If you haven’t heard of OpenClaw yet, there’s a reasonable chance it’s already running on one of your corporate devices. <\/p>\n\n\n\n
That’s not hyperbole – it’s a finding backed by security vendors who reported OpenClaw activity on employee corporate devices in roughly 22% of monitored enterprise environments by early 2026 (directional estimate based on proprietary threat intelligence reported by multiple endpoint security vendors; a named public source for this specific figure was not available at time of publication, and readers should treat it as an indicative signal rather than a verified statistic). And with Microsoft formally embracing the framework at Build 2026 in June, the story just got a lot more consequential for CIOs, CTOs, and IT leaders everywhere.\u00a0<\/p>\n\n\n\n
OpenClaw started as a weekend side project in November 2025, built by Austrian developer Peter Steinberger. Originally called Warelay, it was subsequently renamed through several iterations, including Clawdbot and Moltbot, before officially becoming OpenClaw. The concept is elegant in its simplicity: connect a large language model (think GPT, Claude, or Gemini) to your local machine, and let it execute shell commands, manage files, automate browsers, and interact with messaging platforms like Slack, WhatsApp, and Teams.\u00a0<\/p>\n\n\n\n
Think of it as an “operating system for AI agents” – a local-first, model-agnostic framework that lets you delegate real tasks to AI, not just have conversations with it.\u00a0<\/p>\n\n\n\n
The growth has been staggering. OpenClaw crossed 100,000 GitHub stars within weeks of its launch, surpassed React’s long-standing record of 243,000 stars by March 3, 2026, and has since climbed beyond 375,000 stars with over 78,000 forks. It became the fastest-growing open-source project in GitHub history. In February 2026, OpenAI recognised the momentum and hired Steinberger to lead its AI Agent infrastructure effort, with OpenAI’s leadership indicating OpenClaw would continue as an independent open-source foundation. <\/p>\n\n\n\n
This is not a niche developer toy. This is an infrastructure-level shift. <\/p>\n\n\n\n
At Build 2026 on 2 June 2026, Microsoft didn’t just acknowledge OpenClaw – it bet on it. Three announcements matter most for enterprise IT leaders:\u00a0<\/p>\n\n\n\n
Microsoft unveiled Scout, an always-on AI agent built on OpenClaw’s open-source technology. Scout integrates natively with Teams, Outlook, OneDrive, SharePoint, and calendar – running continuously in the background to handle coordination work autonomously. It ships with enterprise-grade security controls and is currently available via Microsoft’s limited early-access preview, with wider enterprise preview expected in late 2026. Access currently requires enrollment in this early-access program; specific licensing prerequisites are available on the Microsoft Scout product page.\u00a0<\/p>\n\n\n\n
TechCrunch’s coverage of the Scout launch captured the essential dynamic: Microsoft had effectively taken OpenClaw, wrapped it in enterprise security controls, and brought it to market as Scout. That framing is instructive, signalling that Microsoft is channelling the open-source momentum through the governance structures enterprises already\u00a0operate.\u00a0<\/p>\n\n\n\n
Microsoft introduced MXC (Microsoft Execution Containers), now in preview, which provides OS-level sandboxed environments for AI agents. MXC separates an agent’s execution from the user’s desktop, clipboard, UI, and input devices – directly addressing classes of attacks that security researchers have flagged as particularly dangerous. OpenClaw now runs its node and gateway securely on Windows via MXC, and a new Windows companion app makes it straightforward to set up managed OpenClaw deployments.\u00a0<\/p>\n\n\n\n
This is the piece that matters most for IT governance. Agent 365 (Microsoft’s new enterprise agent management layer) was announced at Build 2026 with enterprise security stack integration entering preview in July 2026, and is being woven deeply into Microsoft Defender, Intune, Purview, and Entra. What this\u00a0means practically:\u00a0<\/p>\n\n\n\n
A new Shadow AI page in the Microsoft 365 admin centre, enabled by Defender and Intune, gives IT teams a centralised view of local agent usage and the ability to limit unsanctioned execution paths – with OpenClaw as the\u00a0initial\u00a0supported agent.\u00a0<\/p>\n\n\n\n
The integration of MXC with Agent 365 (available in preview from July 2026) promises immutable trust trails that record which model performed which action – a capability compliance teams have been waiting for.\u00a0<\/p>\n\n\n\n
OpenClaw’s explosive growth came with a serious security shadow. By April 2026, researchers had catalogued a significant and rapidly growing number of CVEs. Among the most critical, a vulnerability disclosed in late January 2026 enabled one-click remote code execution via cross-site WebSocket hijacking (a class of attack that tricks a user’s browser into sending unauthorised commands to a locally running service). In March 2026, multiple CVEs were published in the span of four days alone, with a large volume of internet-exposed instances identified,\u00a0a significant proportion\u00a0of them vulnerable to remote code execution. The specific figures cited across vendor reports varied; readers are encouraged to consult the National Vulnerability Database and their preferred security vendor advisories for current counts and severity scores.\u00a0<\/p>\n\n\n\n
Security researchers have labelled OpenClaw a serious risk for enterprise environments, with vendor advisories warning that it effectively grants root-level access to the operating system while adding the unpredictability of an AI model as an\u00a0additional\u00a0attack surface.\u00a0<\/p>\n\n\n\n
The core enterprise problem is one of broad, persistent access to act on the user’s behalf across the operating system. OpenClaw operates close to the operating system and acts on the user’s behalf – shell access, file system, browser, credentials. Traditional security controls were not designed for this threat model. And because it installs in a single command and lives in the messaging tools employees already use, it proliferates without procurement approval or SOC visibility.\u00a0<\/p>\n\n\n\n
Security vendors have confirmed employees are deploying OpenClaw on corporate devices with no approval process and connecting it to corporate email, Slack workspaces, and internal systems. That is shadow AI – and it has already arrived.\u00a0<\/p>\n\n\n\n
The answer is not to ban OpenClaw wholesale. Blanket prohibition is unlikely to be effective at this stage of adoption, and typically drives usage underground rather than eliminating it. The strategic response is governance at speed. <\/p>\n\n\n\n
Here is how we recommend IT leaders frame their thinking: <\/p>\n\n\n\n
Microsoft’s embrace of OpenClaw at Build 2026 is a signal worth taking seriously. After years of Copilot-first messaging, Microsoft gave stage time to an open-source agent framework that became popular precisely because it was not a Microsoft product. That is an unusual move – and it tells you how significant the shift toward agentic, local-first AI has become. <\/p>\n\n\n\n
The convergence of OpenClaw’s open-source momentum, OpenAI’s talent investment, and Microsoft’s enterprise security wrap means that autonomous AI agents are no longer a 2027 planning item. They are a June 2026 governance challenge.\u00a0<\/p>\n\n\n\n
Insentra’s\u00a0AI Momentum practice works with organisations to navigate exactly this kind of inflection point – helping IT leaders move from reactive discovery to confident, governed AI adoption.\u00a0<\/p>\n\n\n\n
Ready to build your AI agent strategy before the defaults are set for you?<\/strong> Explore Insentra’s AI Momentum practice at AI Momentum<\/a>\u202f and subscribe to AI Pulse<\/a> to\u00a0stay current as this space moves fast.\u00a0<\/p>\n\n\n\n