QUICK ANSWER:
OpenClaw is a free, open-source AI agent that runs on your own machine and takes real actions from WhatsApp, Slack and Telegram. The software costs nothing, but you pay for the model calls it makes and for the time it takes to secure it properly. How well it runs comes down to how it is configured rather than to the software itself, so the setup steps matter as much as the feature list.
Most AI tools stop at giving you words. You ask, it answers, and you go and do the work yourself. OpenClaw is the tool that broke that pattern for a lot of people, because you message it the way you would message a staff member and it goes off and does the thing.
It is also a tool that rewards a careful setup. Get the configuration right and it behaves like a well-briefed staff member. This guide covers both halves, because the second one is what decides which experience you get.
What OpenClaw actually is
OpenClaw does not live in a browser tab. It sits in the messaging app your team already has open, and when you ask it to do something it goes and does it, across your files, your email and your browser.
OpenClaw is self-hosted software you install on a machine you control. You connect it to a model provider using your own API key, connect it to the channels you want to reach it through, and it runs from there. It reads and writes files, drives a browser, sends messages and chains multi-step jobs together using a large library of installable skills.
The distinction that matters commercially is that it is an agent, not an assistant. An assistant drafts the email. An agent sends it. That single difference is where the productivity gain comes from, and it is why the setup section below is worth ten minutes.
Where it came from, and why the name kept changing
Austrian developer Peter Steinberger, best known for founding the PDF tooling company PSPDFKit, first published the project as Warelay. It was renamed Clawdbot, then Moltbot following a trademark dispute, then OpenClaw a few days after that.
The reason to care about this history is practical. Three names in ten weeks means a lot of the tutorials, Docker images and skill packages you will find in a search are written for a build that no longer exists, and some of them point at repositories nobody at the project controls any more. When you install, take the release from the official repository and nowhere else.
What it costs to run
The licence fee is zero. The real bill lands in three places, and the first one surprises people.
Model tokens. Every step the agent takes is a model call, and agents are far chattier than chat. A single instruction that reads a long document, decides on an action, checks a result and reports back can be a dozen calls. This is the cost that scales with use, and it is the one to model before you commit. Pairing OpenClaw with a cheaper model for routine steps is the standard way to keep it sane, which is why it is so often run against DeepSeek or a local model served through Ollama rather than a frontier model for everything.
Hosting. If it runs on a machine you already own, this is close to nothing. If you put it on an always-on VPS so it can act while nobody is at a desk, budget for a small instance plus the discipline of patching it.
Your time. This is the cost nobody writes down and the one that dominates in the first month. Someone has to own updates, key rotation and reviewing what the agent has been doing. Give it a named owner and it stays sharp indefinitely.
Setting it up well, and why it pays off
These are the published figures, and they are simply the reason the checklist in the next section looks the way it does. Read them as a setup brief rather than a warning: an hour spent here is what separates a tool that runs quietly for years from one that needs attention.
The main one to design around is network exposure. A remote code execution issue was disclosed against the Gateway, where the WebSocket endpoint did not validate the origin of skill-execution messages, and it was patched within days. What made it matter was how many installs were reachable in the first place: independent scans have found tens of thousands of instances answering on the open internet, with thousands of those confirmed vulnerable. Those were not targeted victims. They were default installs left on a machine with a port open, which is a configuration choice rather than a flaw in the software.
Two other things are worth knowing so you can plan around them. Integration credentials sit as plaintext JSON in the config file in your home directory, readable by any process running as that user, so every API key you connect is as safe as the machine you put it on. And the skill registry works like any open extension marketplace: campaigns distributing malicious skills have been found more than once, at one point affecting roughly one in five entries, so skills need the same vetting you would give a browser extension.
The project has moved quickly on all of it. Successive hardening releases changed the transcript, sandbox, MCP, browser, channel and exec-approval paths to fail closed rather than fail open, tightened Gateway lifecycle supervision, and stopped channel allowlists granting owner-level access. The software today is meaningfully hardened. The defaults still assume you know what you are doing, which is exactly what the checklist below is for.
The setup checklist that gets you there
If you take one thing from this guide, take this list. Each item is drawn from what experienced operators do as standard, and the whole list is about an hour of work, once.
- Never expose the Gateway to the internet. Reach it over a VPN or a tunnel with authentication in front. A VPN takes minutes to set up and settles the question permanently.
- Run it as its own user on its own machine. Not on the laptop that also has your accounting logins and your browser profile.
- Give it scoped, revocable credentials. A dedicated mailbox, a limited API key, a service account with only the permissions the job needs. Pick keys you would be comfortable rotating at any time, and rotation becomes routine rather than an event.
- Pin your version and read the release notes. Track the extended-stable channel rather than chasing every release.
- Vet every skill before installing it. Treat the skill registry the way you would treat a browser extension store, because the threat model is identical and the registry has already been compromised more than once.
- Keep approval gates on for anything that sends, pays, deletes or publishes. Read-only autonomy is a productivity tool. Write autonomy is a risk decision, and it should be made deliberately rather than left on by default.
