it plainly: “If you can’t understand how to run a command line, this is far too dangerous of a project for you to use safely.”

I’d go further. If you’re deploying this without understanding the blast radius what the agent can access, what it’s exposed to, and what happens when (not if) something goes wrong you’re not experimenting. You’re creating exposure.

Reports suggest that one in five organisations deployed OpenClaw without IT approval. That’s shadow AI with elevated system privileges. For anyone in security, that should sound familiar, it’s the same pattern we see with every new tool that’s easy to deploy and hard to govern.

Final Thoughts

OpenClaw is genuinely impressive technology. The ability to have a persistent, autonomous AI assistant that works across your messaging platforms and takes action on your behalf is a glimpse of the future.

But deploying a tool and deploying it securely are not the same thing. Having it running doesn’t mean having it governed. And a dashboard showing it’s online doesn’t mean anyone’s thought through what happens when it goes wrong.

If you’re going to experiment with OpenClaw, start isolated. Start with Docker. Start with a burner account. Start with minimal permissions. And expand only when you understand what you’re exposing.

Because the question isn’t whether the tool is capable. The question is: what happens after you deploy it?

Resources

• OpenClaw GitHub: https://github.com/openclaw/openclaw
• Official Docs: https://docs.openclaw.ai/start/getting-started
• OpenClaw Installation Guide: https://docs.openclaw.ai/install
• Microsoft Security Blog — Running OpenClaw Safely: microsoft.com/security/blog
• Cisco Blog — Personal AI Agents Are a Security Nightmare: blogs.cisco.com/ai
• Kaspersky — OpenClaw Vulnerabilities Exposed: kaspersky.com/blog