OpenClaw and WhatsApp: What It Does and Safer Options

OpenClaw is an open-source AI agent that runs on your own computer and that you can talk to over WhatsApp. Its WhatsApp channel links to an account the same way WhatsApp Web does, so once it is set up you message the agent like a contact and it acts for you: it answers, browses, runs commands and uses add-on “skills”.

That power is also the problem. In 2026 OpenClaw has had a serious remote code execution bug, hundreds of published security advisories, tens of thousands of instances exposed to the internet and a wave of malicious skills on its marketplace. If you want to run it with WhatsApp, run it carefully. If what you actually want is AI help with your chats (summaries, search, reply drafts), a narrower tool carries much less risk.

This guide covers how the WhatsApp integration works, what has gone wrong, a setup checklist, and the alternatives.

What OpenClaw is

OpenClaw describes itself as “an open-source AI assistant that runs on your own computer,” with channels for WhatsApp, Telegram, Slack, Discord, iMessage and more (GitHub). It was created by Peter Steinberger and went through two names before this one. It started as Clawdbot, a play on “Claude”, until Anthropic’s legal team asked the project to reconsider; it became Moltbot and then, at the end of January 2026, OpenClaw (OpenClaw blog).

In February 2026 Steinberger announced he was joining OpenAI and that “OpenClaw will move to a foundation and stay open and independent” (steipete.me). Today the project README says it is stewarded by the OpenClaw Foundation, an independent nonprofit, with “no paid tier, hosted service, or token.” It is MIT licensed and among the most starred projects on GitHub.

The key thing to understand: OpenClaw is an agent with access to your computer. By default, its tools “run on the host for the main session unless you configure sandboxing,” according to the README. A message that reaches the agent can lead to real actions on your machine.

How the OpenClaw WhatsApp integration works

OpenClaw’s WhatsApp documentation describes the channel as “production-ready via WhatsApp Web (Baileys).” Baileys is an unofficial open-source library that speaks the WhatsApp Web protocol. In practice:

1. You run openclaw channels login --channel whatsapp on the machine where OpenClaw runs.
2. It shows a QR code, which you scan from Linked devices in WhatsApp on your phone.
3. OpenClaw now holds a WhatsApp session for that account and saves its credentials under ~/.openclaw/credentials/whatsapp/.
4. People (including you) message that account, and the agent replies and acts.

The docs recommend a separate WhatsApp number for the agent, while noting that personal-number and self-chat setups “are fully supported.” Who can talk to the agent is controlled by a dmPolicy setting:

dmPolicy	What it does
pairing (default)	Unknown senders request access and you approve them
allowlist	Only numbers you list can message the agent
open	Anyone can message it (requires an explicit wildcard)
disabled	No direct messages

In groups, the agent replies only when it is mentioned, by default.

OpenClaw’s security record in 2026

OpenClaw’s own README tells users to “treat inbound messages as untrusted input.” That advice exists because of what happened this year:

• A one-click takeover bug. CVE-2026-25253 let a malicious link steal the gateway token and run code, even on a gateway listening only locally. It was rated 8.8 out of 10 and fixed in version 2026.1.29 on January 30, 2026 (Wiz).
• A steady flow of advisories. The repository lists more than 700 published security advisories as of November 2026, including several specific to WhatsApp, such as a reaction action that bypassed the allowFrom restriction (GitHub).
• Exposed instances. SecurityScorecard counted 40,214 OpenClaw instances reachable from the internet on February 9, 2026, and flagged about a third of them as vulnerable (SecurityScorecard).
• Malicious skills. Koi Security audited the ClawHub skills marketplace and found 341 malicious skills out of 2,857, most from one campaign that installed password-stealing malware on Macs (Koi Security). OpenClaw responded by having VirusTotal scan every skill, while noting “this is not a silver bullet.”

Security teams have been blunt. Cisco called personal agents like OpenClaw “an absolute nightmare” from a security perspective and named WhatsApp and iMessage as attack surfaces (Cisco). Palo Alto Networks pointed to the combination of private data, untrusted content and the ability to send messages out (Palo Alto Networks). Gartner titled its analysis “OpenClaw Agentic Productivity Comes With Unacceptable Cybersecurity Risk,” and China’s national CERT warned about weak default security settings (The Register).

