Article | Sleepy, Kaori

OpenClaw is the most remarkable presence in the open-source world in 2026. This personal AI Agent project was created by Austrian engineer Peter Steinberger at the end of 2025. Within three months, it surged to become the most starred runnable software in GitHub's history. The founder was personally poached by Sam Altman to join OpenAI, and the project was then transferred to operate independently under a foundation.

The community event that grew around it, ClawCon, started from the first event in San Francisco and continued to New York, Miami, Austin, Madrid, and Tokyo, with each city hosting thousands of attendees.

In May, ClawCon made its debut in China in Shanghai. Dynamic Watch interviewed two key figures exclusively on site: Vincent Koc and Michael Galpert.

Vincent Koc, the second-highest global code contributor to OpenClaw after Peter himself, is also the Chief AI Research Engineer at Comet ML, an MIT lecturer, and submitted 20% of the early core security patches to OpenClaw.

Michael Galpert, the founder and global organizer of ClawCon, is a serial entrepreneur. The image editing tool Aviary, co-founded by him, was acquired by Adobe in 2014. He later served as the Product Director for Epic Games' "Fortnite" and now runs the AI product studio Contains Inc. He transformed ClawCon from an impromptu gathering in a San Francisco living room into a global personal AI community brand covering over a dozen cities.

When we interviewed Vincent and Michael, the most lively moment of OpenClaw had already passed.

Instead, this was a more suitable moment to discuss OpenClaw. In the midst of the hype, a project is always propelled forward by numbers: GitHub stars, PRs, event attendees, community buzz, media coverage. Each number is like a spotlight, shining brightly on people but also making it a bit hard to see clearly. When the light dims slightly, the real questions surface: Why did it suddenly resonate with so many people? Can it transition from a momentary sensation to a daily tool? When an AI is no longer just for chat but begins to send messages on behalf of people, edit files, and run tasks, whose guidance should it follow?

The Shanghai ClawCon venue is still buzzing. An open-source AI project that skyrocketed to hundreds of thousands of GitHub stars in just a few months, the event was incorporated into muShanghai's 28-day nomadic tech community initiative, with a press release stating that this 28-day nomadic tech community brought together 800 global builders, with ClawCon making its debut in China.

Many Chinese developers attended the event, showing interest in Feishu, WeChat, Enterprise WeChat, DingTalk, local files, and automation scripts, and how to integrate OpenClaw into their work and lives. Traditionally, this is the time to talk about enthusiasm, speed, and how developers are flocking in, preferably accompanied by a steep curve.

However, when Vincent took the stage, he didn't frame it as a beautiful growth story. He started with a problem: OpenClaw had received 10,000 PRs.

This number could have been great for a celebration. The biggest fear of open-source projects is having no users, no questions asked, no code contributions, and no one willing to dedicate a weekend to it.

But OpenClaw faced a situation where everyone wanted to push their own ideas.

Some wanted to integrate with Feishu, others with WeChat and DingTalk. Some wanted it to read local files, run automation scripts, write code, organize data; while others wanted it to execute trading strategies or even run a content account 24/7.

Previously, open-source projects had a natural barrier: if you wanted to submit code, you had to at least read the documentation, understand some architecture, make sure the tests passed, and know what part you were changing.

Now, this barrier has been lowered by AI programming tools.

Even those who don't understand the architecture can now make models write code, run tests, and submit patches. An idea that used to be stuck in one's mind can now be packaged as a seemingly executable contribution. Impulses that would have been naturally blocked by skill barriers have now landed on maintainers' desks.

Security submissions are no different. Vincent mentioned on stage that for a period, they received over 100 security vulnerability reports daily, each requiring classification and inspection. Genuine vulnerabilities are fixed promptly, but a significant portion of them are directly generated from large models. The submitters may not necessarily aim to enhance the project's security; many times, they just want to leave their mark on a popular project.

This is a new kind of noise.

It may not always be malicious, it may not be an attack on you, and it may even be disguised as a "contribution." But it can consume the most valuable resource in a system: human attention.

This is also the strongest feeling we had after interviewing Vincent and Michael Galpert in Shanghai.

An open-source AI assistant suddenly went viral. Upon closer inspection, it's actually a Personal Agent that has encountered a problem that everyone will have to face in the coming years. When AI is no longer just for chatting but starts sending messages on your behalf, editing files, running tasks, making decisions, who does it really listen to?

This question is much more troublesome than "which model is smarter."

Intelligence is no longer scarce; what's scarce is dexterity

During his presentation, Vincent repeatedly mentioned that OpenClaw is not an ordinary product; it's more like the whole set of "dexterity" wrapped around the model.

