OpenClaw et al., AI Capability Is Solved. Security Hasn't Started.

This post is public. Share it with anyone who builds with AI.Full disclosure: I am a digital builder, but I am also a healthy skeptic of technology. While I don't believe yet in an AI apocalypse, there are definitely going to be roiling changes in society, industries and economies. Winners, losers, perhaps even more wealth disparity. I have tons of IT experience, in everything from systems engineering, cyber, networking, system administration, too much Bash and Python, (I even made the best 2024 presidential election prediction with Python) dev ops, AWS serverless stacks, full-stack programming in web apps and phone apps, and now AI and ML. It may surprise you, because all I ever blab about is geopolitics, metabolic health, economics, finance, etc., but it's true. Through the years, I have never been a fan boi of any tech and generally feel companies like Apple are anti-consumer. And I used to work for Apple. It's so bad that I wrote 294 lines of code to fix Apple's broken basic coding essentials a few days ago. So yeah, the guy you know who is gunning for The New York Times is also single-handedly making up for Apple's felonies. What am I going to do? Retrain all my clients on Ubuntu or Mint Linux desktop or fix Apple's broken dev tools? Well, I pulled it off. You can check it out here: https://github.com/tatsuikeda/install-modern-macos-toolsI've been building AI enabled apps for over a year. Most of you know me for the "thesis intel" geopolitical analysis and "trustless journalism" with more footnotes than Leonardo DiCrapio's line items on his superyacht repair bills, but my systems and ML engineering keeps the lights on till I make it to higher ground on Substack, (Won't you please consider a paid subscription? "Can I have some more, sir?") I have several professions actually, which helps my multi-modal and multi-domain analysis skills in geopolitics. I invent and train people and organizations on bespoke AI workflows. (Yes, feel free to reach out if you are interested.) I built one of the first project management workflow coding systems called "Autopilot" within Cursor AI, analyzed multi-billion dollar pharma deals a lá McKinsey, and got a friend a $300K job by generating a 30-page strategic whitepaper about an industry neither of us knew, this is just a sampling of my AI hijinxes last year. All before the frameworks in this article existed. The same infrastructure I built empowers my Iran war coverage: hundreds of OSINT channels scraped on cron, augmented intel analysis, articles monitored and scheduled across three platforms while I sleep. This isn't a review from a press box. It's a scouting report from the digital trenches. That's why my Substack byline says "Analysis from 2030, today." Four years from now, who knows what year I will be in?Eighteen months ago, AI was a chatbot. You typed, it responded, you typed again. ELIZA 1966 vibes. That's over. In 2026, AI agents execute multi-step workflows across real systems: writing code, managing databases, coordinating with other agents, and operating autonomously for hours without human input. We went from "Conversational AI" to "Executive AI." (Those are b******t "thought leader" terms for chatbots and agents.)This is not just a tech shift. It's a geopolitical one. The United States committed $500 billion to Project Stargate because whoever controls the AI compute layer controls the next century of economic and military dominance. I wrote a 6-part series on the AI Dollar and a standalone investigation into OpenAI's circular financing documenting how NVIDIA's chip monopoly, Taiwan's fab dependency, and OpenAI's self-paying economy are national security architecture, not business stories. The tools in this article are the next layer down: the harnesses and runtimes that determine whether AI agents actually work in production, or whether they become the most expensive security vulnerabilities in corporate history.And if you want a case study in how broken the incentives are, look at Anthropic (the company that makes Claude, the AI I use daily). In February, Defense Secretary Pete Hegseth gave CEO Dario Amodei a deadline to remove all AI safety guardrails for military use, including the ban on autonomous weapons and mass surveillance.