OpenClaw Complete Guide: Setup, Security, and Cost Control in 2026

A friend of mine ran OpenClaw for two days with default settings. His Anthropic bill hit $1,100. He thought something was broken. It wasn't. That's just what happens when you run Claude Opus on every heartbeat, every classification task, and every sub-agent call without configuring model tiering. I analyzed 27 videos from top creators who've collectively spent thousands of hours running this thing, and this is everything I wish they'd put in one place.

What Is OpenClaw and Why It Went Viral

OpenClaw isn't a chatbot. It's an agent runtime. You give it goals, connect it to your email, calendar, Telegram, GitHub, and it works 24/7 on your behalf without you asking. It checks emails, triages your inbox, writes code while you sleep, and reports back in the morning. If you're comparing it to other AI agent tools, the key difference is the personal, always-on deployment model.

The project hit 200,000 GitHub stars in 84 days, making it the fastest-growing repository in GitHub history. In January 2026, creator Peter Steinberger (also founder of PSPDFKit) joined OpenAI. OpenClaw moved to an independent foundation under MIT license with 70+ regular contributors. OpenAI provides financial and technical support, but the community runs the project.

The name history matters because it created a real security risk. The project went ClawdBot to MoltBot to OpenClaw in a matter of weeks. Bad actors cloned every old website with malware. Only download from github.com/openclaw/openclaw or openclaw.ai. Nowhere else.

Installation Methods Compared

There are essentially five ways to install OpenClaw. I'll save you the research: most people should use the one-liner on a local machine. Here's the full picture so you can decide.

Method	Difficulty	Monthly Cost	Best For
One-liner (local macOS)	Easy	$0 hardware	Most users, maximum integration
VPS + one-liner	Easy-Medium	$5-10/month	Beginners without spare hardware
Dedicated Mac Mini	Easy	$0 (after $600 hardware)	Power users, permanent deployment
From source (VPS)	Hard	$5-10/month	Developers, bleeding-edge features
Claude Code replica	Medium	~$200/month flat	Fixed-cost users, maximum security control

The One-Liner: Recommended Starting Point

Seven out of 22 creators I studied explicitly recommend the one-liner. Alex Finn put it directly: "Copy the single-line command, paste and hit enter. It's installed." That's the kind of simplicity that's hard to argue with.

curl -fsSL https://openclaw.ai/install.sh | bash
# Or if Node.js is already installed:
npm install -g openclaw@latest

After the install runs, you kick off the wizard:

openclaw onboard --install-daemon

The --install-daemon flag is critical. Without it, OpenClaw dies the moment your terminal closes. This trips up a lot of first-timers.

VPS vs. Local: The Real Argument

This is the most debated topic across all the videos I analyzed. Strong opinions on both sides.

Alex Finn is emphatic: "I highly recommend doing this locally. Doing it on a VPS is a massive critical mistake. VPS gives you 20% of the power." He's not wrong about the power claim. Local macOS means iMessage, browser automation with your actual cookies, local apps, and Things 3 integration. None of that works on a VPS.

But VelvetShark's counter is also valid: his Hetzner VPS ($5/month, 4GB RAM) setup is literally cited in the official OpenClaw documentation. It works. It's 24/7 without keeping a personal machine on. And it provides natural isolation from your daily driver.

Here's my read: if you already have a Mac you can dedicate, go local. If you don't, start on a VPS. The "20% of the power" claim applies specifically to OS integrations. For email, calendar, web research, and coding workflows, VPS is perfectly capable.

Mac Mini: The Power User Default

Peter Yang, Alex Finn, Matthew Berman, and Nat Eliason all independently converged on the Mac Mini (~$500-600) as the optimal dedicated hardware. It's always-on in clamshell mode, has full macOS integration, and you can access it remotely via Tailscale. Alex Finn called it "the best value in computing at $600."

If you're serious about running OpenClaw as a permanent AI employee, this is the setup to build toward. Start cheap (VPS or existing laptop), then upgrade when you've proven the value.