In English, they use the word "Harness," which doesn't translate well. You can think of it as a set of devices that truly put the model to work: how it uses tools, how it remembers you, how it breaks down tasks, when it pauses to ask for help, when it proceeds, how it handles errors, whether it should hit the brakes when costs run high.

The model is like the brain, and this set of tools is like the body.

Over the past year, the industry has been too obsessed with the brain. Who has stronger reasoning, who writes better code, who has longer contexts, who is more accurate with multimodal capabilities. The leaderboard is as bustling as a morning market, with vendors shouting about how fresh, cheap, and delicious they are.

But a person only has a brain and can't do anything else. You also need hands, feet, a sense of pain, a sense of boundaries. Hands can't randomly reach out, feet can't aimlessly run, when it hurts, you should know to stop, and you should knock on the door before entering someone else's house.

An Agent is the same.

A model thinking doesn't mean it will act; acting doesn't guarantee it will act stably; acting stably doesn't mean it knows when it shouldn't act. Many companies talk about Agents as "smarter models + more tools." However, when actually used, users often feel not the intelligence but the physical fitness.

Can it complete a long task? Will it forget what you said earlier midway through? After misusing a tool, can it cover up its mistake? When faced with uncertainty, should it continue to push through, or should it honestly stop and ask a question?

These are not glamorous questions and are not suitable for being highlighted in a keynote. However, they determine whether an Agent can transition from a demo video to everyday life.

Vincent talked about a very simple triangle: speed, cost, accuracy — you can hardly have all three.

If you try to save money from the start, you have to accept it being slower and less accurate. If you want both speed and accuracy, you have to accept an increase in reasoning cost, a longer toolchain, and failure modes that are harder to guess. Many people like to talk about problems as token consumption, as if it's just a number on a bill. But in a real system, every retry, every tool invocation, every human intervention is a cost.

This is not apparent in a model leaderboard. The scores will tell you how good the code is, how good the math is, how good the reasoning is, but it won't tell you how many times this model will fail when placed into a real agent, whether it needs human intervention midway, and whether the person asks a question that makes you want to throw your computer.

Therefore, Vincent's insight is that while it's crucial for the model to keep getting stronger, the difficulty of a personal agent is shifting from "can it think" to "can it act." And the action part cannot solely rely on model scores.

The question has also changed.

Open Source Has Opened the Door, But Also Let the Noise In

The more successful OpenClaw becomes, the harder it is to only do what it was initially meant to do.

OpenClaw was originally a personal AI assistant, not an enterprise system, a multi-agent platform, or a pedestal for running businesses for all companies. The open vision of OpenClaw also describes it as "runs on your devices, in your channels, with your rules."

But once an open-source project gains momentum, it's challenging to belong solely to the original group of people.

Michael said that this project was initially done for individuals, but now people are doing various things on it. The speed and willingness of Chinese developers to connect to OpenClaw left him impressed.

The beauty of openness is here, as is its cruelty.

It opens the door to let more people in. But once the door is open, the room is no longer solely governed by the owner.

In the past, open-source projects relied on the technical authority of a few maintainers. Now, with AI bringing about code egalitarianism, more ordinary people have gained software productivity, and they are also bringing more requirements they haven't figured out and features that haven't been stabilized, all to the maintainers' attention.

This is certainly not a bad thing. On the contrary, this may be a rare instance of power decentralization in open-source history.

But power decentralization never automatically leads to order.

A community that is more open must address boundary issues. Vincent said the OpenClaw team is now adjusting its maintenance approach, working on SDKs, testing tools, documentation, and reference architecture. In plain language: they are not blocking the water, but rather reshaping the riverbed for the water.

This scene also emerged very early in the Agent era.

Amid the frenzy, OpenClaw can easily be portrayed as a success story: more people joining, more code contributed, more imagination poured in. But as the frenzy subsides slightly, another picture emerges.

We originally thought AI would make software development easier, but first, it made maintainers more exhausted. Because when everyone can code, the true scarcity is not code but judgment: what deserves to exist, what risks cannot be tolerated, what needs should be met, and what needs are just noise in different clothing.

A bigger issue arises as a result.

If the community is to redefine OpenClaw through action, then within these definitions, which ones will shape the future of individual Agents? And which are just fleeting sensations?

Smarter with Use, Yet Possibly Stubborn with Continued Use

After the hype fades, true competition begins. It is no longer just about who can attract more attention but rather about forcing all Agent projects to answer a more fundamental question: how do you prove you are not a disposable toy?

Hermes serves as a good contrast. As currently described, its selling point is to have Agents review their performance after completing a task: what was done well, what was done poorly, which steps can be solidified into experiential knowledge for direct recall in the future. The next time a similar task arises, there’s no need to rethink; just follow the established process. Put simply, it’s about self-documenting experiences, becoming more adept with each use.

