AI
OpenClaw’s Growth and Governance Under Pressure
OpenClaw is five months old and, by Steinberger’s count, the fastest-growing project in GitHub’s history. The growth curve looked less like a hockey stick and more like a vertical line. Numbers at the time of the talk: around 30,000 commits, closing in on 2,000 contributors, and nearly 30,000 pull requests. Running the Open Claw Foundation alongside a day job at OpenAI means managing all of that with volunteers you cannot direct. To spread the bus factor, Steinberger pulled in contributors from Nvidia, Microsoft, Red Hat, Tencent, and ByteDance.
1,142 Security Advisories: Separating Signal from AI Slop
OpenClaw collected 1,142 security advisories in five months, 16.6 per day, 99 of them critical. That rate is double the Linux kernel’s and twice curl’s lifetime total. Most are AI-generated. Steinberger’s triage rule: the louder the CVSS rating, the more likely it’s slop. The real incidents were GhostClaw, a likely North Korean npm typosquatting campaign that installed rootkits, and a transitive Axios dependency that dragged OpenClaw into a supply-chain hit it never introduced. He walked through the NemoClaw sandbox break in 30 minutes live: five escape paths from Nvidia’s secure sandbox, found using Codex.
Fearmongering vs. Real Agentic Risk
A university paper called “Agents of Chaos” gave four pages to OpenClaw’s architecture and zero to its security documentation. The authors ran it in sudo mode to maximize agent power, then left that out of the report. Belgium’s national cybersecurity agency issued a CVSS 10 remote-code-execution advisory. The bug: a malicious site could forward a gateway token, but only if the user had already broken the default local-only setup. The real risk is structural. Any agentic system that holds user data, reads untrusted content, and can communicate outbound is exposed. The more capable the agent, the larger that surface.
Staying Open Under OpenAI: The Foundation Strategy
Steinberger is finalizing the Open Claw Foundation, modeled on Ghost, with board members from Nvidia, Microsoft, Telegram, Salesforce, Tencent, and ByteDance. The last obstacle is the American banking system. The foundation will fund full-time hires. OpenAI did not acquire OpenClaw; Steinberger joined OpenAI and the two exist separately. He deliberately limits OpenAI’s contributor count to prevent any appearance of corporate capture. The logic: OpenClaw must run against any model from any provider. Every lab benefits when home users discover agents and then demand the same tools at work.
Parallel Agents and the Limits of Dark-Factory Development
At peak, Steinberger ran ten parallel agent sessions to compensate for slow inference. With faster models, five or six windows now cover the same surface. He rejects the dark-factory model, where code merges without human review. A vision document can guide an agent, but it cannot replace whoever decides which PR fits the project and which pulls it sideways. That judgment is taste. At its floor, taste means output that does not smell like AI. At its ceiling, it is the roast message that appears when OpenClaw starts. No high-level prompt produces details like that.
Prompt Injection, Dreaming, and Skills That Still Matter
On prompt injection: frontier models handle untrusted content well. The weak point is 20-billion-parameter local models with no safety training. OpenClaw already warns you when you pick one, and Steinberger said a fix is close but unannounced. The dreaming plugin runs session logs through a garbage-collect pass, promoting some memories to long-term storage and discarding the rest. On skills: system design, because agents given a partial codebase view produce locally correct but globally broken solutions. And saying no, because any feature is one prompt away and the real problem is how all of them fit together.
Q&A
What is your response to ‘closed claw’ concerns about OpenAI taking over the project? Steinberger says OpenAI understands the project must stay independent and model-agnostic; he deliberately limits the number of OpenAI contributors to prevent any appearance of corporate capture. ▶ 19:29
How do you want to solve prompt injection? Frontier models already handle most cases; the real risk is underfenced local models, and Steinberger said an unannounced dedicated solution is close. ▶ 35:58
What skills do you want engineers to focus on in the age of AI? Taste, system design (to steer agents toward globally coherent solutions), and saying no (because every feature is one prompt away and the combination is the problem). ▶ 41:34
Notable Quotes
advisories. That’s around 16.6 a day. 99 Peter Steinberger · ▶ 4:34
within half an hour. Peter Steinberger · ▶ 6:08
system design is still very important. Peter Steinberger · ▶ 41:53
Key Takeaways
- AI-generated security reports are flooding open source projects at rates no volunteer team can manually triage.
- The real agentic risk is data access plus untrusted content plus outbound communication, not CVSS scores.
- Taste and system design still determine output quality; dark-factory automation cannot replace iterative steering.