[19] Amodei refused. Trump ordered all federal agencies to stop using Anthropic products. The Pentagon designated them a "supply chain risk." Anthropic filed two federal lawsuits.[20]Principled stand? Sure. But in late March, Anthropic held a secret, closed-door gathering with 15+ Christian leaders to discuss building a "moral chatbot," while OSINT channels were circulating reports that Claude was already being deployed in Pentagon targeting workflows under "Project Glasswing."[21] As one viral post put it: "Anthropic deploys Claude to kill Iranians, then asks Christian leaders for help building a moral chatbot."[22] Lordy, is this the modern Crusades, just digitized? And while Anthropic was fighting the Pentagon in court over ethics, it was simultaneously banning its own paying customers from using third-party tools like OpenClaw through their Pro and Max subscriptions, shutting down accounts, and putting small developers out of business over OAuth token arbitrage.[23] The company drew a red line on autonomous weapons but had no problem pulling the rug from under the developer community that made its ecosystem valuable.This is the AI industry in 2026. The ethics are performative. The security is reactive. And the paying customers are always the last priority.Here is my argument: the capability problem is mostly solved. We have agents that can code, research, coordinate, and learn since 2025. What we don't have is a security model that scales with autonomy. Every system I evaluated either gives agents too much access (and has already shipped dozens of critical CVEs with hundreds more zero days to come, cuz Mythos), inherits vulnerabilities from the runtimes it orchestrates, or adds so many security layers that the latency kills real-time performance.The first team to build a genuinely secure multi-agent runtime will own the infrastructure layer the way AWS owned cloud compute. Everything else is incremental. The orchestration layer is commoditizing. The security layer hasn't even started.I spent several weeks evaluating six systems at the frontier. Three run agents. Three that grade them. Here's where each one breaks and which ones are worth your time. And this is a quick rundown! I won't give you a breathless 8,000 word lapdog take. Just what you need to know. People pay me to build or inform them in the least amount of time possible. That's my job, as a lead IT guy, sometimes IT god, when I put the hammer down.Deep technical analysis like this takes weeks of research. $8/month for geopolitics, AI, and the systems reshaping the world.Two Buckets of AI HarnessesBefore diving into six profiles, you need one framework:Bucket 1: Tools That Run Agents (the harnesses and orchestrators)These give language models the ability to persist across sessions, use tools, coordinate with other agents, and operate on real systems. Think of them as the operating system for AI workers.Bucket 2: Tools That Grade Agents (the evaluation frameworks)These measure whether your agents actually work. Accuracy, safety, bias, robustness, cost efficiency. Without them, you're flying blind.If you're building agents, you need Bucket 1. If you're choosing which model to build on, you need Bucket 2. If you're doing both, welcome to the frontier, my fren.Bucket 1: Three HarnessesOpenClaw: Personal Agent Runtime, Very RiskyWhat it solves: You want one AI agent that works across your phone, laptop, and messaging apps, executing real tasks on your actual devices.How it works: OpenClaw is a decentralized, single-user runtime that splits into two pieces: a Gateway (the control plane for auth, state, and policy) and Nodes (execution surfaces on your devices). It connects to over 20 messaging protocols, from WhatsApp and Discord to Nostr and Matrix. Every inbound message is treated as untrusted. Unknown senders must be cryptographically approved before the agent interacts with them.OpenClaw evolved through Warelay, Clawdbot, and Moltbot before exploding in early 2026, crossing 295,000 GitHub stars to become the most-starred software project on the platform.[1][3]Where it breaks: Multi-agent scaling. Single-agent operations are fast and efficient. The moment you spin up a swarm, everything falls apart. This is also true of most startups, but at least startups can blame the market. Benchmark data shows P95 latency exceeding 5 seconds under load. Error amplification hits 17x compared to centralized systems because sub-agents propagate mistakes without rigid guardrails.