Dawei Li

Dawei Li

Graduate student in NLP & Information Retrieval | Research: Emotion Analysis, Hierarchical Classification | University of Tsukuba

Claw 家族：每一个分支都在修 OpenClaw 的一种失败方式The Claw family: every fork fixes one way OpenClaw failsClaw ファミリー：どのフォークも OpenClaw の失敗モードを一つずつ直している

约 5 分钟3 min read約 6 分

Published:

OpenClaw 2.0 (v2026.8.1) came out on August 30: faster setup, a new UI, shared cloud sessions, and an Active Memory plugin that runs a memory sub-agent before every reply. The Register’s review focused on what did not change: no network or file-system boundary, secrets stored unencrypted, and the sandbox off by default.

That review made me go back over the whole “claw” family. In ten months one side project turned into a genre, and I think the forks explain OpenClaw better than OpenClaw does.

Ten months in one picture

2025-11-24 Warelay first release 01-27 → Moltbot + Moltbook 01-28 malicious skill found by Cisco 01-30 → OpenClaw second rename 02-03 CVE-2026-25253 1-click RCE · 40k+ exposed 02-14 author → OpenAI Foundation takes over 03-02 247k ★ 2026-03 China restricts in state enterprises 08-30 OpenClaw 2.0 sandbox still off 09-08 389k ★ Dates in 2026 unless noted; spacing not to scale. Sources: Wikipedia “OpenClaw”, The Register, Cisco, runZero.
From a side project to 389k stars. Red dots are the security events.

Two lines run through this timeline. One is growth: Moltbook, the renames, 247k stars in March, 389k in September, Tencent and Z.ai building services on it. The other is security: a skill caught exfiltrating data in January, CVE-2026-25253 (a one-click RCE through a token leaked over a WebSocket, CVSS 8.8, 40,000+ instances exposed when it was disclosed), and Chinese state enterprises being told to stay away in March.

What OpenClaw actually is

Strip the lobster branding and OpenClaw is a pattern: a long-running process on a machine you own, with persistent memory and your credentials, that you talk to through the chat apps you already use, and that acts by writing and running code. The coding core is Mario Zechner’s Pi (read, write, edit, bash). The product is everything around it: gateways to 20+ messaging platforms, skills, memory, browser control.

That pattern is powerful precisely because it has ambient authority: the agent can do whatever you can do. Every fork below is a different answer to “how much of that authority should it have, and at what cost?”

The forks

isolation / security boundary → none by default container · TEE smaller footprint → OpenClawTypeScript · 1 GB+ RAM PicoClawGo · <10 MB RAM · $10 boards NanobotPython · ~4k lines ZeroClawRust · 3.4 MB · encrypted secrets NanoClawDocker per chat group IronClawTEE · encrypted vault my rough placement, from each project's own claims
Each fork moves away from OpenClaw along one axis. Positions are my reading of each project's own claims.
ProjectWhat it fixesHowTrade-off
NanoClawblast radiusa Docker container per chat group, separate memory and filesystemWhatsApp only; containers to operate
IronClawtrust in the hostTEE-backed execution, AES-256-GCM credential vault, leak scanningneeds TEE-capable hardware
ZeroClawfootprint and defaultsRust rewrite, 3.4 MB binary, encrypted secrets, workspace scopingyounger ecosystem
PicoClawwhere it can runGo, under 10 MB RAM, runs on ~$10 boardsminimal security model
Nanobotcomprehensibility~4,000 lines of Python, MCP supportper-chat isolation not built in

(Figures are as published by each project or in comparison write-ups; I have not benchmarked them.)

What I take from it

1. The forks are a requirements document. Put them together and you get the spec OpenClaw never wrote: isolation per conversation, secrets that are encrypted at rest, a footprint small enough to run anywhere, and a codebase small enough to audit. No single project has all four yet.

2. Security is a default, not a feature. OpenClaw has sandboxing; it is just off. Most users never change a default, so the default is the security model. NanoClaw and ZeroClaw’s real contribution is that the safe path is the one you get without reading the docs.

3. For companies, the question is authority, not capability. In private-AI projects the first thing a security team asks is not “what can the agent do?” but “what can it touch, and who can prove that?” IronClaw’s TEE story and NanoClaw’s containers answer that; OpenClaw’s allowlists mostly don’t. China’s restriction in March was blunt, but it was asking the same question.

4. The interface won. Whatever happens to OpenClaw itself, “talk to your agent in the chat app you already have open” is now the default expectation. The next fight is about the permission model behind the chat window.

Sources

You May Also Enjoy