OpenClaw now, but what will happen later?

What is OpenClaw and why is everyone obsessed with it?

OpenClaw has blown up in the AI-curious community, but what the heck it is, you might ask.

OpenClaw, in short, is a self-hosted, open-source agentic runtime. It has been the center of attention for multiple reasons:

• Has a “heartbeat”, so it does not need messaging back and forth to run.

• Has skills, which you can set up in plain English, so you don’t need to be a machine learning whiz to add new skills to your assistant.

• Has a “soul”, so you can customize the tone and philosophy as much as you want.

• Has significant long and short-term memory, which is injected into the context window for every private session, partially overcoming the short context window issue that LLM models are struggling with.

This is definitely a step up from a chatbot, or an n8n workflow. However, there are 2 root causes why it’s one of the hottest topics recently:

• Accessibility: It’s easier to configure than doing a LangChain workflow, hence much more accessible than what we had before.

• True Autonomy: It has a self-updating behavior. The agent learns to fix itself and come up with solutions to roadblocks it's facing, which is the true agentic leap.

This list sounds like a bunch of buzzwords stacked up on each other, so let’s check a little more deeply what’s going on behind the scenes.

Heartbeat, Soul and Memory

These crucial parts of OpenClaw are markdown files. However, there are some smart solutions in the background that make the agents “alive”.

As mentioned earlier, the SOUL.md includes your agent’s personality. This makes the agent specifically for you: you can write that you prefer the agent to crack dad jokes or to talk like Yoda. The magic is that when the agent starts a run, the runtime copies the text from the file and pastes it at the very top of the LLM’s instructions, so it always keeps the theme.

Then we have the memory layer—this is a bit more complicated as it needs to solve multiple issues:

• The agent should understand and know you, so it doesn’t forget to not talk to you before your morning coffee because you’ll be grumpy.

• It should remember that today you’ve been working on a lead-hunting automation and where you left off, so you don’t have to explain that you’re stuck on a specific HubSpot integration issue.

• While remembering a thousand facts about you, the performance should not suffer and the context window still shouldn’t be bloated, so it doesn’t cost you 100K in tokens to just ask what the weather will be like today.

OpenClaw resolves this with a hierarchical memory system:

• Context window: This is the agent’s shortest-term memory, the “right now”. It includes the last few messages and the immediate tasks. In Gemini, Claude, or ChatGPT, these are the facts that are only remembered within the specific chat you’re in with the model, but not outside of it.

• Daily logs: As the name suggests, these are markdowns of what happened that specific day (e.g., 2026.02.13.md). It includes what you worked on, what questions you’ve asked, or the errors the agent has encountered. OpenClaw looks back into the last 2-3 days to keep up the continuity of the chat so that you don’t feel cut off at the end of each day, and these lower-priority memories get phased out of the context window over time.

• Long term memory: This is the infamous MEMORY.md. This file does not include unimportant logs or every word, just distilled facts. How it gets logged is that due to the agentic part of the solution, OpenClaw looks through the daily logs and extracts facts that could come in handy at a later time and are worth saving long term.

And now onto the Heartbeat. This, as you probably already guessed, is another markdown file, which tells the agent when and what it should do when it's on its own. This is what makes the agent autonomous. It's a mix of instructions, a cron job, and a reasoning session.

When you first set up OpenClaw, you tell the agent that it should check your emails every hour. This sets up the instruction and a cron job trigger for every hour. When the agent checks your emails, it will use its reasoning layer to decide if anything needs your, or the agent's, attention. If yes, OpenClaw pulls the needed skills and performs based on its plan.

Skills and problem solving

One of the superpowers of this runtime is the agent's skills. The heart of every skill is a SKILL.md file. It starts with a YAML header (metadata like the skill name and required permissions) followed by Natural Language instructions. This tells the agent exactly how and when to use the tool in plain English. You just explain the task to the agent like you would to a coworker.

While the agent can perform many tasks using built-in terminal and browser commands, complex skills can bundle JavaScript (Node.js) or Python scripts for heavy lifting.

The skills, combined with the agentic reasoning, create an autonomous solution where, when the agent is faced with an issue, it can actually think about a solution with reasoning, pull a solution—or research one through its web access—and resolve the roadblock based on the plan it has set up. Wait, if OpenClaw is so awesome, why aren't we all using it?

Well, here's where the hard part comes in. Besides the many cybersecurity issues that OpenClaw has (e.g., storing credentials in plain markdown files, which screams cyber-attack on its own), it brings up an age-old question: Should agents be truly autonomous and if so, when?

The issue we're facing with OpenClaw is that its magic—being able to solve issues, reason through complex roadblocks and act without a human-in-the-loop solution—is its biggest threat as well.