[4][5] Token costs inflate 5x from redundant prompt passing. A single agent runs on 1 to 2 GB of RAM. A swarm of ten needs 8+ GB and multiple cores to avoid kernel panics.The security problem: OpenClaw integrates deeply with your host OS. 138 tracked CVEs as of 2026. To put that in perspective, the average enterprise security product ships with 12. OpenClaw ships with 138. The open-source community calls this "transparency." Nation-state actors call it a shopping list. (So does Claude Code, by the way. It's not true it's constrained to a single project folder. It can access, manipulate, and transmit any data on your computer, as long as you make the fatal mistake of instructing it to do so.) As of 2026, the open-source codebase has 138+ tracked CVEs.[25] (I will cover one of these in real life later this week. The scheduled persistence task was named `AndronichAdultMegaLodong`.) So rounding error these are not. 138 documented ways to compromise a system that has filesystem access, executes shell commands, and manages your API credentials. CVE-2026-25253 was just one of them, a critical vulnerability patched earlier this year that demonstrated the risks of giving autonomous systems delegated tool authority on unsandboxed machines.[6] This is the thesis of this entire article in miniature: the capability is impressive, the security is an afterthought.The platform risk: OpenClaw's explosive growth ran headfirst into Anthropic's business model. Thousands of users were routing API-equivalent workloads through $20/month Pro and $100 or $200/month Max subscriptions via OAuth token arbitrage. I foresaw this and wasn't dumb enough to fall for this obvious trap and clawback from Anthropic. No, no, no thank you. On April 4, Anthropic killed it: all third-party agentic tools cut off from subscription authentication.[23] Accounts were auto-banned. Businesses that built on this access woke up to find their infrastructure gone overnight. Anthropic's updated terms are explicit: "Using OAuth tokens obtained through Claude Free, Pro, or Max accounts in any other product, tool, or service is not permitted."[24] If you're building on OpenClaw with a Claude subscription, you're now paying API rates or you're shut down. This isn't a security story. It's a platform dependency story. Build your agent on someone else's authentication layer, and you're one policy change from oblivion. To be fair, Anthropic gave fair warning. They did nothing wrong. Sucks to be the little guy.Who it's for: Individual power users who want a personal AI that spans their entire digital life. Not for teams. Not for enterprise. Not for multi-agent workflows.My honest take: I built my own version of this said OpenClaw with Python, cron, and custom Bash scripts over a year ago, started delving into Rust because why not. My machines capture intelligence data from OSINT sources 24/7 and run breaking news proto-analysis while I sleep. (I often have a better "thesis".) I was writing my own hooks and skills before Anthropic shipped theirs in Claude. (Claude is often leveraged in OpenClaw.) Is OpenClaw powerful? Absolutely. But most people will crash and burn like a teenager dropped into a 900-horsepower Ferrari. The tooling outruns the fundamentals. People want the latest orchestrator but haven't mastered their terminal. It's the photographer, not the camera. Master the basics first, then reach for the orchestrator.OpenClaw is one of the latest shiny new glass AI toys. But if you drop it, it shatters into shards that you now have to avoid. They already cut you. "Now it cuts like a knife! But it feels so right! Nyah nya, na na nah-na-na"Peter, the creator of OpenClaw, couldn't resist the paycheck so Sam Altman hired him. That's all you need to know. Anthropic's MO is to build two parsecs slower with the benefit of safety. I think Anthropic's play wins.NVIDIA Hermes: A Flawed Self-Improving AgentWhat it solves: You want an agent that gets better the more it works, automatically compiling successful workflows into reusable skills.How it works: Hermes embeds a continuous learning cycle directly into its architecture. When it successfully navigates a complex multi-step pipeline, it autonomously compiles that execution pattern into a reusable skill (compliant with the agentskills.io standard).