After OpenClaw’s rapid rise, the central debate is shifting away from raw model intelligence to a harder question: when a personal agent can send messages, edit files, and run tasks on a user’s behalf, who is it actually supposed to obey? Speaking at ClawCon in Shanghai, OpenClaw core contributor Vincent Koc argued that the real bottleneck is not just reasoning power. It is action boundaries, memory handling, tool use, and the ability to recover when things go wrong.
Popularity brought governance strain into full view
OpenClaw, a personal AI agent project created by Austrian engineer Peter Steinberger in late 2025, became one of the most-starred executable software repositories in GitHub history within three months. Sam Altman later announced that Steinberger was joining OpenAI, and the project was handed over to a foundation for independent operation. Around it, the ClawCon community expanded from San Francisco to New York, Miami, Austin, Madrid, Tokyo, and then Shanghai in May.
The surge in attention came with a cost. Koc said OpenClaw received 10,000 pull requests. AI coding tools have lowered the barrier to contribution, which means ideas that once would have stopped at the concept stage can now arrive as patches that appear functional on the surface. He also said the team went through a period of receiving more than 100 security reports a day. Many of those reports were generated through large language models, yet maintainers still had to review and classify them.
The model is the brain, but the agent is the body
Koc described OpenClaw as the system wrapped around the model rather than the model alone. He used the word “Harness” to explain that layer: the framework that determines how tools are called, how the user is remembered, how tasks are broken down, when the system should stop and ask a human, and when it should keep going. None of that sounds glamorous. Still, those mechanics shape whether an agent can move beyond demos and become a stable everyday tool.
He framed the trade-off as a simple triangle: speed, cost, and accuracy are hard to maximize at the same time. Push cost down too aggressively, and the system may become slower or less reliable. Push for both speed and accuracy, and inference costs rise while tool chains become longer and harder to predict. Benchmark rankings can show model scores in coding, math, or reasoning, but they do not reveal how often an agent fails in a live environment, whether it needs human intervention, or how instability appears over time.
Memory may matter more than multimodality
Michael Galpert, founder and global organizer of ClawCon, argued that if everyone ends up with a persistent personal agent, the defining capability will be memory. If a user discussed something two weeks ago, the agent should still understand the reference today. That separates a personal agent from ordinary software. Tools are used for functions; relationships are sustained through memory.
Koc was cautious on another idea gaining attention in the market: agents that automatically generate their own experience and reuse it later. He said there is still no strong enough evaluation method to determine whether those machine-written lessons are actually useful or just freezing past mistakes into the system. A stored “skill” could be a real shortcut, or it could be an accidental success turned into a rigid path. For agents, remembering is not the same as learning. Never forgetting is not always a sign of progress.
Open communities widen innovation and blur control
OpenClaw started as a personal AI assistant, not an enterprise stack or a multi-agent platform. Yet once it became a large open-source project, the community began extending it into Feishu, WeChat, WeCom, DingTalk, local files, and automation scripts. Galpert said the speed and willingness of Chinese developers to integrate OpenClaw stood out sharply. The implication is clear: openness invites experimentation, but once the door is open, the original maintainers no longer define the project alone.
Koc said the team is adapting its maintenance approach by building out SDKs, testing tools, documentation, and reference architectures. The goal is not to block contributions, but to channel them. In practice, the scarce resource is no longer code itself. It is judgment: which features deserve to stay, which risks cannot be accepted, which requests reflect long-term direction, and which ones are only noise generated by hype.
For agents, security is also a question of boundaries
Security remained a central topic in Shanghai. A tool like OpenClaw becomes more useful as it gains access to chat apps, files, scripts, models, and code generation. It also becomes more dangerous. Koc said OpenClaw, as a major open-source repository on GitHub, has been under constant scrutiny from security researchers. Real vulnerabilities are fixed quickly, and the team works with security groups while trying to keep the process transparent.
But agent security goes beyond software flaws. The harder issue is permissions: what an agent may touch, what it must not touch, when it can act on its own, when it has to stop and ask, and who bears responsibility if it deletes a file, sends the wrong message, or commits bad code into production. There is still no settled answer. That may be why OpenClaw matters beyond its popularity: it is forcing those questions into the open early.