Why WhatsApp makes this worse: your WhatsApp is full of messages from other people. Every one of them is text the agent may read, and text is exactly how prompt injection works. An agent that can read a message, browse the web and run commands can be talked into doing something you never asked for.

What WhatsApp’s rules say

WhatsApp’s help center says that “using these apps or linking your WhatsApp account to unofficial versions of WhatsApp violates our Terms of Service,” and that accounts “might also be temporarily or permanently banned” (WhatsApp Help Center). OpenClaw’s WhatsApp docs do not mention this.

To be fair, this applies to every tool that reaches personal WhatsApp chats through a linked device, including open-source MCP servers and hosted services like ConnectChats, because Meta offers no official API for personal accounts. WhatsApp is testing an official way to chat with third-party agents, and its help center now says that connecting an agent through that supported feature “is different from using an unofficial WhatsApp app.” It is limited to a few users for now.

If you run OpenClaw with WhatsApp: a safer setup

If you decide the agent is worth it, these steps reduce the damage a mistake or an attack can do:

1. Use a separate WhatsApp number for the agent, as the docs recommend. Your personal account and its contacts stay out of it, and a ban would not hit your main number.
2. Keep dmPolicy on pairing or allowlist. Never open.
3. Update constantly. With this many advisories, an old version is a known-vulnerable version.
4. Never expose the gateway to the internet. Keep it on localhost or behind a VPN.
5. Run it isolated. A virtual machine or container with sandboxing turned on, and throwaway credentials rather than your real email, cloud or bank logins.
6. Install as few skills as possible, and read what each one does before installing it.
7. Keep it out of groups, or at least keep mention-only replies on.

Safer options, depending on what you want

You want AI help with your chats, not an agent on your computer. Most people who search for OpenClaw with WhatsApp want to catch up on groups, find messages and answer faster. That does not need shell access. ConnectChats is built for exactly that and nothing more:

• It exposes seven tools to your AI app (list, read, search and summarize chats, draft and send replies) and cannot run commands, browse or install anything.
• You choose which chats the AI can see.
• Replies are drafts you approve, unless you turn on auto-send for a specific chat.
• It is hosted, so there is no gateway on your machine to expose, and stored messages are encrypted with a key that only your passkey can unlock.

You use it from ChatGPT, Claude, Grok, Cursor or other AI apps you already have: WhatsApp to ChatGPT, WhatsApp to Claude. OpenClaw is on our list of coming AI apps, so later you will be able to give OpenClaw this same narrow access instead of a full WhatsApp session (OpenClaw page).

You want everything to stay local. An open-source WhatsApp MCP server runs on your computer and connects to Claude Desktop or Cursor, without an agent’s browser and shell tools. It still holds your WhatsApp session and still faces prompt injection; see our comparison with open-source WhatsApp MCP servers.

You only want quick help inside WhatsApp. Meta AI is built in and sees only what you send or tag it in. See Meta AI in WhatsApp vs ChatGPT.

For the full list of options, read the best ways to use AI with WhatsApp in 2026.

FAQ

Is OpenClaw safe to use with WhatsApp?

It can be run more safely, but it is not low risk. Security firms and national CERTs have warned about it throughout 2026. If you use it, use a separate number, keep access restricted, run it isolated and update often.

Can WhatsApp ban my account for using OpenClaw?

WhatsApp’s help center says linking your account to unofficial apps violates its terms and can lead to a temporary or permanent ban. OpenClaw connects through an unofficial library, so the risk applies. A separate number for the agent limits the impact.

Does OpenClaw need its own WhatsApp number?

No, but its documentation recommends one. Personal-number and self-chat setups are supported.

What happened to Clawdbot and Moltbot?

They are earlier names of the same project. It was renamed Moltbot and then OpenClaw in late January 2026.

Can OpenClaw summarize my WhatsApp groups?

An agent connected to your number can work with the messages that reach it, but it is a general agent, not a chat tool. If summaries and search across your groups are the goal, a dedicated connection such as ConnectChats for WhatsApp does that with far less access to your computer.