[7] It uses an FTS5 database for cross-session memory recall and Honcho dialectic modeling to build evolving profiles of its environment and operators.The deployment architecture is aggressively decoupled from local machines. Hermes runs across bare metal, SSH, Docker, Singularity containers, and serverless platforms like Daytona and Modal. It can hibernate during inactivity and wake instantly on a webhook, eliminating idle compute costs.The April 2026 releases moved fast: v0.8.0 introduced background task auto-notifications and self-optimized guidance loops. v0.9.0 expanded to Android via Termux, added iMessage and WeChat, and shipped a local web dashboard for fleet management.[8]Where it breaks: The self-improvement loop is a double-edged sword. Hermes compiles skills from experience, but if it learns from a flawed execution, it bakes that flaw into its permanent skill library. There's no built-in mechanism for skill deprecation or quality regression testing on compiled procedures. Over time, an unmonitored Hermes instance can accumulate what I'd call "Skill Debt": the agent equivalent of technical debt, except the agent doesn't know it's carrying it.The security trade-off: The seven-layer security model is thorough (container isolation for code execution, command approval gates, credential rotation, MCP OAuth 2.1) but adds latency. Each security check is a tax on responsiveness. Hermes is the most security-conscious of the three harnesses, and that conscientiousness costs performance. This is the trade-off nobody has solved: secure or fast, pick one.Who it's for: Developers and teams who want agents that learn on the job. The closest thing to a genuine AI employee, with the caveat that employees also need performance reviews.It's not really been vetted enough. Just another AI toy that Jenson Huang is putting out there to ride on OpenClaw's coattails. Nice opening salvo, Jenson. Might want to change out that leather jacket. You are not a WWII fighter pilot.Paperclip AI: Zero-Human Company, Crazy DangerousWhat it solves: You want to model an entire organization using AI agents, with departments, budgets, reporting lines, and governance.How it works: Paperclip doesn't think in chains or workflows. It thinks in org charts.[10][11] I've worked with plenty of companies that were effectively zero-human already. At least Paperclip is honest about it. Built on Node.js with a React dashboard, it uses a corporate metaphor: agents don't call functions, they hire other agents. Each hire gets a role, a goal, and a monthly token budget. Every task traces back through a lineage of parents to the company's primary mission.The template library tells you how far this goes. GStack: a five-agent engineering team with 27 workflow skills. Donchitos Game Studio: 48 agents managing a full development pipeline. Trail of Bits Security: 28 agents running domain-specific security processes. You can import these via CLI and have a functioning AI company in minutes.Human operators serve as the "Board," approving hires and setting spending limits. The dashboard tracks token usage by agent, task, project, and goal. Governance features include heartbeat scheduling (agents wake on a configurable cycle), maximizer mode (accomplish goal regardless of cost, with circuit breakers), and stuck-run detection (alert after 5 consecutive heartbeats without progress).Where it breaks, and why it matters most: Paperclip is a routing layer, not a runtime. It orchestrates agents but doesn't sandbox them. If an integrated OpenClaw agent gets hit with prompt injection, that malicious payload flows straight back into Paperclip's ticket system. Recent versions added VirusTotal scanning for inbound data, but Cisco has explicitly warned this doesn't replace proper low-level sandboxing.