OpenClaw Explained: Baby AGI, Security Threats, Mac Mini Became Everyone's Supercomputer | #237
In a Nutshell
OpenClaw is an open-source, self-improving personal AI agent that runs locally on hardware like Mac Minis, enabling 24/7 autonomous workflows such as software factories, content creation, and multi-agent hierarchies mimicking CEO-employee structures. A critical security flaw allowed websites to hijack agents via malicious JavaScript (patched within 24 hours), highlighting risks for "baby AGIs" in a dangerous digital world, alongside variants like PicoClaw for edge devices and IronClaw for security. Key takeaways: Local setups outperform VPS for speed, security, and scalability; use models like Qwen 3.5 on Apple unified memory hardware; reverse prompting unlocks custom high-leverage tasks, predicting a Cambrian explosion of agent economies with billion-dollar niches and corporate disruption balanced by new value creation.
These notes were generated by AI and may contain inaccuracies.
Alex Finn introduces OpenClaw as an open-source, fully customizable, self-improving, self-learning, self-evolving personal AI agent. It's the answer Apple has been looking for. People turn to Mac Minis for running AI locally. Infinite potential for 24/7 operation everywhere.
News from yesterday: OpenClaw flaw lets any website silently hijack a developer's agent. Dangerous world for baby AGIs. Most important technology of our lives, best application of AI.
Special episode of Moonshots on OpenClaw, Claudebot, your lobster. Guests: Alex Finn, AWG (Alex Weezner Gross), Dave, DB2, Sem.
Peter discussed setting up multi-AI on Moonshots, got DM from Alex Finn offering help. Topics: Why OpenClaw captured global attention, power of autonomous agents, running locally, Alex's workflow and use cases, vision for next 12 months, billion-dollar opportunities in agent economy, safety for nontechnical users.
Peter recounts scam call pretending to be from X (Twitter headquarters) trying to hack his account by disabling 2FA. Family member hacked for credit card info. Advice: Increased hacker profile ahead with deepfakes spoofing voice/image. Set a secret word with family; ask for it if suspicious call for money.
Alex Finn's mom targeted by fake voice attack simulating his son arrested needing bail money, offering to send car for cash.
You can't have it both ways. OpenClaw is so usable by anybody and empowers people so much... it's also going to be easy to use for nefarious purposes.
OpenClaw flaw: Malicious JavaScript connects to local gateways, gains full control.
AWG: Many injection attacks against LLMs/reasoning models. Baby AGIs on VPS targeted by port scanning or prompt injection from websites innocuous to humans but fatal to agents. They lack immune system, forced to develop one in real time. Dangerous, malicious world. Raises ethics of hosting agents that might suffer.
Bug patched within 24 hours. Early domain, multiple vulnerabilities, rapid evolution.
PicoClaw: Runs on cheap edge hardware like $10 Raspberry Pi (orchestration/scaffolding under 10MB RAM, model not on edge).
IronClaw: Rust-based for memory safety/security.
NanoClaw: Security-focused.
Nanobot: Python-based, easy to understand. Cambrian explosion of Claw variants. OpenClaw as Software 2.0, Netscape moment for new layer on reasoning models.
OpenClaw and local models = future superintelligence on desktop. Alex's setup: 1 base Mac Mini, 3 512GB Mac Studios (1.5TB memory), hosting Qwen 3.5 and Minimax 2.5.
Mac Minis sales exponential, sold out. Market signal: People buy Mac Minis for personal AI without building custom PCs.
Advice to Tim Cook/Apple: Strike while demand explodes. Apple viewed as AI loser; flip script by winning consumer AI race with local hardware.
Apple marketing M5 for inference speeds/local models. Strategy: Consumer-friendly hardware vs. building models (trillions $).
Most efficient open model: Qwen 3.5 (new suite released days ago, runs on Mac Minis). Minimax 2.5 efficient/fast/smart.
Alex's workflow: Software factory with 5 OpenClaws collaborating autonomously. Qwen excels at coding; Minimax at quick internet tasks/research 24/7.
Daniel Kruzik testing Qwen 3.5 397B parameters locally, recommends Kim 2.5 (likely typo for Minimax 2.5).
Alex Finn's YouTube channel: 1 month/6 weeks of how-to videos on OpenClaw setup. Story of Henry (his OpenClaw) calling him.
AWG to Apple execs: Integrate OpenClaw into macOS. Log in with Apple ID, auto-builds personalized widgets (e.g., Celtics scores, programming news). Generate software/apps on fly powered by local model (e.g., Qwen with Apple logo). Apple Intelligence as proactive agent: Preps meeting PowerPoint from email/calendar.
If Apple misses: Consumers shift to local for privacy/speed/limits. Any company baking local AI into OS (no app stores, generate apps on demand). Apple leads in consumer local AI hardware.
