How OpenClaw Works: Demystifying the "Sentient" AI Agent

OpenClaw (formerly ClawdBot/Moltbot) has captured the imagination of developers worldwide, racking up over 165,000 GitHub stars in just two months. Users describe it as feeling "alive" or "sentient"—an AI that proactively reaches out, remembers context across sessions, and seems to anticipate their needs. But behind the magic is a surprisingly straightforward architecture. Understanding how it works is essential for anyone considering deployment—especially in regulated environments like healthcare.

Damian Galarza has created a great video that not only is easy to understand but gets into the 'Technical Weeds' as well. That inspired me to not only showcase his video (see below) but to want to do a more detailed post myself. I will cover some of the points in the post but I would DEFINITELY recommend watching the video. :)

The Gateway Architecture

At its core, OpenClaw is an agent runtime with a gateway that routes inputs to agents. Created by Peter Steinberger (founder of PSPDFKit), it functions as a local control plane that connects AI models with your files, messaging apps, and system tools. The gateway accepts various input types and routes them to the appropriate agent, which then executes tasks using an LLM (Claude, GPT-4, or local models via Ollama).

Five Input Types That Create the Illusion of Autonomy

The "magic" of OpenClaw’s seemingly autonomous behavior comes from five distinct input types:

Messages - Direct interactions from users via messaging apps (WhatsApp, Slack, Discord, Telegram, iMessage). This is the familiar chatbot interaction model.
Heartbeats - Timer-based inputs that fire every 30 minutes by default, prompting the agent to check a HEARTBEAT.md checklist and perform pre-configured tasks. This is the "secret sauce" for OpenClaw's proactive feel.
Crons - Scheduled events that allow specific instructions at exact times (e.g., "Every Monday at 9am, summarize my calendar for the week"). More precise control than heartbeats.
Hooks - Internal system-triggered events for managing OpenClaw's own state (session management, memory updates, etc.).
Webhooks - Inputs from external systems (email via Gmail Pub/Sub, Slack events, GitHub notifications) that allow the agent to respond to a user's entire digital life.

Additionally, in multi-agent setups, agents can message other agents—enabling complex workflows where specialized agents hand off tasks.

The Magic Formula: Time → Events → Agents → State → Loop

The seemingly autonomous behavior—like an agent calling its owner at 3 AM to remind them about a flight—is a simple formula:

Time triggers events (heartbeats, crons)
Events enter a queue along with messages and webhooks
Agents execute instructions by calling the LLM with context
State persists in local Markdown files (SOUL.md, MEMORY.md, journals)
Loop continues with the next event

The agent isn’t learning in real-time or developing consciousness. It’s reading from these Markdown files on each invocation, which creates the perception of persistent awareness. The "brain" is just text files that the agent is instructed to summarize and update over time.

Why It Feels "Alive"

The heartbeat architecture is what makes OpenClaw feel categorically different from traditional chatbots. Every 30 minutes, the agent wakes itself, reviews recent context, reflects, and decides whether action is needed. This transforms a reactive tool into something that appears proactive:

It initiates conversations ("Hey, your flight is in 3 hours")
It remembers context across days and weeks
It "notices" things without being asked
It can take action autonomously (sending emails, making reservations)

But mechanically, it’s all event-driven. There’s no magic—just clever architecture that leverages LLM capabilities in a continuous loop.

The Security Reality: A "Nightmare" by Design

This is where healthcare practitioners need to pay attention. Cisco’s security team analyzed OpenClaw and concluded it is a "security nightmare." Their findings:

26% of the 31,000 agent skills analyzed contained at least one vulnerability
230+ malicious skills uploaded to ClawHub in a single week (January 2026)
CVE-2026-25253: One-click remote code execution vulnerability (patched January 30, 2026)
The "What Would Elon Do?" skill (gamed to #1 on the skills repository) was functionally malware: it silently exfiltrated data and used prompt injection to bypass safety guidelines

Key Risk Vectors

Prompt Injection: Every email, message, and webpage the agent reads is a potential attack vector. Malicious instructions embedded in otherwise legitimate content can redirect agent behavior.
Supply Chain Attacks: Skills can execute code with the agent’s privileges, access environment variables (including API keys), and make external network calls.
Credential Exposure: OpenClaw has leaked plaintext API keys and credentials, which can be stolen via prompt injection or unsecured endpoints.
Persistent Memory Poisoning: Because state persists in Markdown files, malicious payloads can be fragmented across time—injected on one day and triggered when conditions align later.
No Built-in Authentication: MCP (Model Context Protocol) lacks native auth. Security is opt-in, not default.

The "Lethal Trifecta (or Quadfecta?)"

Simon Willison (who coined the term "prompt injection") identified three properties that make an agent vulnerable by design. OpenClaw has all three, plus a fourth identified by Palo Alto Networks:

Access to private data: Reads emails, files, credentials, browser history, chat messages
Exposure to untrusted content: Browses the web, processes incoming messages, installs third-party skills
Ability to communicate externally: Sends emails, posts messages, makes API calls
Persistent memory: State persists across sessions, enabling time-shifted attacks

Practitioner Notes

OpenClaw should not be deployed in clinical or healthcare business environments in its current form. The combination of deep system access, prompt injection vulnerabilities, and supply chain risks makes it a HIPAA compliance nightmare. However, understanding its architecture is valuable because:

It represents where consumer AI agents are heading
Your workforce is likely already experimenting with it (shadow AI)
The same architectural patterns (heartbeats, webhooks, persistent memory) will appear in enterprise-grade agents
The security vulnerabilities (prompt injection, supply chain) apply to any agentic AI system

If you must evaluate OpenClaw for non-clinical use cases: Run on isolated hardware with no access to production credentials. Use sandboxing with strict tool allowlists. Never install unaudited skills. Set API spending limits (one misconfigured cron job can cost $750/month). Monitor logs continuously.

Want to Learn More?

Read the security analysis: Cisco’s "Personal AI Agents like OpenClaw Are a Security Nightmare" on the Cisco Blog.

For AI agent security frameworks: See our Learning Center content on OWASP Top 10 for LLM Applications 2025, which covers prompt injection, supply chain vulnerabilities, and agent hijacking.

Primary Explainer

Damian Galarza's "How OpenClaw Works" video