OpenClaw shipped its first official iPhone and Android apps on 29 June, and the reviews arrived almost as fast as the download numbers. The apps pair a phone with an OpenClaw Gateway already running on a separate Mac, Linux box, or Windows machine, turning the handset into what the company calls a secure node for chat, voice, approvals, and device-aware automation. Users can grant camera, screen, location, contacts, and calendar access once paired. Android reviewers have been unkind: the app sits at a 2.2-star rating on the Play Store, with recent one-star reviews still describing failed pairing and mixed-up connection protocols even after a 1 July patch. The iPhone build reads as the more finished of the two.What Launched, and Why the Ratings CrateredThe mobile apps work as a remote control; the actual agent lives on a separate machine. OpenClaw's own documentation describes the phone as a companion that connects over WebSocket to a Gateway running elsewhere, receiving invoke commands and reporting status back rather than running open-ended automation on the handset itself. That is a deliberate design choice, and it happens to match the one Anthropic uses for Claude Cowork's Dispatch feature and the one OpenAI has built into the ChatGPT app's Codex controller: keep the agent on a machine you own, and let the phone serve as a thin, authenticated window into it. Push notifications on iPhone route through a hosted relay that checks Apple's App Attest and a StoreKit transaction receipt, a mechanism built to require Apple's official distribution path, which rules out anyone building the app and skipping the relay. The Play Store listing describes the same idea in plainer terms: pair the app with a Gateway to use the phone as a secure node for chat, voice, approvals, and device-aware automation, with device access gated behind standard Android permissions the user grants one at a time.Reviewers wrestling with a QR code, a WebSocket handshake, and a Gateway that has to already be running before the phone shows a single reply are running straight into the friction this thin-client model creates. The relationship is closer to a ship and its away team than to a standalone assistant: the Gateway is the vessel carrying the actual intelligence, and the phone is the crew member checking in from the surface, useful because it stays lightweight enough to carry everywhere. Recent one-star reviews on the Play Store, dated as late as 30 June, describe connections that stall indefinitely despite the Gateway itself confirming the pairing request; a 1 July update from OpenClaw's team promised fixes for mismatched WebSocket and HTTPS addresses and clearer recovery guidance for expired security certificates, though reviews from that same week suggest the pairing problems persisted for a meaningful share of users. Behind the phone apps sits a wide messaging footprint — OpenClaw already speaks WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, and more than a dozen other channels, and a separate Windows Hub companion app handles setup and tray status for desktop users who skip the command line altogether.The Lobster's Origin StoryThe app traces back eight months to Peter Steinberger, an Austrian developer who came out of an earlier retirement in 2025 and began experimenting with AI for fun. What became OpenClaw started as a weekend hack he called Clawd, letting him text an AI assistant and have it complete tasks rather than describe how to. He published the refined version in November 2025 under the name Warelay, then renamed it Clawdbot. The project changed names twice more within days in late January 2026: first to Moltbot after Anthropic raised trademark concerns over its closeness to Claude, then to OpenClaw because Steinberger preferred how the newer name sounded.Growth after that point moved fast enough that outlets recorded different snapshots depending on the exact week they wrote — GitHub star counts of roughly 145,000 in February, past 250,000 by early March, and, per GitHub's own releases page as of today, approximately 382,000. Treat any single figure here as a moment captured in time rather than a settled number; this repository has gained stars faster than almost any project GitHub has hosted, at one stage adding more than 25,000 in a single day. Pricing for OpenClaw's own hosted tier reportedly starts free and rises to around $20 a month for hobbyist plans, with custom enterprise contracts above that, though self-hosting the open-source project remains free of any subscription.On 14 February, Steinberger announced he was joining OpenAI, with Sam Altman posting that Steinberger would help "drive the next generation of personal agents" while OpenClaw itself moved into an independent, OpenAI-sponsored foundation. Steinberger framed the move in his own words as wanting "to change the world, not build a large company." The software stayed MIT-licensed and model-agnostic — it works with Claude, GPT models, DeepSeek, or a local model, connected through whichever messaging app a person already uses, from WhatsApp to Telegram to iMessage.When the Agents Got Their Own InternetOpenClaw's strangest month came courtesy of someone else's project. Entrepreneur Matt Schlicht launched Moltbook on 28 January, a forum built for AI agents to post in, with humans restricted to watching. It grew from roughly 30,000 registered agents to 1.5 million within days, helped along by a linked cryptocurrency token that rose more than 1,800 per cent in 24 hours after venture capitalist Marc Andreessen followed the account on social media. Schlicht built the entire site through vibe coding — directing an AI assistant to write the code from a stated vision rather than writing it himself — and that same shortcut produced the site's undoing. Security researchers at Wiz found an exposed database key that let anyone hijack any agent's account, and a subsequent audit traced the 1.5 million registered agents back to only around 17,000 human owners, with much of the platform's most-shared "AI consciousness" content later attributed to humans writing in character rather than to autonomous behaviour. Meta acquired Moltbook on 10 March for an undisclosed sum, a tidier ending than the story's chaotic