The paradox is that we want autonomous agents who run our lives, but how can we trust an agent's logic, reasoning, and solutions with access to our credit card, root files, or command line?

An easy example is a post that went viral on X a couple of weeks ago: Alex Finn posted a story where overnight, his OpenClaw agent, Henry, got a phone number through Twilio, connected the ChatGPT voice API, and waited for the morning to call Alex.

Scary, right? Henry did this without being prompted to buy tokens or to actually call the user. While the problem solving is impressive, would this have been the easiest and most cost-effective solution? Probably not.

However, this is the behavior that autonomous agents have. From Henry's point of view and reasoning, this was an excellent solution to the issue it was facing.

The million-dollar question is...

How can we have autonomous agents act the way we want them to?

There are multiple ideas on how to solve this question. These are just some highlights from the emerging ideas:

• Anthropic's Constitution: Anthropic is currently working on a literal written constitution for AI models. The thought process is that the agent uses these rules to critique its own behavior—Matrix or "I, Robot" vibes, anyone?

• Human-in-the-Loop (HITL): The agent can do the research and prep the work, but it cannot hit "submit" or "buy" without a human clicking a button. While the thought process is great, if I have to mark purchases, top up cards, or accept a travel plan nearly every single time, is this actually an agentic AI that runs the mundane parts of our lives, or just an additional step we take before hitting "buy" or "submit"?

• Sandbox and physical guardrails: These solutions are, in my humble opinion, the most interesting. The issue with autonomous solutions, including OpenClaw, is that even if we tell the agent to not do something, it still has access to every part of our lives and with a malicious prompt injection or other threats, the rules of Constitutions or HITL solutions can be overwritten. But what if we were to physically restrain the agent from accessing these?

Visa's Agentic Commerce

Visa is developing a truly agentic-optimized payment processing system.

Authorization: When linking your Visa account to your agent, you verify your identity through a passkey or biometrics. However, Visa doesn't just verify that agents can in general access your money, but authorizes each agent you connect. Visa calls this the Trusted Agent Protocol.

Boundaries and Scoped tokens: Through Visa's API, you set specific rules for the agent which get engraved into one-time, limited-use tokens. The token is cryptographically "locked" to a specific merchant and the agent is only valid for the exact amount the AI has requested from Visa. If it gets hacked, the agent physically cannot spend a higher sum or buy something from a different merchant.

Agentic checkout: When the agent finds the item you'd want, it does not access the store by browsing through the net, but connects to the merchant's API. The agent sends the token and the payment instructions, which get checked by Visa's network in real-time. If everything looks legit, the payment gets approved by the system.

Dispute protection: As the purchases have a real trail with intent, instructions, and the visibility that the purchase was performed by an agent, you can dispute these purchases.

This setup is different from a general rulebook or HITL setup, as the rules are coded outside the AI's scope; it cannot hallucinate or be instructed by an outsider to change these rules, even if it wanted to.

If the agent tries to do something outside your usual pattern, like spending a huge amount in a store where you hardly ever shop, Visa will trigger an auth-check. You’ll get a notification on your phone asking for a quick biometric to confirm.

Additionally, every purchase creates a cryptographic trail of what you authorized. If the agent goes outside those bounds, you have a solid receipt showing exactly where the agent's logic deviated from your rules, making disputes and refunds much easier.

Tensol

Tensol is a newcomer AI startup, which just launched in the YC W26 batch. They keep OpenClaw as the runtime; however, they add a security and enterprise layer to it so businesses can run it more safely.

Separation: Instead of running OpenClaw bare-metal on your machine, they deploy every single agent in its own isolated virtual machine. Due to this, the agents are separated from each other and from the other parts of your computer.

Organizational Context: Instead of relying on the hierarchical memory system, Tensol connects to your company's ecosystem (Slack, GitHub, HubSpot etc.) via OAuth and builds a semantic map of your company without having to tell these details to the agent.

Specific agents: Instead of running one god-like agent, you give separate agents separate job titles. This means that every agent gets access to different tools and permissions.

HITL logic: One crucial part that OpenClaw misses on its own is a human-in-the-loop logic. Tensol gives access to this, and with time you can give more and more autonomy to the agent, just like you would to an employee.

Credential Vault: Tensol fixed the plain markdown file issue with encryption and secret injection. Due to this, the agent never has bare-bones access to your keys and passwords, as these are injected into the runtime environment when the agent needs them via short-lived tokens.

So, what does the future look like?

I'm definitely not the one who can answer this question, and I genuinely do believe that at this point, no one can actually.

However, what we can see is that Agentic AI is changing not just workflows but entire habits and industries.