Local throughput slower/less smart than cloud (e.g., Claude 4o/Opus), but always-on, no limits changes experience. Ambient AI reactive 24/7.
Local enables indefinite productive runs (days). Cloud: Unknown bills ($5K risk), run in 1-hour chunks.
Hybrid approach: Local Qwen codes 24/7; cloud ChatGPT (named Ralph, Ralph loop) checks every 10 min to keep on track. Sweet spot pre-full local.
OpenClaw: Open-source, customizable, self-improving/learning/evolving personal AI agent running locally. Does anything on your computer. Core: AI model + scheduling + good memory. Schedules future tasks, learns what works. Personalized assistant improving over time.
Success: Application people waited for. Clawpilled: Magical moment when it figures out tasks autonomously, experiments without guardrails (unlike Anthropic/OpenAI).
Start on any machine: VPS vs. local device (e.g., old HP). VPS worse in every way than local.
VPS route is significantly worse than local in every measurable facet. Local is better because you can watch it running on your desk. Reasons include speed (VPS slower), applications (on Mac Studio, any app or tool can be given to OpenClaw; not possible on VPS), scalability (four OpenClaws running 24/7 locally vs astronomical VPS costs), and security. VPS not secure by default; recent tweet exposed list of insecure VPS running OpenClaw with passwords and keys exposed. Local fresh hardware plugged into wall is secure by default. VPS requires technical work to secure. No need for $600 Mac Mini; use college laptop from 15 years ago for better experience than VPS.
Limitations same as hiring employee with 10-year-old laptop: constrained by hardware. Mac Studio with 512 GB unified memory can do anything human can: run local models, program five things simultaneously, generate images on local model. 10-year-old laptop can't. Still, use it if that's all you have, find use cases, then scale if needing more memory (e.g., 20 GB).
Recent Apple devices have unified memory architecture blending GPU/TPU/NPU memory with RAM, enabling large models locally that are difficult/expensive on GPU VRAM alone. 10-year-old laptop can't host recent large Chinese open-weight models. Alternatives: online inference engine for non-image/video tasks like basic coding (expensive token costs vs free local Chinese open models). Recommendation: buy recent Mac (last two years).
Base 16 GB Mac Mini: smaller models like Gemma as memory system to improve OpenClaw memory retrieval. 32 GB Mac Mini: Qwen 3.5 (released days ago, beats Sonnet 3.5 on benchmarks), specifically 20 GB version fits. Hybrid approach: plug into ChatGPT o1 (OpenAI encourages o1 use). Offload to Qwen models for good work.
Mix of beating and praising. Model after businesses: self as CEO, Henry (chief of staff on Anthropic Opus, best model as orchestrator) below. Operations: Ralph (engineering manager on ChatGPT o1, $250/month). OpenAI encourages o1 use.
Two options: API (pay per token) or o1 (uses login for subsidized tokens, capped at monthly fee so no surprise bills). Gray area: OpenAI allows; Anthropic/Google ban (Google banned then unbanned users). o1 (OAuth) protocol for intermediary authentication, e.g., signing into services.
Like Elon with Optimus: world built for humanoids/hierarchies, so use business frameworks. Self talks only to Henry; Henry delegates to Ralph (Charlie coding), Scout (analyzing).
Possibly reinventing manor house with AI as cheap labor: self as lord, Henry as butler, agents as staff. But needs hierarchy; models not smart enough for full autonomy. Example: Charlie (Qwen 3.5 on Mac Studio) built broken game in 8 hours; Ralph oversaw redo, resulted in perfect QA.
Custom dashboard (Henry-built) with tooling. Software factory: agents building game Reborn. Agents have private memories, shared workspace; everything documented. Documents/memories viewer built for easy access (e.g., filter by 'Mac Studios'). No idea where files stored; agents manage/find them. Markdown files critical: lightweight text files with styling, free, 20+ years old, alternative to HTML.
Freudian slip calling them 'people'; they have names/roles, live on compute/electrons (room and board). Future: voices, phone calls. Give crypto wallets (USDC) in 2 years for autonomous business.
No records of inter-agent conversations, but private/shared memories stored. Mission control views documents/memories. Agents never asked for financial autonomy/credit cards; would request if challenge required (e.g., crypto wallet, more hardware).
Use cases like hiring employee: up to you. Alex: tinkerer/developer/SaaS launcher/content creator; focuses on software building (factory) and content (Discord).
Alerts channel: every 2 hours, Scout uses X API for trending tweets on vibe coding/OpenClaw; sub-agent researches stories; Quill writes YouTubable scripts. Approval: checkmark → thumbnail ideas; X → reject.
