OpenClaw for business: what it is, what it costs, and how to run it safely.

What is OpenClaw?

OpenClaw is an open source AI assistant that runs on a computer you control rather than in a vendor's cloud. It connects AI models such as Claude to the channels a business already uses, so you can message it on WhatsApp, Slack or Microsoft Teams and it will actually do the work: read files, draft replies, run tasks in a browser, and remember what you told it last week.

The software itself is free: OpenClaw is open source under the MIT licence, with no paid tier, and runs on a Mac, a Linux machine or a Windows PC. It started in late 2025 as Clawdbot, was briefly called Moltbot, and settled on OpenClaw in early 2026. When its creator, Peter Steinberger, joined OpenAI in February 2026, the project moved to an independent open source foundation. It is still updated constantly; there were several releases in the last week of October 2026 alone, many of them security fixes.

That is the difference between OpenClaw and a chat tool. ChatGPT answers questions; OpenClaw acts. It can be given access to your files, your browser, your calendar and the machine it runs on, and a library of community-built skills bolts on new abilities. That reach is why it has taken off, and why a careless OpenClaw setup is a problem. Worth knowing before anyone in your office installs it: OpenClaw was designed as a personal assistant for one trusted person, and its documentation is clear that a single install is a single zone of trust. That matters the moment a whole team wants to share it.

What can OpenClaw do inside a business?

Real office jobs. It can watch an inbox and draft the replies, chase overdue purchase orders, follow up quotes that have gone quiet, pull the numbers together for a monthly report, and field staff questions from your own document library at whatever hour they arrive, through the chat apps your people already use. If a capable assistant could do the job with a computer and the right access, OpenClaw can usually attempt it.

Attempt is the honest word. In a WA business the wins look like this: the operations manager messages it at seven to get yesterday's dockets summarised, the office has it assemble a prequalification pack from documents it already holds, and the quote follow-ups that used to slip go out on time. But it works with judgement rather than a script, so anything leaving the business should pass a person first. What it may do alone, and where, is exactly what a managed setup pins down. For more of what agents are actually doing in businesses here, see our AI agent examples from Australian businesses.

Is OpenClaw safe for business use?

Not as it comes. OpenClaw runs with whatever access it is given, which can include your email, your files and the ability to run commands on its own machine, and its own documentation is blunt that written guardrails alone do not stop a malicious message from steering it. Made safe for business, it takes hard limits: on who can reach it, on what it can touch, and on what it may do without a person saying yes. Putting those limits in place is exactly what our managed setup is for.

The risks are worth naming plainly, because most write-ups skip them. First, prompt injection: an assistant that reads email and web pages is reading instructions from strangers, and instructions hidden in a message can steer it. The fix is not a cleverer prompt; it is keeping dangerous abilities off or gated so a steered assistant cannot do much harm. Second, open doors: most real incidents are mundane, someone messages the assistant and it does what they asked, and installs left reachable from the open internet have been reported repeatedly. Third, skills: an installed skill runs with the assistant's access, so every one needs vetting like any other software you would let inside the fence. This is not theoretical. In early 2026 security researchers found hundreds of malicious skills on ClawHub, the public skill registry, some of them built to install password-stealing software. The registry has since added malware scanning, but scanning is a filter, not a guarantee.

OpenClaw's own security guide is worth reading before anyone installs it. It says plainly that OpenClaw "is not a hostile multi-tenant security boundary", recommends a separate install for each group of people who trust each other, and ships an "openclaw security audit" command that checks a setup against its safe defaults. Normal installs only listen on the local machine by default, but its container images are reachable from outside by default, so they need authentication added before they go anywhere near the internet.

None of that makes OpenClaw a bad tool. It makes it a power tool, and power tools get guards fitted before anyone on site is allowed to use them. How we handle access, data and models on every build is written up on our security page.

What does OpenClaw cost to run?

The software costs nothing. Running it costs three things: the AI model it uses, billed by your model provider (usually per use through an API key), a computer or server to run it on, and the time to secure, update and watch it. For most businesses the model bill and the upkeep are the parts worth planning for.

Model usage is the cost that surprises people. An assistant that answers a few questions a day costs very little; one left running long jobs around the clock can run up a serious bill, because every step it takes is billed. Set a monthly spend limit with your provider before go-live and check usage weekly for the first month. One more thing that changed this year: model providers have tightened how personal chat subscriptions can be used inside third-party tools like OpenClaw, and OpenClaw's own documentation recommends an API key rather than a personal subscription login for shared business automation. Budget on API pricing, under business terms.

Hosting is the cheap part: a spare machine in the office or a small cloud server, hosted in Australia if your obligations require it. Upkeep is the part DIY setups underestimate. OpenClaw ships updates often, and skipping them means skipping security fixes.

How do you set up OpenClaw?

Installing it takes minutes: the official installer runs on macOS, Linux, Windows and WSL2, installs Node if needed, asks for your model provider's API key and walks you through connecting a chat channel. Setting it up safely for a business takes longer, because the work is deciding what it may touch, who may talk to it and what needs a human yes.

The DIY path, in order: install on a dedicated machine rather than someone's work laptop, connect one channel, keep pairing switched on so strangers who message it get nothing, run the built-in security audit and fix what it finds, and add tools and skills one at a time. If the job you have in mind is really a tool rather than an assistant, such as a quote calculator or a dashboard, building it with Claude Code is often the simpler route; our guide to Claude Code for business owners covers what owners build that way.

What does a managed OpenClaw setup include?

Everything between "we want this" and "it runs safely without us thinking about it": scoping what the assistant may touch, deploying it locked down on hosting that suits your data obligations, connecting only the channels and systems you approve, writing the rules for what it may send or do without a human, training your staff, and monitoring it after go-live. The whole thing is quoted as one figure before we begin, and you own the setup.

In practice that means an access list agreed with you before anything is connected, with payroll, banking and HR systems off it unless you explicitly decide otherwise. Each channel is restricted to named staff. High-risk abilities are off by default and anything sensitive routes through a person for approval. Logs are kept, updates are applied and tested rather than left to chance, and when something looks off, we get the alert and make the call with you. Staff get shown how to use it well and where its judgement ends, which pairs naturally with our Claude training. And if you are not sure OpenClaw is the right first move, our AI audit works out where the return actually is before you commit.

When is OpenClaw the wrong tool?

When the job is one defined process that must run the same way every time, at volume, with an audit trail. OpenClaw is a generalist assistant: superb at varied, human-shaped work for a few trusted people, and wasteful as a production line. For jobs like quoting every enquiry or processing every invoice, a purpose-built AI team is cheaper to run, easier to audit and harder to break.

Two other cases get a no from us. One assistant shared by the whole company is the wrong shape: one install is one zone of trust, so the receptionist and the finance manager sharing an assistant hold the same keys. Different teams need separate installs or a purpose-built system with proper user accounts. And OpenClaw should not face the public; a customer-facing assistant needs the narrow permissions of a purpose-built agent, not a generalist with system access. We build all three shapes, so when we tell you which fits, it is advice rather than a pitch.