- Log what it does and read the log weekly. A quick weekly skim is how you spot the workflows worth expanding.
What Australian businesses need to think about
There is a compliance layer here that most international coverage skips entirely.
Running OpenClaw locally does not mean your data stays local. Unless you have pointed it at a model running on your own hardware, every document it reads is sent to a model provider, and if that provider is offshore you have made a cross-border disclosure under Australian Privacy Principle 8. The accountability does not transfer with the data. If the overseas recipient handles it in a way that would breach the APPs, you are treated as having breached them, and pointing at the vendor privacy policy is not a defence.
There is a second obligation to plan for. The Privacy Act 1988 carries transparency requirements for automated decision-making: where personal information feeds a decision that significantly affects someone, that has to be disclosed in your privacy policy. An agent that screens applicants, prioritises customers or makes eligibility calls sits squarely in scope. Check the OAIC’s current guidance for where the commencement timetable sits, and write down what your agent decides now, while the list is still short.
The practical answer for most small businesses is a split: let the agent handle internal admin and research, and keep customer personal information either out of it entirely or on a local model. That is a design decision, not a setting, and it is easier to make at the start than to retrofit.
How OpenClaw compares
| Tool | Cost | Data control | Setup effort | Best for |
|---|---|---|---|---|
| OpenClaw | Free plus model usage | Full, if paired with a local model | High, and ongoing | Technical operators who want maximum reach |
| Hermes Agent | Free plus model usage | Full, local state database | High, easier install | Long-running workflows that improve over time |
| Managed vendor agents | Per seat, per month | Vendor holds the data | Low | Teams with no appetite for maintenance |
If you have someone technical who will own it, OpenClaw gives you more capability per dollar than anything you can buy. If you would rather not, a managed product costs more and takes the maintenance off your plate entirely. Be honest about which of those two businesses you are. Our guide to Hermes Agent covers the closest open-source alternative if you want to compare before installing.
Pros and Cons
Pros
- No licence cost, and no per-seat pricing as the team grows.
- Reaches you in the messaging apps you already use.
- Model-agnostic, so you can move providers when prices change.
- Can run fully offline against a local model for sensitive work.
- Very large skill ecosystem and an active release cadence.
Worth knowing before you start
- Security is yours to configure. The defaults assume a technical operator.
- Credentials sit in plaintext on the host, so the machine choice matters.
- Skills need vetting, the same as any open extension marketplace.
- Token costs are unpredictable until you have run it for a month.
- Needs a named owner inside the business or it degrades.
The verdict
OpenClaw gives an Australian small business more capability per dollar than anything you can buy, and it rewards a considered setup. Deployed by someone who reads release notes, keeps it off the public internet and gates the destructive actions, it does genuine work at a fraction of the cost of the managed alternatives. That is a very good trade for an hour of configuration.
Our recommendation is to start it read-only. Let it search, summarise, draft and file for a fortnight. Look at the logs. Then decide, one action at a time, what it is allowed to send.
Get it set up properly the first time
Most of the value in an agent like this shows up in the second month, once it is wired into the workflows that actually eat your week. Most of the risk shows up in the first, during setup. If you want a hand deciding whether OpenClaw fits your business and getting it deployed behind proper controls, our AI consulting team runs an AI Jumpstart Audit that maps your processes to the right tool before anything gets installed, and we run hands-on AI training for teams that would rather own it internally.
It is free to download, so the only real cost of trying it is the hour you spend setting it up properly. You can find it at OpenClaw.
This guide describes how the pricing is structured rather than quoting figures that date: tiers, ratios and what each level unlocks all hold when rates change. For the current numbers, check the vendor’s own pricing page.
Frequently asked questions
Is OpenClaw free?
The software is free and open source. You pay for the model calls it makes through your own API key, for hosting if you run it on a server, and for the internal time to maintain it. For a small business running it daily, the model bill is usually the largest of the three.
Is OpenClaw safe to use in a business?
Yes, once it is configured properly, and that is the part to get right. A disclosed Gateway vulnerability allowed unauthenticated code execution on installs that were reachable from the open internet, and scans have found tens of thousands of them answering publicly. Keep the Gateway off the public internet, run it under its own user account, give it scoped credentials and require approval for any action that sends, pays or deletes.
Who created OpenClaw?
Austrian developer Peter Steinberger, founder of PSPDFKit. He first published it as Warelay, and it was renamed Clawdbot, then Moltbot, then OpenClaw over the following months. Older tutorials often still use the earlier names.
Does OpenClaw keep my data in Australia?
Only if you pair it with a model running on your own hardware. If it calls an offshore model provider, that is a cross-border disclosure under Australian Privacy Principle 8, and you remain accountable for how the overseas recipient handles the information.
What is the difference between OpenClaw and a chatbot?
A chatbot returns text and you carry out the work. OpenClaw carries out the work itself, including sending, filing and updating across connected tools. That is why it needs approval gates on destructive actions in a way a chatbot never does.