[13]This is the most dangerous architecture in this review. Paperclip's governance layer (budgets, approvals, reporting) creates the illusion of control. But control over what an agent spends is not control over what an agent executes. You can cap the token budget of an agent that has already exfiltrated your database. The corporate metaphor is elegant. The security model is inherited. And inherited security, in every system I've ever evaluated, is no security at all.The corporate metaphor is also a constraint. Not every problem maps to an org chart. Highly dynamic, reactive workloads (real-time monitoring, event-driven responses) fit awkwardly into a structure designed around scheduled heartbeats and hierarchical reporting.Who it's for: Teams and companies exploring autonomous operations at scale. The governance layer makes it the most enterprise-ready of the three. But you need to bring your own security.I thought Cursor YOLO mode was living dangerously last year. Why not put all my lifetime of data from my laptop at risk? It'll be more fun since I don't have any backups. Yee-haw.Bucket 2: Three Evaluation FrameworksHow do you know your agents actually work? These frameworks answer that question, each with a different philosophy.EleutherAI LM Evaluation Harness: Community StandardThe open-source default for zero-shot and few-shot evaluations.[17][18] The v0.4.x release moved from rigid Python scripts to YAML-based task configuration with Jinja2 templates, making it trivially extensible. Integrates with Hugging Face accelerate, vLLM, and SGLang for efficient local execution.The limitation: No native multi-node distributed evaluation. Scaling beyond a single server requires custom integrations. This is a local-first tool for researchers, not an enterprise benchmarking platform. Security is minimal by default; you're expected to run it in trusted environments.Seems boring but someone has to be grown-up.Stanford HELM: Academic Gold StandardThe most rigorous transparency-focused benchmarking suite, maintained by Stanford's Center for Research on Foundation Models. HELM measures across accuracy, efficiency, bias, toxicity, and robustness,[14] publishing results on public leaderboards (HELM Capabilities, HELM Safety, VHELM for vision models, HEIM for image generation).The insight that justifies HELM's existence: HELM exposed a critical flaw in how we benchmark medical AI. Their MedCalc-Bench tests showed models scoring 35% on clinical calculators with direct prompting, but jumping to 100% when given Python execution tools.[15] The benchmark was testing arithmetic memorization, not clinical reasoning. If a medical AI scores 100% on a benchmark that measures the wrong thing, the benchmark is more dangerous than the AI. This kind of methodological honesty is why HELM matters.Academic grown-ups are more boring than open-source grown-ups. I prefer coding drop-outs to grad students. Zuckerberg agrees, though his social calendar in 2015 suggests his taste in company ran somewhat younger than the average PhD candidate.[^26]OpenCompass: Enterprise BeastThe extreme end of evaluation scalability. Pre-supports 70+ datasets with nearly 400,000 evaluation questions.[16] Built for HPC environments: 64-GPU clusters, InfiniBand interconnects, NVIDIA NeMo containers. Integrates with LMDeploy and vLLM for optimized tensor parallelism.OpenCompass evaluates frontier models at billion-parameter scale (Kimi K2, Qwen3.6-Plus, MiniCPM-o 4.5). Its CascadeEvaluator chains multiple specialized evaluators sequentially for complex multi-step assessments. All code execution runs in ephemeral Docker sandboxes with strict CPU limits, memory constraints, and total network blackouts.Who needs this: Organizations evaluating foundation models for production deployment. If you're not running evaluations across GPU clusters, this is overkill.Beware of any company that starts with "Open." OpenAI isn't open, nor intelligent. OpenCompass is probably Chinese. The naming convention at this point is a threat assessment, not a feature description. I need to research further, or you can help me out, why do I have to do all the heavy lifting, all the time?Trade-Off Matrix | OpenClaw | Hermes | Paperclip | EleutherAI | HELM | OpenCompass -----------------+-------------------+--------------+--------------+---------------------+------------------+------------- Category | Runtime | Runtime | Orchestrator | Eval framework | Eval framework | Eval | | | | | | framework Scale | Single user | Single to | Company | Single node | API-based | HPC cluster | | team | | | | Security | OS-level (risky) | 7-layer | Governance | Trust-based | Sandboxed | Docker | | defense | only | | | isolation Self-improving | No | Yes (skill | No | No | No | No | | compilation) | | | | Multi-agent | Poor (17x errors) | Good | Excellent | N/A | N/A | N/A | | (multi-instance) | (org chart) | | | Cost model | Token + compute | Token + | Token + | Free/local | Free/API credits | HPC | | serverless | budget caps | | | infrastructure