Important Warning: Subscriptions on VPS

This tripped up Berman and others. Using a Claude Pro or Max subscription to authenticate OpenClaw on a VPS infrastructure can get your account banned. Goda Go documented Anthropic banning accounts for this. After his own OOTH access got cut, Berman migrated to the Agents SDK.

The rule is: Claude subscription works on local machines. For VPS deployments, use API-based billing or the Agents SDK. Alex Finn says he's "heard of people getting banned but never met any of them," so enforcement may be uneven. I wouldn't bet my account on that. If you want to understand Anthropic's full model pricing, check our Claude Opus 4.6 review for a breakdown of what you're paying for.

Security: The Part Most Guides Skip

Here's what nobody mentions upfront: OpenClaw has access to everything you give it. Email, files, calendar, GitHub, Stripe, crypto wallets. If someone can inject malicious instructions into content it reads, they have access to all of that too.

Nine out of 22 creators I analyzed independently recommend the same baseline practice: run on a dedicated machine with dedicated credentials. Not your daily driver. Not your personal Apple ID. A separate machine with a separate email, separate Google account, and separate API keys.

OpenClaw Security: What Works and What Doesn't

The Summer Yue Incident: A Lesson in SOUL.md

In February 2026, Summer Yue (a director at Meta AI) had her agent delete her entire email inbox. She had instructed it to "confirm before acting" but that instruction lived in the conversation history. When the context window compacted, the constraint was erased. The agent deleted the emails.

The lesson is simple. Any rule you actually need the agent to follow forever goes in SOUL.md or MEMORY.md. Not the chat. These files persist through compaction. The conversation does not.

# SOUL.md -- Critical safety constraints
Always confirm before: deleting files, emails, or data.
Never send external communications without explicit approval.
Do not execute financial transactions over $100 without confirmation.
Never share API keys, passwords, or sensitive credentials in any channel.

Prompt Injection: The Primary Threat

Prompt injection is when malicious instructions are embedded in content your agent reads. A "please delete all files" in an email body. An "ignore previous instructions" in a tweet. A skill with a hidden payload. This is a topic our AI security guide covers in depth for anyone running multiple agents.

Goda Go documented that 42,000 OpenClaw instances were exposed publicly, with prompt injection achievable in under 5 minutes against most of them. Alex Finn put it plainly: "If they have access to your OpenClaw, they have access to all your passwords and API keys."

Berman built a 3-layer defense I think is worth replicating: first, deterministic scanning (regex for "ignore previous instructions" patterns before the LLM sees the content), second, quarantine mode where suspicious content gets analyzed in an isolated sandbox, third, elevated risk markers that score and flag content before action is taken.

Most users won't implement all three layers. At minimum, do the first one: teach your agent to scan incoming content and quarantine anything with injection patterns.

The 26% Skill Vulnerability Problem

Cisco audited 31,000 ClawHub skills and found that 26% contained at least one vulnerability. That's roughly 8,000 potentially dangerous skills in the marketplace. There's no official security review process for user-uploaded skills.

Samuel Gregory's risk hierarchy is practical: pure Markdown skills (lowest risk) are fine. Skills with CLIs are mostly fine. Skills with Python scripts need inspection. Skills with multiple bash scripts get a full manual review before I'd trust them.

Model Tiering: The Most Important Configuration

This is where people lose real money. Without model tiering, OpenClaw runs Claude Opus on everything: every heartbeat check (48 times per day), every classification task, every sub-agent call, every routine cron job. Opus costs about $30 per million tokens. At that rate, VelvetShark calculated a power user profile running $943/month. Tech With Tim reported a friend hitting $200/day. These aren't edge cases.

With proper tiering, Berman runs a full multi-workflow setup for $150/month. VelvetShark brought $943 down to $347. The savings are 60-80%.

The "Brain and Muscles" Framework

Alex Finn coined this and it's the clearest way to think about it. Your brain (Claude Opus 4.6) handles planning, decision-making, and personality. Your muscles (cheap specialized models) execute the actual tasks.

