TL;DR: OpenClaw is the fastest-growing self-hosted personal AI assistant of 2026 — MIT-licensed, ~385K GitHub stars, and reachable from WhatsApp, Telegram, Slack, Signal, iMessage, and 20+ other channels. It’s genuinely useful and genuinely dangerous: an autonomous agent with shell access, exposed through messaging apps, with 245 recorded advisories. Self-host it only if you’re willing to harden it.

	OpenClaw	Khoj	Odysseus
Best for	An always-on assistant you message from anywhere	Searchable second brain over your notes	All-in-one chat + agents + email bundle
License	MIT	AGPL-3.0	AGPL-3.0
Local model support	Any OpenAI-compatible endpoint incl. Ollama	Ollama, llama.cpp, APIs	Ollama, llama.cpp, vLLM, APIs
The catch	Huge attack surface; hardening is on you	No messaging channels, no autonomy	Heavier bundle, younger project

Honest take: OpenClaw is the most capable personal AI you can self-host right now, and also the one I’d least recommend installing casually. Run it on an isolated box with locked-down DM pairing, or don’t run it at all.

What OpenClaw actually is

OpenClaw is not another chat UI. It’s a persistent agent daemon — a “personal AI” that lives on hardware you own, keeps long-term memory, runs on a schedule, and takes actions: executing shell commands, reading and writing files, browsing the web, sending emails, managing calendars. You talk to it through whatever messaging app you already use. The project lists 25+ channels, including WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Matrix, IRC, LINE, Mattermost, Nextcloud Talk, and plain WebChat.

The architecture centers on the Gateway, a local control plane that owns channel connections, sessions, and tool access. Your prompts, memory, and credentials stay on your machine; the only mandatory outbound traffic is to whatever model endpoint you configure. Point it at a cloud API and your conversations go there. Point it at Ollama on localhost and the whole loop — including the model — stays on your hardware.

The project’s history explains the momentum. Founder Peter Steinberger built it as a personal tool, it went viral in late 2025, and after he joined OpenAI in early 2026 the project moved to community governance under the OpenClaw Foundation. Star growth since has been absurd — roughly 355K by early July per community trackers, ~385K on the repo as of late July 2026. Even Amazon noticed: Lightsail added a one-click OpenClaw blueprint in March 2026. Development pace held up after the governance change; the 2026.7.x releases (tested here: 2026.7.2, July 2026) focused on reliability — crash-recoverable SQLite snapshots, a quarantine store that survives primary-database damage, durable channel delivery, and session rewind/branching.

License check: MIT, clean, no rider clauses. Commercial self-hosting, modification, redistribution — all fine. That’s rarer than it should be in this category; Khoj and Odysseus are both AGPL-3.0.

Install and first run

Setup is a one-liner plus an onboarding wizard:

curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon

The wizard walks through model provider, first channel, and daemon install. On a Debian 12 test box this took about ten minutes to a working Telegram bot. Windows users get a PowerShell equivalent (iwr -useb https://openclaw.ai/install.ps1 | iex), and npm/pnpm/bun installs work if you’d rather pin versions.

For a fully local setup, run Ollama on the same host and select the OpenAI-compatible endpoint option during onboarding, pointing it at http://localhost:11434/v1. Two traps here, both familiar if you’ve wired other agents to Ollama (see our Goose + Ollama guide, which hits the same walls):

1. The model must support tool calling. OpenClaw is an agent; a model that can’t emit tool calls will chat pleasantly and do nothing. Qwen3-class instruct models work; most 7B roleplay finetunes don’t.
2. Raise the context window. Ollama’s 4096-token default silently truncates OpenClaw’s system prompt and tool definitions. Set num_ctx to 32K via a Modelfile or you’ll get an assistant with amnesia and broken tools.

Verify the model is actually loaded locally and on your GPU:

$ ollama ps
NAME            ID            SIZE     PROCESSOR    UNTIL
qwen3:32b       e5a19b78d2a3  22 GB    100% GPU     4 minutes from now

Hardware-wise, the OpenClaw daemon itself is light — the community consensus of a $40–80/month Hetzner or OVH VPS for a small multi-user setup matches what we saw; the Gateway and channels are not the bottleneck. The local model is. A used RTX 3090 or a Mac Mini M4 Pro with 48GB unified memory comfortably runs the 30B-class tool-calling models OpenClaw needs to be useful. For GPU sizing beyond that, runaihome.com’s local AI hardware guides cover the tiers.

The security section (read this before installing)

This is where the review earns its keep, because OpenClaw’s threat model is unlike anything else we’ve covered. An LLM chat UI leaks chats if you misconfigure it. OpenClaw executes shell commands and is designed to be reachable from public messaging networks. Misconfigure that and a stranger is piping instructions to an agent with filesystem access.

The numbers say people are misconfiguring it. Security researchers counted 63,026 identifiable OpenClaw instances on the public internet as of March 4, 2026, and the GitHub Advisory Database has recorded 245 OpenClaw-related vulnerabilities — a mix of core issues and third-party plugin/extension problems. Vendors have started calling it an “AI agent security crisis,” which is marketing-flavored but not wrong. We watched the same movie with Ollama last year — 175K exposed instances, covered in our Ollama security guide — except an exposed Ollama serves tokens, while an exposed OpenClaw runs commands.

