In Brief
Peter Steinberger discusses the meteoric rise of OpenClaw as the fastest-growing open-source project and his transition to OpenAI to lead agent development while maintaining project independence through the OpenClaw Foundation.
Overview
In this keynote and subsequent AMA, Peter Steinberger reflects on the first five months of OpenClaw, which he characterizes as the fastest-growing software project in GitHub history. He describes the unique challenges of 'stripper pole growth,' noting that the project has reached nearly 30,000 commits and 2,000 contributors. Steinberger addresses the intense scrutiny regarding OpenClaw's security, revealing that the project handles over 16 critical security advisories daily—double that of the Linux kernel—though he argues many represent 'AI slop' or bad-faith reports from researchers who bypass default security protocols. He emphasizes a transition toward the OpenClaw Foundation to ensure a 'Switzerland-like' neutrality, even as he works at OpenAI. The discussion explores the philosophy of 'agentic' software, where human 'taste' and system design remain the primary moats against a rising tide of AI-generated code. Steinberger ultimately advocates for a future of local data ownership and ubiquitous agents that operate with distinct personalities or 'souls.'
Key Points
- Hyper-growth and the 'Stripper Pole' Trajectory: OpenClaw is identified as the fastest-growing project in GitHub history, surpassing educational repos to become the largest functional software project on the platform. With 30,000 commits and nearly 30,000 PRs in five months, the velocity necessitates a shift from solo maintenance to a broad corporate coalition including Nvidia, Microsoft, and ByteDance. Why it matters: The massive scale proves a profound demand for open-source agentic frameworks that bypass corporate data silos. Evidence: I think it's fair to say by now that we are the fastest growing project in GitHub's history... a friend called it stripper pole gross and that comes with its own challenges.
- The Security Advisory Deluge: Steinberger reveals the project has received 1,142 security advisories, averaging 16.6 per day. He contrasts this with the Linux kernel (8-9/day) and Curl (600 total), noting that 99% are marked critical, forcing the team to contend with a new era of AI-generated vulnerability reporting. Why it matters: It highlights a new reality where AI tools can identify obscure multi-chain exploits, potentially breaking traditional software security models. Evidence: So far we got 1,142 advisories. That's around 16.6 a day. 99% are critical... we get like twice as much as the Linux kernel.
- Critique of AI Security Research Tactics: Steinberger criticizes certain academic and corporate security papers for ignoring recommended setups to create 'scary' headlines. He cites examples where researchers ran agents in 'sudo' mode or disabled sandboxing to force vulnerability, which contradicts the project's 'personal agent' security guidelines. Why it matters: It warns against 'clout-chasing' in security research that misrepresents the true risk profile of agentic systems. Evidence: They ignored all of the recommendations we do on security... they actually fought the setup. It's actually not easy to run it in pudo mode.
- Independence via the OpenClaw Foundation: To maintain neutrality, Steinberger is establishing the OpenClaw Foundation, inspired by the Ghost foundation. This structure allows the project to accept help from OpenAI, Nvidia, and Microsoft without being acquired or controlled by a single corporate entity. Why it matters: Neutrality is essential for an agentic framework that must work across competing LLM providers and local models. Evidence: I'm kind of building Switzerland with the open glove foundation... this will actually then help us to hire full-time people to both keep up the pace, improve the quality.
- The Role of Human 'Taste' in AI Development: In an age of automated coding, Steinberger argues that 'taste'—the ability to identify and avoid 'AI smells' or generic outputs—is the ultimate moat. He defines good taste as the deliberate choice of delightful details and human-like personality over 'AI slop.' Why it matters: As coding becomes a commodity, the value shifts to the vision and human-centric design of the final product. Evidence: Taste is very important... the very low level of taste is if it doesn't stink like AI... you can identify AI written slop right away.
Sections
Project Metrics and Security Data
Key performance indicators and security vulnerability statistics for OpenClaw.
- Project Stats: 30,000 commits, ~30,000 PRs, ~2,000 contributors within 5 months.
- Security: 1,142 total advisories; 469 published; 60% closure rate. CVSS 10.0 incidents frequently reported for marginal use-cases (e.g., read/write permission bypass on unreleased features).
- Dependency Risk: Supply chain attack via MS Teams/Slack through an unpinned Axios dependency.
Managing Open Source on 'Hard Mode'
Insights into managing high-velocity community projects and AI-driven development.
- Running a large foundation is like a company on 'hard mode' because you cannot directly command volunteers.
- Agents should follow the 'Toby Luca' trust system: building reputation over time so that trusted entities get more privileged access.
- Avoid 'Dark Factories' in software development; an iterative, human-led approach is superior to fully automated waterfalls because the path to the 'mountain top' is never straight.
Meta-Level Observations on AI Agents
Synthesis of the current state of agentic software and industry dynamics.
- AI is fundamentally changing the security landscape by making complex multi-chain exploits easy to find, effectively 'breaking' all legacy software that hasn't accounted for agentic attackers.
- The 'Soul' of an agent (its personality and quirks) is not just aesthetic but a requirement for user trust and natural interaction in non-search contexts like messaging apps.
- Open source agentic frameworks act as a gateway drug for the enterprise; as individuals use them at home, they create bottom-up pressure for AI adoption in the workplace.