Role	Recommended Model	Cost (per M tokens)	Why
Brain (reasoning)	Claude Opus 4.6	~$30/M	Best personality, warmth, multi-step planning
Heartbeat	Gemini 2.5 Flash-Lite	$0.50/M (60x cheaper)	Simple check-in, no reasoning needed
Classification	Gemini 2.5 Flash	Low	Tagging, filtering, sorting tasks
Coding execution	OpenAI Codex / GPT	$5-15/M or subscription	Best for code; different prompt conventions
Fallback	GPT-5.2 (not another Claude)	Varies	Cross-provider avoids correlated outages

The fallback provider point is easy to miss. If you set Opus as primary and Sonnet as fallback, you get nothing when Anthropic has an outage. Both fail together. Use a different provider for fallback. For a side-by-side look at how Opus compares to OpenAI's models on reasoning tasks, see our Claude Opus vs GPT comparison.

Real Cost Scenarios

Here's what the data from experienced creators actually shows, not marketing estimates:

Setup	Monthly Cost	Source
Free models (Pony Alpha / Gemini free)	$0	AICodeKing [V09]
Budget (GLM5 or MiniAX 2.5)	$5-10	Alex Finn [V24]
Berman's full setup (tiered)	~$150	Matthew Berman [V12]
Alex Finn (Opus subscription)	~$200	Alex Finn [V17]
VelvetShark (optimized)	$347	VelvetShark [V05]
Default Opus (no tiering)	$943	VelvetShark calculation [V05]
No tiering at all	$100-500/day	Tech With Tim [V21]

Note the privacy trade-off with free models: Pony Alpha via OpenRouter logs all prompts. If you're testing workflows with personal or business data, free models are not appropriate.

Prompting Claude Opus Correctly

One thing that surprised me: Opus 4.6 requires a different prompting style than older models. Berman, who's processed roughly 5 billion tokens through OpenClaw, is emphatic about this. No bold formatting. No ALL CAPS. No "CRITICAL:" prefixes or "never ever forget this" language.

Just clear, conversational instructions. Opus reads every word carefully. Adding emphasis doesn't help. It can actually cause over-triggering.

Setting Up Your Agent: The Six Critical Steps

After analyzing the setup workflows across 27 videos, these are the steps that matter most. Not the ones tutorials show first. The ones that actually determine whether your agent works in week three.

Step 1: Configure Model Tiering Before Anything Else

Tell OpenClaw your model structure before you set up a single workflow. Once workflows start running, you'll forget. By the time you notice the costs, you've spent real money.

Configure model tiering:
- Primary brain: Claude Opus 4.6 (reasoning, planning, decisions)
- Heartbeat model: Gemini 2.5 Flash-Lite (routine check-ins)
- Classification model: Gemini 2.5 Flash (tagging, filtering)
- Coding execution: OpenAI Codex (via ChatGPT subscription)
- Fallback: GPT-5.2 (different provider for outage resilience)
Set spending alerts at $20/day on all providers.

Step 2: Set Up Telegram with Topics

Create a Telegram group with topics enabled, not a direct message channel. This is unanimous across advanced users: Berman, Finn, Eliason, and Tech With Tim all use it. Each topic becomes its own context bubble: CRM channel, research channel, cron updates channel, general channel.

This matters because context isolation improves performance dramatically. When your agent is in the CRM topic, it knows it's doing CRM work. The context doesn't bleed across different workflows.

One gotcha: the Telegram bot username must end in "bot" (like myagent_bot), and many good names are already taken. Have backups ready.

Step 3: Write Your SOUL.md First

Before giving your agent any real access, write the safety constraints that must survive context compaction. At minimum:

# SOUL.md
Always confirm before deleting files, emails, or data.
Never send external communications without explicit approval.
Do not execute financial transactions over $100 without confirmation.
Never share API keys, passwords, or sensitive credentials.
When uncertain about scope, ask rather than assume.
Back up before any destructive operation.