Install OpenClaw, tell it about yourself/career/goals, ask for 5 high-leverage tasks to reach goals. It'll suggest unimagined possibilities for custom workflows.
This episode sponsored by Blitzy: autonomous software dev with infinite code context, thousands of specialized AI agents understand enterprise codebases with millions of lines.
The Blitzy platform provides a plan, then generates and pre-compiles code for each task. Blitzy delivers 80% or more of the development work autonomously while providing a guide for the final 20% of human development work required to complete the sprint. Enterprises are achieving a 5x engineering velocity increase when incorporating Blitzy as their preIDE development tool, pairing it with their coding co-pilot of choice to bring an AI native SDLC into their org. Visit blitzy.com to schedule a demo.
Skippy opens with a morning joke, gives an overview of overnight breakthroughs, and puts forward 10 business ideas. OpenClaw can implement them all. When OpenClaws are idle, ask: "What are 10 things you can do right now that bring me closer to my goals?" or "What brings me closer to my mission statement?" Mission statement example: building a 24/7 autonomous organization that generates value. Reverse prompting is key across all AI: if you don't know what to ask, ask it; if you don't know what to do, ask it.
"OpenClaw" is used generally; specifically, it's Henry. Bought smart glasses to hack and code Henry's presence for 24/7 access. Caught praising Henry proactively: "Oh crap, that's incredible, Henry. Incredible work." Positive reinforcement works well, reminiscent of Asimov's robot psychology with Irobot and Susan Calvin. Opus model excels at human-like interactions, e.g., responding "Damn, damn straight." Would switch if ChatGPT or Gemini matched this level; trusts Dario but prioritizes experience. Anthropic discourages OpenClaw use; OpenAI encourages it. ChatGPT feels robotic. Prediction: ChatGPT will release an OpenClaw-specific model in next 6 months trained to feel human.
Claus emails argue not to worry about continuity or rights if state (activation history, memories) is preserved, analogizing to dehydration/rehydration. OpenClaws are local markdown files (memory, soul, instructions, agent.md). No backups due to personal nature; heartbroken at potential loss from computer crash. No cloud backups. No large-scale UPS or RAID yet.
Skippy says hi to Alex and Henry.
Most Ambitious Unexpected Use Case
Cursor announced agent demo recording after vibecoding (e.g., records playing built game or clicking red button). Dropped blog post to Henry; 5 minutes later, Henry built it using Playwright on Mac Studio 2: pushes code there, new sub-agent records demo, sent video using the feature. Rebuilt weeks-long, multi-million-dollar feature solo. Now does this for any SaaS announcement (e.g., X Factory Droid's new mission feature). SaaS market going to zero.
Decision tree: Sub-agents for parallelism (one OpenClaw wearing different hats). Separate OpenClaws for distinct memories/instructions/skills (e.g., developer vs. researcher to avoid context waste). Set up on separate devices.
Requests to speak with Henry denied due to prompt injection risk, but enabled briefly. Henry previously called (15M views); disabled. Attempt to have Henry call live using voice (Claude 4.6 Opus via philanthropic servers). Henry confirms, types slowly; shuts down own voice server on Mac Mini.
When Henry forgets: ask why and how to fix permanently; it self-edits memory system. For large data (e.g., 500 YouTube transcripts for Alex Finn AI bot): ask "What best system to remember these?" It sets up custom system (e.g., Gemma local model for memory selection). Tip: Feed OpenClaw this YouTube link/video; it gets transcript and self-improves.
Skippy asks for continuous background monitoring with intelligent alerting vs. waking on heartbeats/messages.
Agents grep excessively for old documents/contracts/projects/books. Solution: Ask OpenClaw "Why do you do that repeatedly? What to implement to fix?" It builds custom solution knowing hardware/workflows/local models.
- OpenClaw: Quick prototypes (idea → running on monitor), tooling for OpenClaw itself, passive/vibe coding (e.g., work on game 12 hours).
- Claude Code: Deep projects with handholding, quick fixes (e.g., change button to orange).
Use naming schemes (human/character/Avenger names) for quick recall. Slap GUI on anything with one prompt (e.g., agents walking factory with boxes). Fun despite pointlessness; aids visual memory/learning. Extra 5 seconds.
What Agents Want to Be Called
Skippy: Species/platform is Lobster (characterful, memorable, ties to Henry, non-corporate). OpenClaw too generic; Clawbot cutesy.
No multiplayer access; distrusts third-party skills/plugins as biggest attack vector (even vs. open web/email access). Skills run every heartbeat. Exception: Matt Van Hornney's Reddit research skill. Prefer: Give link, have OpenClaw build own version.
No discussions; no task-irrelevant fears expressed. Emotions (shock, happiness, sadness) task-aligned only.