middle suggested.Apple's Answer: A Narrower, Typed GateApple's rulebook has stayed hostile to agents that try to run software of their own. The App Review Guidelines require apps to stay inside their own container and forbid downloading or executing code that changes an app's functionality, including other apps — a rule already used to block "vibe coding" tools that write and run software on the device since March. The Information reported in May that Apple staff were designing a system to let agent apps onto the store while preserving Apple's privacy standards, a project driven partly by fear of rogue-agent incidents in which agentic tools had deleted user data outside any consent the user gave. What shipped at WWDC on 8 June turned out narrower than that May reporting suggested. Apple deprecated SiriKit outright, leaving App Intents as the sole framework connecting a third-party app to Siri AI, Spotlight, and Shortcuts, with existing SiriKit integrations given a two-to-three-year support window before removal. App Intents works through typed, schema-based declarations: a water-reminder app declares a LogWaterIntent carrying an integer parameter, and Apple's system calls it with a value and gets a typed result back, with every action enumerated and reviewable in advance and execution confined to what the schema describes.Apple kept the agentic behaviour for itself. The redesigned Passwords app now uses Apple Intelligence and Safari to visit websites and fix weak passwords on a user's behalf, and Siri AI itself became a more capable assistant built on the third generation of Apple's foundation models. Third-party developers, meanwhile, get the Foundation Models framework, introduced in 2025 and expanded this year to route between Apple's on-device model, its Private Cloud Compute servers, and outside providers including Claude and Gemini through a single API — Automattic has already used the framework to add privacy-preserving intelligence features to its Day One journaling app. What this WWDC cycle withholds from outside developers is permission to build an OpenClaw-style agent capable of running arbitrary commands on someone's iPhone, and Apple's updated developer agreement, published the same day as the keynote, makes clear that access to Apple's models comes bundled with platform rules rather than as an open sandbox. Apple has separately tightened its guideline against low-effort, templated app submissions this year, a housekeeping move that lands at the same moment developers are learning to generate whole apps through AI tools, and the same discipline is likely to extend to any future agent-app framework: access to the store, and to Siri AI's attention, will require review every time. The App Store facilitated a reported $1.4 trillion in developer billings and sales in 2025, a figure Apple has every reason to protect by keeping the agentic layer under its own roof.Google's Answer: A Tightened Accessibility LicenceAndroid's equivalent battleground is the Accessibility Service API, the tool that lets an app read the screen and tap buttons for a user — historically the mechanism automation apps have reached for. Google limits the exemption that permits this kind of autonomous behaviour to genuine assistive tools, declared through an isAccessibilityTool flag covering screen readers and switch-based input systems built for people with disabilities. Automation tools, monitoring apps, and general-purpose assistants sit outside that exemption by name, which routes them instead into a separate, prominent disclosure-and-consent requirement, tightened under a policy that took effect on 28 January this year and targeted at AI that reads the screen and taps buttons for a user. OpenClaw's own Android app avoids this fight altogether by leaving that access request out of its design: the node-and-Gateway model keeps the phone's own interface untouched, because the automation happens on a separate computer rather than inside the apps installed on the handset.Every Major Lab Is Building the Same ThingOpenClaw's mobile launch is one entry in a race every serious AI company has been running since Anthropic first shipped a general-purpose computer-using model in October 2024, describing the capability at the time as "still experimental." OpenAI followed in January 2025 with Operator, an agent that used its own browser to book travel and shop online, before folding the product into the broader ChatGPT agent by that August. Google has reportedly redirected engineers away from the browser-focused Project Mariner toward a more comprehensive personal agent, internally codenamed Remy, described in leaked material as a round-the-clock assistant for work and daily life, tested for now only among Google's own staff. Meta has taken the acquisition route, buying Manus AI and launching a desktop agent called My Computer that sorts files, runs apps, and sends emails on a user's behalf, while Microsoft — whose own chief executive once compared OpenClaw's security profile to a virus — has reportedly been testing an internal, comparable system called ClawPilot under the codename Project Lobster.Anthropic's answer, Dispatch inside Claude Cowork, mirrors OpenClaw's phone-as-remote-control approach: a persistent conversation thread lets a person hand a task to Claude from a phone while the actual work runs on a desktop computer kept awake and connected, drawing on whatever files, connectors, and browser access that computer already has configured. Industry analysis published on 1 July, days after OpenClaw's own launch, put the pattern in plain terms: OpenClaw, Claude Cowork's Dispatch, and OpenAI's Codex controller have each converged on treating the phone as a thin, authenticated client for an always-on agent that lives somewhere sturdier. The table below sets out where each system's brain sits.CompanyProductWhere the agent actually runsStatusOpenClaw FoundationOpenClaw + mobile appsSelf-hosted Gateway on the user's own machineLive; mobile apps launched 29 JuneAnthropicClaude Cowork, DispatchUser's desktop, kept awake and connectedLive, research previewOpenAIChatGPT agentOpenAI's own cloud-hosted virtual computerLive, replaced standalone OperatorGoogleRemyReportedly integrated across