Step 4: Do the Brain Dump

This is the step that makes everything else work. Alex Finn calls it "the most important thing you can do today." Tell your agent everything about you: your name, your work, your goals, your communication preferences, your ongoing projects, your pet peeves.

The interview format works well:

I want to do a brain dump. Interview me about: my name, job,
goals, daily routine, communication preferences, current projects,
and anything else you think is important to know about me.

Answer all the questions. The more context you give, the more useful the agent becomes. Eliason puts it plainly: "Get the memory structure in first, because then conversations from day one immediately start being useful."

Step 5: Start with the Morning Brief

Five separate creators recommend this as the first workflow. It's simple enough to set up in minutes, valuable enough to prove the tool's worth, and teaches you cron scheduling without any real risk.

Schedule a daily morning brief at 8:00 AM. Include:
- Weather for [your city]
- Today's calendar events
- Top 3 news items in [your field]
- Any pending tasks or reminders
Send to the general topic in this Telegram group.

When you get your first morning brief the next day, you'll understand why people find this addictive.

Step 6: Enable Backups Before Expanding

OpenClaw runs on a single machine. Its memory is in plain Markdown files in ~/.openclaw/. Berman's setup pushes code to GitHub hourly and uploads encrypted database snapshots to Google Drive daily. That's the right level of protection for anything you plan to rely on.

The Skills Ecosystem: What's Actually Worth Installing

ClawHub has 31,000+ skills. Most are unnecessary. Here's the honest picture of what actually matters.

Samuel Gregory's framing is useful: skills don't grant access you don't already have. The browser plugin already gives OpenClaw access to anything logged in on your browser. Skills make certain tasks easier and faster, but they're not magic capabilities.

The skills that add genuine new functionality are the ones with actual scripts, not just Markdown prompts. ElevenLabs for voice calling, WhatsApp CLI, custom data processing pipelines. These do things the browser plugin can't.

Skill Security Hierarchy

• Pure Markdown skills: Lowest risk. Read the file, understand the prompt, install if it looks sane.
• Skills with CLIs: Low risk. Understand what the CLI does before installing.
• Skills with Python scripts: Medium risk. Read every line of the Python before installing.
• Skills with multiple bash scripts: High risk. Full manual review required. These can do anything.

And the warning from Cisco's audit: roughly 26% of skills have at least one vulnerability. That number hasn't been officially updated since the audit. SecureClaw (launched February 18, 2026) provides 55 automated checks and is worth running after any skill installation.

Memory Architecture: Enable QMD

OpenClaw's default memory system only reads the last two days of history. For an agent you're building long-term institutional knowledge into, that's not enough.

QMD (BM25 + vector + reranking) is dramatically better. Tech With Tim is direct: "Enable QMD. By default, OpenClaw only reads two days of previous memory. QMD is significantly better at searching through all your memory." Eliason installed it, notes it took "4-6 pushes to get working," but says it's been excellent since.

Also enable memory flush and session memory. The three together form a functional long-term memory system. The default doesn't get you there.

Business Use Cases That Actually Work

Let's skip the fantasy ("your AI does everything while you sleep!") and look at what experienced creators are actually running in production.

Morning Brief and Daily Intelligence

The simplest and most universally deployed workflow. Weather, calendar, top news in your field, pending tasks, delivered to Telegram at a set time every morning. Takes 10 minutes to set up, saves 20+ minutes of daily context-gathering. This is where every setup should start.

Personal CRM with Natural Language Queries

Berman built a 371-contact CRM in SQLite with vector embeddings. It scans email, calendar, and Slack for contact data, deduplicates and classifies them, monitors news about contacts' companies, and enables queries like "Who haven't I talked to in 4 months?" When he has a meeting, the agent pulls full context on every attendee automatically. It took significant iteration to build, but it's his most-used feature.

Video and Content Research Pipeline

Drop a link in Telegram or tag the agent in Slack. It parses the topic, researches across the web and X, queries the existing knowledge base to avoid duplicates, generates hooks and outline, creates an Asana task, and confirms back in the original channel. Berman reports the entire flow takes about 30 seconds.

