OpenAI opens ChatGPT subscriptions to OpenClaw's 3.2M users as Anthropic blocks ...

OpenClaw was created in November 2025 by Peter Steinberger, an Austrian developer who had previously sold a software company for $100 million and was experimenting with AI coding tools in a Madrid cafe. The first version was called Clawdbot, a play on Anthropic’s Claude with a lobster mascot. Anthropic filed a trademark complaint. Steinberger renamed it Moltbot, then, because that “never quite rolled off the tongue,” renamed it again to OpenClaw. The lobster stayed.

The product is a locally hosted AI agent that connects to large language models, Claude, GPT, DeepSeek, and others, and operates through the messaging apps people already use: WhatsApp, Telegram, Signal, Discord, Slack, iMessage, Microsoft Teams. It manages calendars, sends emails, organises files, writes code, browses the web, and executes multi-step workflows autonomously. The data stays on the user’s machine. The agent runs continuously in the background. Jensen Huang called it “ the most popular open-source project in the history of humanity ” at Nvidia’s GTC conference in March. It surpassed React’s ten-year GitHub record in 60 days.

TNW City Coworking space - Where your best work happens

A workspace designed for growth, collaboration, and endless networking opportunities in the heart of tech.

In February, Altman announced that Steinberger was joining OpenAI to “drive the generation of personal agents” and that OpenClaw would be moved to an independent foundation with OpenAI’s continued support and funding. Sequoia distributed 200 engraved Mac Minis at an AI event as OpenClaw became the infrastructure layer that venture capitalists could not own , and the signal from Silicon Valley’s most influential firms was clear: the agent layer was going to be open, and the business models would have to be built around it rather than on top of it.

The competitive dynamics are stark. Anthropic looked at OpenClaw and saw a cost problem. OpenAI looked at the same product and saw a distribution opportunity. One company locked the door. The other opened it and handed out the keys.

OpenClaw’s rapid growth has been accompanied by equally rapid security failures. In late January, a critical remote code execution vulnerability, CVE-2026-25253, was disclosed: any website a user visited could silently connect to the agent’s local server through an unvalidated WebSocket, chaining a cross-site hijack into full code execution on the user’s machine. Security researchers audited ClawHub, OpenClaw’s skills marketplace, and found 824 confirmed malicious entries out of 10,700 available skills, with 335 traced to a single coordinated attack operation. More than 30,000 OpenClaw instances were found exposed on the public internet without authentication. Moltbook, the social layer for agents, suffered a breach that exposed 1.5 million API tokens and thousands of private conversations.

The vulnerabilities have been patched in current versions. The problem is that a significant portion of the installed base is running older, unpatched versions. Anything before version 2026.1.30 remains vulnerable to at least some of the disclosed exploits, and attackers are still targeting them. OpenAI’s decision to tie its ChatGPT subscription to OpenClaw means that OpenAI’s brand, its billing system, and its user credentials are now flowing through an open-source platform that has had more security incidents in four months than most enterprise software accumulates in a decade.

Nvidia turned OpenClaw into an enterprise platform with NemoClaw , adding security hardening, compliance features, and integration with Nvidia’s inference infrastructure. Tencent launched ClawPro , an enterprise AI agent platform built on OpenClaw’s architecture and optimised for the Chinese market. Meta launched Manus AI as a desktop agent , a competing approach that runs as a native application rather than through messaging apps. The agent layer is now a battlefield where every major technology company is staking a position.

The ChatGPT subscription integration positions OpenAI at the centre of this ecosystem without requiring it to own or control the agent framework itself. OpenClaw remains open source, governed by an independent foundation, and compatible with multiple language model providers. But with Anthropic blocking access and OpenAI enabling it, the practical effect is that OpenClaw’s three million users are being funnelled toward ChatGPT as their default model. The foundation structure gives OpenAI deniability. The subscription integration gives it distribution.

This is the same logic that drove mobile carriers to subsidise smartphones: give away the hardware economics to lock in the subscription revenue. OpenAI is giving away the agent access to lock in the ChatGPT subscription. If the bet works, ChatGPT becomes not just a chatbot but the default intelligence layer for a generation of autonomous AI agents that manage people’s digital lives. If it does not work, OpenAI will have opened its most valuable product to a compute-intensive use case that burns through inference capacity without generating proportional revenue.

Get the most important tech news in your inbox each week.