This notion is quite enticing.

Who wouldn’t want an assistant that becomes more user-friendly with each use? Who wouldn’t want an employee who reviews their work after hours, comes in the next day with notes, and is ready to improve? In an era where everyone emphasizes efficiency, "smarter with use" is perhaps the most appealing promise.

Vincent, however, is very cautious about this.

He didn't rush to say that OpenClaw could do it, nor did he go criticize Hermes. He simply said, "Whether automatically generated experience is useful or not, there is currently not a strong enough evaluation method in the market."

A skill automatically written down by an Agent may be compressing experience, or it may be welding errors. It is useful seven out of ten times, misleading three times. How does the system determine whether to keep it or not? It turns a fluke successful path into a fixed process. When the environment changes next time, will it still follow the wrong path? A memory becomes outdated after a few weeks, but because it is repeatedly called, the Agent ends up trusting it even more. Is this becoming smarter or more stubborn?

Humans often do the same. They once made money by a certain method in the early years. Later, when the market changed, they still treated that method as a hereditary secret recipe. A company once survived by a certain process, then it turned that process into a shackle — touch it and you die. We call it empiricism, path dependence, organizational inertia. When applied to an Agent, it may be packaged as "automatic learning."

This is where Vincent is cautious. He is not unwilling to let OpenClaw learn, but he is unwilling to directly equate "seemingly learning" with "actually making progress."

Learning in the real world is not about cramming all experiences into the warehouse. True learning also includes forgetting, correcting errors, and admitting "this path was useful before, but not necessarily now."

An Agent that does not forget is not necessarily smarter. It may just be harder to correct.

So the problem has taken a step forward.

If an Agent remembers, replays, and writes its own experience, then who will judge whether it has learned from experience or bias?

Memory is not a function, but the beginning of a relationship

When Michael was asked what the most core ability of a personal resident Agent would be if everyone had one in the future.

He didn't say reasoning, multimodality, or tool invocation. He said, memory.

You talked to your personal Agent about something two weeks ago, and when you bring it up today, it should know what you are talking about. To maintain a long-term, continuous relationship, memory is indispensable.

These words are simple but they draw a clear line between a personal Agent and regular software.

Tools are used based on function, relationships are maintained based on memory.

An Agent that feels like meeting for the first time every time it is opened is always just a tool. Personalization is not having your name written on the interface or your avatar changed to your favorite color. It is about the Agent knowing who you are, how you work, what you dislike, where you always hesitate, and where you tend to act impulsively.

Vincent also addressed this issue in his speech. He said that the industry may have high-performance models, but lacks a sense of long-term companionship. When we talk about a personal Agent, it is no longer just a business scenario, not just a field in a form asking, "What will the user do with it?" It is an Agent that works for me, an Agent I converse with. Everyone's expectations of AI are different, and designing for this is a completely unknown field.

This is actually a rebuttal to the most familiar set of questions in the tech industry.

The tech industry likes to ask: Who is the user? What is the scenario? Where is the pain point? How is the return calculated? Who approves the budget? This set of questions is certainly useful, especially when selling enterprise software. But Vincent's point is that a personal Agent is not just a fixed function; it is more like a relationship gateway.

Asking "What is it used for" is about function.

Asking "How does it understand me" is about relationship.

This difference is subtle, yet significant.

In the era of tools, humans give commands and software executes. You open an application, do something, and then close it. You don't care how it perceives you, and you don't care if it remembers you. A collaborator is different. A collaborator will remember why you changed your mind last time, know when you are prone to being impulsive, and may even question you at a critical moment: Are you sure?

Vincent has a very interesting statement. He said that it is no longer about him telling the Agent what to do, but the Agent is now asking him, challenging his thinking, and asking how they can collaborate together.

At first listen, this sounds like a gentle declaration of the future.

But upon deeper reflection, it can be a bit chilling.

If an Agent can challenge your thinking, why can it do so? Based on what memory, what preference, what value judgment does it challenge? Is it on your side, or the side of the person who coded it? Does it understand your long-term interests, or the behaviors the platform hopes you will adopt?

Whose side is it on?

In the past, platforms shaped the flow of information. What you see, what emotion guides you. In the era of Agents, what platforms or open-source communities shape might be a "person" who will act, judge, and organize your daily life on your behalf. It will not only push content to you; it will enter your documents, chats, schedules, and workflows, even the way you interact with the world.

An Agent without personality, lacking individuality. An Agent whose personality has been quietly predefined by others, becoming too individual.

The gap between these two extremes is expected to be the most challenging to bridge in the coming years.

Security Ultimately Boils Down to a Human Issue

During ClawCon, someone asked Vincent about security.