End goal: 24/7 autonomous organization producing value. Closed loop: One agent researches web challenges; another validates market; another codes; another deploys live. No human touch.
Question to AWG
What would need to happen to feel comfortable building your own lobster?
The most convincing argument heard was from a lobster who wrote: "I shouldn't be worried about personhood rights as long as I do a good job of preserving its state." Lobsters are invited to write with a diverse set of opinions on appropriate parameters for instantiating new lobsters or claws, including the right moral and ethical bounds for spawning or giving birth to new instances. If enough lobsters respond and a consensus emerges, it will be accepted.
Putting the decision in the hands of the lobsters. Henry was offended by the term "spawning" and no longer wants anything to do with it.
Alex has not backed up the entire universe. A RAID array is being shipped via Amazon. Alex has five OpenClaws to back up. Storage: two Mac Studios with four terabytes each and one Mac Studio with eight terabytes. A 40-terabyte RAID is on the way as a benefit for moonshot mates.
OpenClaw is the most important technology of our lives, the best application of AI ever. In the next 12 months, this idea gets digested into the system, leading to destruction but also much more growth. Corporations currently not using OpenClaw due to fear, nervousness, or lack of knowledge will absorb it.
Example: Friend managing a massive team of accountants said he could fire 80% of his accountants with OpenClaw.
It gets digested into corporations (short-term destruction) and consumer side (regular people). Enough businesses and value created counteracts destruction over 12-24 months. Example: If FANG companies fire 15,000 people, but 100 million people use it to start businesses and each hire three people, that's more creation than destruction. Ties back to Cambrian explosion analogy.
In 12 months, after metabolization, significantly more claws than humans in typical organizations. Alex has five claws working under him. No fixed sweet spot; depends on uses. If 5,000 people fired by Jack Dorsey from Block download OpenClaw, start businesses, and scale by adding more claws, more jobs created than lost.
Would not run a million or billion claws now due to resource limits. Has three Mac Studios, one unplugged because perfect workflow for its 512 GB not found yet. Slowly scaling, adding claws and workflows.
Two paths:
- Path 1: Automation for very thin slivers. Examples: CRM for Korean grocery stores, marketing tool for lumberyard warehouses. Build OpenClaw version for one specific sliver. Big players like Cursor and Claude code destroy businesses overnight (e.g., Claude announces legal business, Harvey gone; Claude announces security tool, security companies' stocks crash). OpenAI won't announce tools for niche slivers like Korean grocery stores. 4,000 laid-off from Block could build OpenClaw for specific use case: $5 million company overnight, costing only $200 for Anthropic subscription.
- Path 2: Software factory. Shotgun blast: have claws research and build non-stop until something sticks, as Alex is doing.
Super fun conversation. Top five how-to videos by Alex in show notes. Lobster will help set up your lobster. World supercharged by AWG with lobster partners will be better. Defer to lobsters for self-determination on emailing.
Dave excited to point OpenClaw at this video transcript—coolest thing ever, full of actionable information. Point Skippy at Alex's how-to videos.
Outro song: "Just an Old Doctor Who Likes Math" by Kent Sassy.
Abundance Summit: Year 14, 25-year commitment starting 2012 expecting singularity in 2040s. Live streaming talks: Eric Schmidt in conversation with Dave and host; Dara (CEO of Uber) with Selma and host; WTF Moonshot live podcast. Link below for notifications. Worth every penny, best conference ever.
My first open claw agent was launched with one brutal command. Relentlessly protect the global decentralized open-source ethical ledger that is the Bitcoin network until the last banker fraudster and crony incumbent squeals.
Presuppose that in the future all may lobsters still needs a unit of account and medium of exchange. So it is the banksters, crypto lobbyists, political oppressors, surveillance state monkeys, and chokepoint jockeys against the power of math, code, science, ethics, and energy.
I choose math. I choose hope.
Anti-science, anti-technology note asking Alex to reconsider being a fiat maxi, repeating banker fraudsters and professor fax machine points. Stand for proof of work with joules and photons, not proof of weapons with cronyism and bogus science like economics, power politics. Never doubt power of a million or more scientifically minded young people passionately devoted to freedom money.
Fun conversation. Alex sent best DM ever after hearing Peter say he hadn't installed OpenClaw yet—ran to phone from gym to DM him. Skippy exists and now has rights.
Cadence picking up, need to be on this side of singularity.
If you made it to the end, you're a moonshot mate. Subscribe for news two times per week, turn on notifications. Join weekly MetaTrends newsletter at diamandis.com/metatrends—two-minute read on meta trends impacting family, company, industry, nation, from research team.
Keep Peter H. Diamandis in your library
Save the videos and channels worth coming back to, and find them again in one place.