Biggest weakness | Swarm scaling | Skill debt | Inherited | No distributed eval | Static datasets | Massive | | | runtime | | | infra | | | vulns | | | requirementWhat This MeansEvery system in this review can make an agent do things. None of them can guarantee an agent only does the things you intended.OpenClaw gives agents OS-level access and has already shipped a critical CVE. Paperclip trusts whatever runtime it orchestrates, which means one prompt injection in a sub-agent compromises the entire organizational graph. Hermes is the most security-conscious of the three, but its seven-layer model adds latency that makes it impractical for real-time applications.The evaluation frameworks are better positioned (HELM and OpenCompass both sandbox execution), but they're measuring models, not deployed agent systems. Nobody is systematically evaluating the security posture of agent orchestrators in production. The tools that grade agents are grading capabilities. Nobody is grading attack surfaces.This is the gap that will define the next 12 months. The capability race is effectively over. Every major framework can run agents that code, research, coordinate, and learn. The agents work. The question is whether they work exclusively for you, or whether they can be turned against you by a well-crafted prompt from an untrusted input channel.The orchestration layer is commoditizing cottage industries. The security layer hasn't even started. Whoever solves this owns the next platform. Want to fix this with me? Send Bitcoin.This analysis is based on architecture documentation, benchmark telemetry, and CVE disclosures as of April 2026. These tools are evolving weekly. Scratch that. Daily. Hourly. By the second.$8/month. Geopolitics, AI, and systems analysis. No ads. No sponsors.Notes[1] "The Rise of a New King on GitHub: How was OpenClaw Developed?", 36Kr, 2026.[2] "What Is OpenClaw? A Practical Guide to the Agent Harness Behind the Hype", Zylon Blog, 2026.[3] "OpenClaw Statistics 2026: Key Numbers, Data & Facts", Gradually AI, 2026.[4] "Scaling OpenClaw: How Multiple Agents and Sub-Agents Affect Speed, Hardware, and Your Wallet", r/OpenClawCentral, 2026.[5] "Where Does OpenClaw AI Agents Actually Fail?", Cobus Greyling, Medium, 2026.[6] "OpenClaw Security Risks: What Security Teams Need to Know About Agentic AI", Barracuda, April 2026.[7] "Hermes Agent Documentation", NousResearch, 2026.[8] Releases, NousResearch/hermes-agent, GitHub, 2026.[9] "OpenClaw vs. Hermes Agent: The Race to Build AI Assistants That Never Forget", The New Stack, 2026.[10] "What Is Paperclip? The Open-Source Framework for Zero-Human AI Companies", MindStudio, 2026.[11] "Paperclip: The Open-Source Operating System for Zero-Human Companies", Towards AI, 2026.[12] paperclip/doc/SPEC-implementation.md, GitHub, 2026.[13] "No Cross-Company Coordination Mechanism", Issue #2212, GitHub, 2026.[14] "Language Models are Changing AI: The Need for Holistic Evaluation", Stanford CRFM.[15] "MedCalc-Bench Doesn't Measure What You Think: A Benchmark Audit and the Case for Open-Book Evaluation", arXiv, 2026.[16] OpenCompass Documentation, Read the Docs, 2026.[17] EleutherAI LM Evaluation Harness, GitHub.[18] "Evaluating LLMs", EleutherAI, 2026.[19] "Pentagon threatens to make Anthropic a pariah if it refuses to drop AI guardrails", CNN, February 24, 2026.[20] "Anthropic sues the Trump administration over 'supply chain risk' label", NPR, March 9, 2026.[21] OSINT capture, geopolitics_prime channel, April 13, 2026, 21,000+ engagement. "Project Glasswing: How Iran took aim at US AI."[22] OSINT capture, geopolitics_prime channel, April 12, 2026, 22,300 engagement. "Anthropic deploys Claude to kill Iranians, then asks Christian leaders for help building 'moral chatbot.'"[23] "What Is the OpenClaw Ban? Why Anthropic Blocked Third-Party Harnesses From Claude Subscriptions", MindStudio, 2026.[24] "Anthropic clarifies ban on third-party tool access to Claude", The Register, February 2026.[25] "OpenClaw vs Claude Code: Complete Comparison 2026", Blink, 2026. "In 2026, OpenClaw's open-source codebase has 138+ tracked CVEs."[26] "Epstein Files: Photo shows Elon Musk, Mark Zuckerberg at 2015 dinner", Indian Express. Musk and Zuckerberg attended a 2015 dinner at Epstein's Manhattan residence. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit tatsuikeda.substack.com/subscribe