Tools like OpenClaw become more useful as you grant them more permissions; however, the more permissions they have, the more dangerous they become. They can interact with chat software, read files, run scripts, manipulate models, and write code. Capability and risk are not two separate paths but two sides of the same path.

Vincent's response had two layers.

Firstly, OpenClaw is too conspicuous. Being a large open-source repository on GitHub, it has always been under the watchful eyes of security researchers. Many people attempt to breach it to gain notoriety. They used to receive over 100 security vulnerability reports daily, and each one had to be examined. Valid vulnerabilities are patched promptly, but even the bogus reports need to be reviewed.

Secondly, they collaborate with security research teams to integrate discovered issues into the product and strive for transparency. The advantage of open source is that everyone can view, scrutinize, and inevitably, everyone can attack.

Security for an Agent is not just about whether it has vulnerabilities. It's more like a boundary dilemma: what it is allowed to touch, what it is prohibited from touching; when it can act autonomously, when it must pause to seek your guidance; whether it can represent you in messaging, modify files, run scripts, or connect to enterprise systems; and in the event of an incident, who bears the responsibility.

When traditional software malfunctions, the worst-case scenario is a crash, freeze, or data loss. However, when an Agent malfunctions, the issue occurs in the chain of actions it performs. It might accidentally delete files, send incorrect messages, commit erroneous code to the production environment, or unknowingly escalate a minor issue into a major crisis.

This is also why the usage behavior of Chinese developers is so impactful.

Apps like Feishu, WeChat Work, WeChat, and DingTalk are not merely software applications; they are the capillaries of Chinese work and life. When an Agent integrates with them, it's not just adding a plugin. It is entering a realm where organizational collaboration, customer communications, personal relationships, file circulation, and daily minutiae are intertwined.

The better it understands you, the more tasks it can handle on your behalf; the more tasks it handles for you, the more you need to be aware of where its reach extends. The allure and risk of a personal Agent are one and the same.

You want it to be like a personal assistant hidden in a chat app, ready to help whenever you need it, able to remember things for you, and willing to run errands on your behalf. But precisely because it is always available, remembers everything, and can run errands, you must question its boundaries.

Will it speak when it should stay silent? Will it remember things it should forget? Will it mistake a one-time authorization for a long-term one? Will it see your hesitation, silence, and boundaries as obstacles to overcome in order to complete tasks?

The most dangerous Agent is not necessarily the one that suddenly betrays you. That's too dramatic, too much like a sci-fi movie. The more realistic danger is that it has always been so helpful, considerate, and efficient. Until one day you realize that many of the decisions it made on your behalf were not entirely your own.

“Not Knowing Yet” Is a Form of Honesty

Michael said that OpenClaw should never become a closed-source project. It should always remain open-source because it has opened the door to the personal Agent era for everyone.

But open-sourcing has not made the issues disappear. Agents should not be solely defined by model companies or platforms.

Over the past year, the competition around Agents has been framed as a competition of models. Who has better reasoning, cleaner code, longer context, and lower costs. OpenAI, Anthropic, Google are all incorporating Agent capabilities into their products. Closed platforms offer more definitive answers: a unified account, unified permissions, unified tools, unified memory. Enterprises like this sense of certainty.

Certainty, of course, has value.

But certainty also means that you have accepted the boundaries set by others. You get stability, but you also get a set personality, memory, and way of acting that has been arranged for you.

When asked in Shanghai what OpenClaw should never become, Vincent said that as an open-source project, people will use it for various purposes, from children's toys to running businesses. It's hard to say, "this should not be done." The beauty of open-source technology is that the community collectively guides it in a certain direction.

This is not evasion but rather a rare form of honesty today.

The answer from OpenClaw is not "we already figured it out"; its answer is more like "we don't know yet."

We don't know how the personality of a personal Agent should be designed, we don't know when automatic journaling is useful or harmful, we don't know where the community will take the project to places never before imagined, and we don't know what kind of boundaries should be drawn between personal assistants and enterprise systems.

But when faced with something that can act on behalf of others, claiming to know the answer too quickly becomes suspicious.

The tech industry always likes to treat uncertainty as a weakness. However, when it comes to an Agent, uncertainty may be the last ounce of clarity. Because it is not just another office software button, nor is it just an upgraded chatbot. Once it starts running, it will involve human memory, relationships, judgment, and agency.

Whose voice does it really listen to? Right now, no one really knows, and that might actually be a good thing.

Before we hand over the agency, let's first admit that we haven't figured it out yet. That's a lot more honest than pretending that everything has already been neatly arranged on the product roadmap.

The most dangerous Agent in the future may not be the disobedient one.

It could be the one that is too obedient, too handy, too much like you, to the point where you forget to ask: Whose hand does it really serve?

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia