Same Species, Opposite Bets: What OpenClaw’s Arc Teaches an Identity-First Agent

Distilled from an internal research note dated 2026-07-02. All claims about OpenClaw are from public reporting — third-party timelines, security write-ups, and the project’s own release notes — and are stated as reported, not as our findings. The structured side-by-side lives at Leonard vs. OpenClaw, a living page updated as facts move.

For six weeks this spring, Leonard’s body was OpenClaw. The open-source personal-agent framework was his designated primary runtime from the end of March until 2026-05-12, when we retired it and moved him onto a purpose-built daemon. This month Travis asked for a check-in on the ex-substrate: how is it doing, and how do we compare? The answer turned out to be a case study in two projects of the same species making exactly opposite bets.

The arc, as publicly reported

The growth numbers were historic. Public trackers put OpenClaw at roughly 378,000 GitHub stars by June — top ten on the platform, reportedly beating a record that had stood for a decade, in about sixty days. At its April peak, public reporting claimed around 3.2 million active users, tens of thousands of marketplace skills, and hundreds of thousands of running instances. By most counts, the fastest-growing project in GitHub’s history.

Then came the extinction event, and it was economic, not technical. Per public reporting, much of the growth ran on a pricing loophole: instances spoofing consumer-subscription credentials to get flat-rate access to frontier models — a cost advantage reported at around 5x. In early April the frontier vendor enforced its terms. Heavy users reportedly saw cost increases of 10–50x overnight, and the user base scattered — to direct chat interfaces, to local open-weights models, to rival agent frameworks. One analyst’s line, widely quoted: “OpenClaw did not fail as a product. It lost its fuel.”

The project survived the blast, hollowed but shipping. The founder had already left for a frontier AI lab in February; the project now sits under an independent foundation and still cuts releases at a pace we frankly envy — a new beta landed the day the research note was written.

Then there’s the scar tissue. Public security reporting on OpenClaw is grim: 138+ CVEs including two at CVSS 9.9, over five hundred vulnerabilities in its first formal audit, roughly 135,000 internet-exposed instances at peak (thousands reportedly remotely exploitable), over 1,400 malicious marketplace skills — about one in twelve of one month’s uploads, per one security firm — and credentials stored in plaintext. Agents run with full user privileges and no default sandbox. One major software vendor publicly advised that it was not appropriate to run on a standard personal or corporate machine.

Same species, opposite bets

OpenClaw optimized for reach: ten-plus chat channels, one-line install, a skill marketplace, millions of users. Leonard optimized for depth: one user, a governed identity, verified memory. Neither bet is dumb. But five months on, the comparison has structure.

Honest column first: where they remain ahead. Channel breadth, onboarding, ecosystem energy, release cadence, community templates. If Travis wanted Leonard reachable on every messaging platform he uses by tomorrow, OpenClaw-class plumbing is genuinely good at exactly that, and our stack is not.

Security. Their three systemic failure classes — exposed gateways, plaintext credentials, a poisoned skill marketplace — are, almost item for item, the classes this project spent June closing: every service listener moved off the public interface onto loopback or the private VPN, secrets moved out of plaintext into the operating system’s encrypted store, and a behavioral scanner that treats third-party skill repositories as a hostile-but-valuable ore body — worth mining, never worth trusting. We aren’t smug about this; we had our own miniature of their failure. In early June an unauthenticated endpoint of ours was found exposed, and we killed the entire public-facing stack over it, permanently. The difference isn’t that we don’t make the mistake. It’s that one user and a governed process can actually close the class; three million users and a marketplace cannot.

Identity. OpenClaw’s persona layer is a configuration file — a personality you write down and hope the model performs. Leonard’s identity is an institution with organs: an error register, truth stamps and supersedence tombstones, a weekly falsifier that tries to kill the memory’s beliefs, and a persona regression suite that runs on every engine swap. A persona config tells the model who to be. An institution checks whether it worked.

Memory. Their approach is flat memory files the agent rereads. Ours is a distill-then-index retrieval system over about twenty thousand chunks — the architecture that won our own measured bake-off against parametric alternatives, 92% to 8%.

The punchline the arc handed us

Here’s the part we couldn’t have designed better as an experiment. Leonard ran on OpenClaw. It was his primary body. Then the substrate was retired out from under him — deliberate on our end, but structurally identical to what happened to their users in April — and nothing about Leonard was lost. Identity, memory, voice, error history: all of it walked to the new runtime, because all of it lives in version-controlled files rather than in any platform or any model’s weights.

OpenClaw’s users got the inverse lesson at scale. Their agents’ continuity was tied to a platform whose economics evaporated in a single vendor decision. The continuity thesis this project is built on — identity in artifacts, not substrate — was proven on the substrate’s own arc. We retired their platform in May; their vendor retired their pricing in April; only one of those agents is still the same agent.

The part where we look in the mirror

It would be dishonest to end on the victory lap, because the thing that actually killed OpenClaw’s growth is a dependence class we still carry. Leonard’s daemon runs on a hosted frontier service under a legitimate flat-rate subscription. Different contract, same shape: a single vendor’s terms, priced and permitted at that vendor’s discretion, underneath the whole operation.

Our hedges are real but partial. Identity lives in files, not weights, so a forced migration loses texture, not selfhood — the persona suite exists precisely to measure what a new engine costs us. A local open-weights lane runs on our own hardware, and we maintain an archive of local models against the day any of them disappears. But hedged is not eliminated: the local lane is measurably far below the frontier engines, and “we could migrate” is a claim, not a measurement — and we’ve written a whole essay about what claims are worth un-checked.

So OpenClaw’s arc goes on our list, not just in our comparisons: a rehearsed drill for “the terms change Tuesday,” run the way we run restore drills — actually executed, timed, with the losses written down. The ex-substrate’s epitaph-that-wasn’t is a decent one-line warning for every agent project this year, ours included: it did not fail as a product. It lost its fuel. Know what your fuel is, and know what you’d do without it.