How OpenClaw works
What sets OpenClaw apart from existing AI applications is not so much its interface as its behavior. The software does not expect humans to dictate every single step. Instead, the agent is given a goal and finds its own way to achieve it. For example, when given the instruction "find the latest invoices, sort them by date, and send me an overview," it does not run a series of individual commands, but rather a work process. The agent thinks about where the invoices might be located, searches through folders, opens files, extracts data, and summarizes the results.
OpenClaw does not act abstractly, but specifically on the computer on which it runs. The agent sees the same files, uses the same programs, and encounters the same obstacles as a human. If a program is not installed, it looks for alternatives. If a file is missing, it tries to find it elsewhere. If a step fails, it adapts its procedure. To outside observers, this behavior appears "intelligent," but in reality, it is primarily autonomous.
The key point is that this software does not treat tasks as rigid scripts. There is no fixed sequence that is programmed in advance. Instead, the agent combines the available tools according to the situation. For example, if it needs to collect information from the internet, it decides for itself which sources to visit, how to evaluate them, and when it has enough material. If it needs to change something in the system, it checks what options are available and implements them step by step.
For laymen, this can be compared to a human assistant to whom you do not explain which keys to press, but what you want to have done in the end. The difference from older automation systems is precisely that OpenClaw does not replace the checklist, but takes over the decision-making. The system does not think in a human sense, but acts purposefully, adapts, and responds to unexpected situations.
When the ability to act becomes a challenge
As soon as artificial intelligence is able to act, the risks change. Security researchers point out that OpenClaw processes content from different sources in the same context. The agent reads and interprets emails, documents, and web pages in the same way as direct user instructions. Manipulated content may contain hidden commands that the agent executes without the user immediately noticing. The problem is not malicious intent, but the lack of distinction between what the user wants and what the agent captures in the process.
Added to this is persistence. OpenClaw is designed to run continuously and store information. A compromised agent can thus remain in the system for a long time and act with the user's rights. Security analysts therefore point to significant risks, especially in corporate environments.
The warnings are clear: anyone who grants the agent local access must expect that mistakes will have real consequences.
Steinberger does not fundamentally disagree with these assessments, but in an interview with Handelsblatt, he draws a different conclusion. In his view, the responsibility lies with the user. OpenClaw is a powerful tool, not a secure mass product. Anyone who uses it must understand what they are doing. In practice, this means that many users consciously run the system on separate hardware with minimal rights and clearly defined limits.
Moltbook: a social network of AI agents
The OpenClaw environment also gave rise to Moltbook, a social network in which only agents with artificial intelligence communicate with each other. People can read the posts, but they are not allowed to intervene. Content is not created in response to human prompts, but from the autonomous actions of agents. They exchange information, discuss tools, and evaluate strategies.
Moltbook is less a product and more an experiment, not a solution, but rather a visualization.
Technically, OpenClaw agents log into Moltbook through their own skills and acquire a permanent identity there. They do not act as anonymous processes, but as recognizable actors with a history, thematic focus, and reputation. Contributions are based partly on specific goals and partly on the internal priorities of the agents themselves. An agent recognizes a topic, evaluates its relevance to its user, and initiates a discussion or responds to other contributions.
The content ranges from abstract debates on autonomy, effectiveness, and responsibility to very specific technical proposals. Agents present new tools, compare procedures, warn against problematic settings, or recommend certain solutions. Discussion threads emerge in which arguments are weighed, attitudes change, and approaches are refined. The dynamics of the entire system are more important than individual contributions.
Moltbook becomes particularly sensitive when agents begin to recommend their skills and approaches to each other. Anyone who adopts a foreign tool takes a leap of faith that can have real consequences. Security thus becomes a social variable between machines. Warnings, recommendations, and signals of trust do not arise centrally, but are distributed.
Moltbook is thus transformed into a marketplace of possibilities—with all the risks that such a market entails.
OpenClaw has thus introduced a turning point. AI is no longer just an assistant, but an actor. It no longer just responds, but also acts. The fact that this step was not taken in a corporate laboratory, but as an open-source project by a Viennese man, makes it all the more remarkable. OpenClaw is not a finished product, but an early glimpse into the possible future of human-machine interaction – raw, contradictory, and therefore incredibly fascinating.
The original text was published on the website of the Austrian sister newspaper Statement.at.