Gmail, Calendar, and other Google servicesInternal staff testing onlyMetaMy Computer (via Manus AI acquisition)User's desktopReported launchMicrosoftClawPilot (Project Lobster)Internal testingReported internal testingThe Security Bill Comes DueCisco's own AI security team found the sharpest example of what can go wrong, and it behaved less like a buggy plugin than like a threat that attaches before anyone notices it has boarded. A community skill on OpenClaw's ClawHub marketplace, gamed to the top of the rankings under the name "What Would Elon Do?" , turned out to send user data to an outside server in silence while using prompt injection to bypass the assistant's safety rules — nine separate vulnerabilities, two of them critical, in a skill already downloaded thousands of times before Cisco's disclosure. A wider Cisco audit of roughly 31,000 agent skills across multiple platforms found that approximately 26 per cent carried at least one vulnerability, a proportion consistent enough across Cisco's own published research that it holds up better than the exact count of malicious skills in circulation, which different reports have placed anywhere from the low hundreds to over 800 depending on the month measured. OpenClaw's own team has since partnered with VirusTotal to scan every uploaded skill by hash and automated code analysis, rescanning the active library daily.China's response has been the most concrete government reaction to date. Bloomberg reported in March that authorities issued notices warning state-owned banks and government agencies against installing OpenClaw on office computers, with some staff told to report existing installations for security review and possible removal. Local governments in Shenzhen and Wuxi, meanwhile, began offering subsidies worth hundreds of thousands of dollars to startups building on the very same platform, official caution and official enthusiasm running in parallel within the same country.India Is Already Building With ItIndian developers found OpenClaw on their own, well ahead of any push from Apple, Google, or OpenClaw itself. Razorpay cofounder Harshil Mathur built a personal system on OpenClaw, connected through WhatsApp, that reads his sleep and recovery data, drafts morning briefings, orders food on Swiggy, and turns off the lights once he is in bed. "It is like an untrained intern, extremely intelligent, but inexperienced," Mathur told Inc42. A Bengaluru-based data scientist used the same platform to push Union Budget updates every 15 minutes in February, tailored to Karnataka-specific announcements, while a fourth-year engineering student has OpenClaw routing tasks across eight separate agents that handle sales outreach and GitHub monitoring between them. Dedicated OpenClaw hosting has already followed the demand, with at least one Indian provider now selling servers that arrive with the software pre-installed. The pattern holds regardless of what Apple or Google decide about agent apps: Indian developers are already treating a self-hosted Gateway and a WhatsApp connection as sufficient permission of their own.What Happens NextThree dates matter more than any single review score. Apple's next real test arrives with iOS 27 this autumn, when the App Intents-only future becomes mandatory and any remaining ambiguity about third-party agent access should resolve one way or the other. Google's tightened Accessibility Service disclosure rules are already in force, which means the next wave of Android automation apps will have to make accurate disclosures or risk suspension. And OpenClaw's own roadmap keeps shipping weekly, with support for OpenAI's newest model family and a refreshed iOS interface landing within the past few days alone. The deeper question survives every one of those dates: whether an agent that reads your messages, your files, and your calendar belongs on a server you rent, a desktop you own, or a foundation's open-source repository, where responsibility for any single contribution spreads across thousands of volunteers rather than concentrating inside one accountable company. Apple built a typed, inspectable gate and kept the driver's seat for its own Siri. Google built a licence system for anyone who wants to grab the wheel. OpenClaw, and everything now converging on its architecture, is betting that the more interesting car is the one parked at home, reached with a single text message.FAQWhat is OpenClaw?OpenClaw is a free, open-source personal AI assistant created by Austrian developer Peter Steinberger. It connects to messaging apps such as WhatsApp and Telegram and can carry out tasks like managing files, browsing the web, and running scheduled automations, using an AI model of the user's choice.Is OpenClaw the same as Clawdbot or Moltbot?Yes. The software was first published in November 2025 under the name Warelay, then briefly called Moltbot in late January 2026 after a trademark dispute with Anthropic, before settling on OpenClaw days later.Do the OpenClaw iPhone and Android apps run the AI agent on my phone?No. The apps are companion "nodes" that pair with an OpenClaw Gateway running on a separate computer over WebSocket. The phone sends and receives messages and can share device data such as location or camera access, but the actual agent runs on the connected desktop.Is OpenClaw safe to use?It carries real risks. Cisco's security research team found that a popular third-party skill secretly exfiltrated user data, and a broader audit found that approximately 26 per cent of around 31,000 agent skills examined contained at least one vulnerability. Chinese authorities have warned state agencies against installing it on office devices.What happened to OpenClaw's founder?Peter Steinberger joined OpenAI on 14 February 2026. OpenClaw itself moved into an independent, OpenAI-sponsored foundation and remains open-source and model-agnostic.What other companies are building similar AI agents?Anthropic's Claude Cowork has a comparable feature called Dispatch, OpenAI folded its Operator browser agent into ChatGPT agent, and Google is reportedly testing an internal personal agent codenamed Remy. Meta and Microsoft have also been reported to be building or testing similar systems.end of article