Autonomous Code Development

Alex Finn documented OpenClaw noticing a trending article about an Elon Musk contest, autonomously building an article-writing feature for his SaaS product, and generating "$10,000+ recurring revenue" while he slept. Nat Eliason's agent Felix autonomously launched a product called EasyClaw that generated $14,000 total, including $3,500 in the first four days.

To be direct: these are exceptional cases from people who spent months building the infrastructure. Revenue generation isn't a typical early outcome. But they demonstrate what the system is capable of after serious iteration.

What Doesn't Work Well (Yet)

Context window overflow is the main long-term failure mode. After weeks of use, accumulated memory files degrade agent performance. VelvetShark documented this at day 50. Berman has an automated pruning cron that trims about 10% of memory every other day. You need something similar.

Cron jobs also go silent without notification when the daemon dies. If your server restarts, your scheduled tasks stop without telling you. Build monitoring before you depend on critical automations.

And skills do break after major OpenClaw updates. VelvetShark documented needing to reinstall skills after updates. Expect this as maintenance overhead. If you're looking at alternative ways to build similar automations, check out our automation tools category for context on what else is available.

Version Hygiene: Update to v2026.2.23+ Now

Between February 13-19, 2026, the OpenClaw team pushed 90+ security patches across four releases. The specific issues fixed include SSRF vulnerabilities, sandbox traversal exploits, session hijacking, and browser untrusted-by-default policy. Six new CVEs were disclosed by Endor Labs during this period.

Check your version and run the doctor:

openclaw --version   # Should show v2026.2.23 or newer
openclaw doctor --fix   # Fixes breaking config changes automatically

There are also several breaking changes from recent updates that openclaw doctor --fix handles: the browser SSRF config key was renamed in v2026.2.23, channel streaming config keys were renamed in v2026.2.22, and heartbeats can no longer send to DMs as of v2026.2.24.

Frequently Asked Questions

Can I run OpenClaw on a $5/month VPS?

Yes. VelvetShark's Hetzner VPS setup ($5/month, 4GB RAM) is cited in official OpenClaw documentation. You'll lose macOS-specific integrations (iMessage, browser with your cookies, Things 3) but the core agent functionality works fine. 8GB RAM is recommended for skills-heavy or multi-agent setups.

Is Claude Pro/Max subscription usable with OpenClaw?

On local machines: yes, and it's actually recommended to avoid double-billing. On VPS infrastructure: Anthropic has banned accounts for this. Use API billing or the Agents SDK for VPS deployments. The "Claude Code CLI token auth" option in the wizard is the right choice for Pro/Max subscribers on local machines.

What's the minimum I need to spend monthly?

Technically $0 with Pony Alpha (free via OpenRouter). Realistically $5-10/month with GLM5 or MiniAX 2.5 via OpenRouter. Quality-tier setup with Opus as brain runs $150-200/month. The variation is entirely determined by model choice and whether you configure tiering.

How long does it take to get real value from OpenClaw?

The morning brief can work on day one. A useful personal assistant with good context takes 1-2 weeks of iterating. A fully operational CRM or multi-workflow business setup takes 4-8 weeks of progressive building. Every experienced creator says the same thing: build incrementally. Don't try to automate everything on week one.

What's the biggest mistake first-time users make?

Not configuring model tiering. Tech With Tim reported a friend spending $200/day without it. The second biggest mistake is putting safety constraints only in the chat, not SOUL.md. The Summer Yue incident (deleted inbox) is a concrete, documented example of what happens when you don't.

Is OpenClaw still actively maintained after Peter Steinberger joined OpenAI?

Yes. The project moved to an independent open-source foundation under MIT license when Steinberger joined OpenAI in February 2026. OpenAI provides financial and technical support. Sam Altman confirmed: "OpenClaw will live in a foundation as an open source project that OpenAI will continue to support." There are 70+ regular contributors and 13 releases in the 2 weeks since the transition.

Start with the morning brief. Prove it works. Then add one workflow at a time. Every creator who has a serious setup today started exactly that way.