sharp
OpenClaw reached nearly 30,000 commits and almost 2,000 contributors in 5 months, and that changes the meaning of Peter Steinberger’s “we won’t go closed source” line. My read is simple: at this scale, closing it would damage the project before it protected anyone’s interests. Open source here is no longer just ideology. It is the distribution engine, the security reporting surface, the model-neutral story, and the partner magnet. Pull that back inside one company and you do not just lose goodwill; you lose supply from contributors, connector builders, security researchers, and adjacent vendors.
I buy half of Peter’s claim and reserve judgment on the other half. I buy the structural part. A project with roughly 2,000 contributors and outside engineering support from Nvidia is not easy to quietly absorb. But governance is where open projects usually get captured. They do not die by license first. They die through roadmap control, merge rights, default service bindings, trademark ownership, or a foundation that exists on slides but not in practice. The article says a foundation is being set up. It does not disclose bylaws, board seats, trademark ownership, CLA terms, or repo permission design. Without those details, “neutrality” is still founder trust, not institutional trust.
That matters because this operating model fits a pattern we have seen across developer AI infrastructure over the last year. Projects that win early usually do three things: remove friction, stay compatible with everything, and postpone hard governance questions. LangChain did that in its first wave, then paid for it in maintenance debt. Open WebUI, ComfyUI, and Ollama also benefited from the same demand: developers do not want a single model vendor controlling their interface layer. Whoever becomes the neutral control surface gets the traffic first. OpenClaw is clearly riding that current. Peter’s bundling of local-first, model-neutral, and swappable memory modules is not random positioning. It is an anti-lock-in engineering stance.
I still want to push back on “local-first,” though. The article gives the philosophy, not the budget sheet. It does not say what a serious local agent run costs in RAM or VRAM, which tasks still require cloud fallback, what latency looks like, or which connectors end up sending data back out to third parties anyway. A lot of products spent the last year marketing local-first while delivering “settings local, capability remote.” If OpenClaw wants to prove it is different, it needs to publish the data flow, permission boundaries, and model fallback path in much more detail. That becomes even more important with Dreaming-style memory features. Once you start rewriting logs into summaries and persistent memory, the privacy risk is often larger than the original prompt. The article gives the theme and withholds the implementation.
Security is where this talk gets serious. The numbers are big: 1,142 security reports, 99 marked critical, 469 made public, with a 60% closure rate. Those are not “everything is fine” numbers. Those are “your attack surface now looks like infrastructure” numbers. Peter’s complaint about noise is fair. CVSS has had this problem for years: a technically severe chain does not always translate into realistic exploitability. AI agent vulnerabilities are especially prone to this because they often require odd deployment setups, permissive tool grants, or multi-step prompt/tool chains. A scary 9.8 or 10 score is easy to produce. Users, though, read headlines, not exploit preconditions. If your defaults are not safe enough for sloppy operators, you will still eat the reputational cost.
And I do not fully buy the “researchers deployed it wrong on purpose” defense. Yes, some security reports use exaggerated setups. But real users also deploy systems badly all the time. They give sudo, dump agents into shared chats, disable sandboxing, install random npm packages, and forget version pinning. That is not an edge case. That is the internet. Security design that assumes users will follow docs precisely is weak security design. Anthropic, OpenAI, and tools like Cursor have all moved toward tighter default isolation for exactly this reason: prompt injection and tool abuse do not get solved by documentation. Peter’s “fatal triad” framing is strong, though. If a system can access private data, read untrusted content, and communicate outward, risk is structural. That is the right diagnosis. It also implies the fix is not “close 99 critical issues.” The fix is narrower default permissions, explicit confirmation on dangerous actions, and harder isolation across connectors.
The Fast Mode claim is more interesting than it looks. Peter says it cut his parallel sessions from nearly 10 to 5 or 6. That suggests a shift from hiding slowness with concurrency to actually improving per-session throughput. That is a meaningful product maturity signal. A lot of heavy agent users in 2024 and 2025 were effectively acting as their own scheduler, opening many windows because single-threaded progress was too slow. If token handling, tool latency, context compression, and cache behavior are all improving together, users no longer need to be human orchestrators. Still, I have some doubts about how portable that result is. This is one founder workflow, not a public benchmark. The article does not disclose task mix, model version, tool chain, or network conditions. It shows direction, not universal gains.
Dreaming is the flashiest part and the one I trust least until more is disclosed. The talk says the idea came from leaked Anthropic source code. That makes for a good conference moment, but the engineering value depends on two hard questions. First, does memory consolidation add more signal than noise? Second, does it harden wrong summaries into long-term behavior? Nearly every serious agent team has been patching memory over the last year, from academic systems like MemGPT to product features like project memory and workspace recap. Everyone knows stateless chat is not enough. The problem is that automatic summarization also creates second-order hallucinations. If Dreaming just compresses logs again, it is not new. If it adds decay, confidence markers, provenance tracking, and user revocation, then it starts to matter. The article does not give those details, so I am not going to fill them in for them.
I actually agree with Peter on the “dark factory” point. It is not that AI cannot write code. It is that product development is a search problem, and automation often accelerates movement in the wrong direction. Projects that overpromised automatic PR generation, merge, and deployment usually spent the following months adding review gates, allowlists, and environment isolation. In software, the scarce resource is not token production. It is judgment about which path to kill. Peter calls that taste. The word is fuzzy, but in the agent era it lands. As models commoditize average output, differentiation moves to interruption design, escalation rules, and the places where a human should step back in.
So I do not read this as a routine founder reassurance tour. I read it as an attempt to reframe OpenClaw from a breakout open source sensation into an infrastructure layer with security operations, governance, and modular boundaries. Whether that works has very little to do with the slogan “we will not go closed source.” It depends on three concrete things the article only partially covers: how foundation power is allocated, whether default security survives bad operator behavior, and whether high-risk memory features ship with auditable controls. The direction makes sense. The missing details are still the whole story.