To its credit, the project is unusually honest about this. The security docs order priorities sensibly: identity first (decide who can talk to the bot — DM pairing policies, allowlists), scope next (decide where it can act — sandboxing for non-main sessions, per-tool restrictions), model last (assume the model can be manipulated and limit the blast radius). The SECURITY.md explicitly treats prompt injection as out of scope — the maintainers assume a sufficiently motivated attacker who can get text in front of your agent can steer it, so containment, not prevention, is the design goal. That’s the correct engineering posture and a red flag for casual users in the same breath.

The problem we actually hit: after wiring up Telegram, our test instance accepted DMs from a second, never-paired Telegram account — it happily answered and would have run tool calls. Root cause: we’d breezed through onboarding and left the DM policy open for the channel. The fix is configuration, not code — set dmPolicy to pairing-only for every channel, run untrusted sessions sandboxed, and strip tool access from anything public-facing. The docs tell you to review the exposure checklist before remote deployment. Actually do it.

Two more items for your checklist. Credentials — channel tokens, API keys — live in ~/.openclaw/openclaw.json and are readable by anything running as your user, including the agent’s own tools; some published attack chains use exactly that. And skim the advisory database for the extensions you enable, because that’s where most of the 245 CVEs live. Treat plugins like you’d treat browser extensions on a work machine.

Where it beats the alternatives — and where it doesn’t

Against Khoj: different species. Khoj is a self-hosted second brain — indexing and chatting over your notes and documents. It doesn’t reach out to messaging platforms, doesn’t take autonomous actions, and is correspondingly hard to hurt yourself with. If “chat with my files, privately” is the goal, Khoj is the safer, simpler pick.

Against Odysseus: closer. Odysseus bundles chat, agents, email, and calendar into one AGPL workspace with a web UI as the front door. OpenClaw’s bet is that the front door should be your existing messaging apps, and daily use validates it — sending your agent a voice note from WhatsApp while walking is a different product than opening a web dashboard. OpenClaw is also further ahead on channel breadth and release cadence. Odysseus is easier to reason about security-wise, since it isn’t listening on twenty messaging networks.

The honest ceiling: OpenClaw’s usefulness scales with the model behind it, and fully-local setups feel it. A 30B-class local model handles routine tasks — summaries, scheduling, file operations, web lookups — reliably. Long multi-step autonomous work is still visibly better on frontier cloud models, which reintroduces the privacy tradeoff the self-hosted pitch was supposed to eliminate. Pick your poison per task; OpenClaw lets you configure multiple providers and route between them.

When NOT to use OpenClaw

• You can’t commit to maintenance. This is internet-facing agent software with a fast release cadence and an active advisory feed. Unpatched OpenClaw is worse than no OpenClaw.
• You’d run it on your main machine. Shell access plus prompt-injection-out-of-scope means it belongs on an isolated VPS, container host, or dedicated box — not the laptop with your SSH keys.
• You just want private document chat. Khoj or AnythingLLM give you that with a fraction of the attack surface.
• Compliance-sensitive environments. An autonomous agent bridged to consumer messaging platforms is an auditor’s nightmare; 63K exposed instances say deployment discipline is the exception, not the rule.

Verdict

OpenClaw earns its stars: MIT license, real local-first architecture, unmatched channel coverage, and a shipping cadence most funded startups can’t match. It’s the first self-hosted assistant that feels like an actual assistant rather than a chatbot with a to-do list. But it demands operator-grade respect. Run it isolated, pair every channel, sandbox untrusted sessions, patch weekly. If that sentence sounds like fun, OpenClaw is the best thing in this category in 2026. If it sounds like work, it is — pick something with less agency.

FAQ

Does OpenClaw work fully offline with local models? Yes. Point it at any OpenAI-compatible endpoint, including Ollama at http://localhost:11434/v1. Use a tool-calling model (Qwen3-class or better) and raise num_ctx to 32K, or the agent loop breaks silently. Messaging channels like WhatsApp still require internet; WebChat works on LAN.

Is OpenClaw safe to expose to the internet? Only deliberately. Set dmPolicy to pairing-only on every channel, sandbox non-main sessions, restrict tool access, and keep the Gateway off public interfaces. Researchers found 63K+ exposed instances and 245 recorded advisories — the defaults won’t save you; configuration will.

What does it cost to run? Software is free (MIT). A $40–80/month VPS covers the daemon for a small group with cloud-model APIs billed separately, or run everything locally on a 24GB+ GPU box with Ollama for zero marginal cost.

Sources

• OpenClaw GitHub repository — license, install, channels, v2026.7.x release notes
• OpenClaw Gateway security docs — dmPolicy, pairing, sandboxing model
• Reco: The AI Agent Security Crisis Unfolding Right Now — exposed-instance count, advisory tally
• knownsec/openclaw-security — community hardening guide
• AWS: Amazon Lightsail now offers OpenClaw — March 2026 blueprint announcement

Recommended Gear

• RTX 3090 — 24GB VRAM, the used-market sweet spot for running 30B-class tool-calling models locally
• Mac Mini M4 Pro — quiet always-on host; 48GB unified memory covers both the OpenClaw daemon and the model