OpenClaw, the open-source AI agent that runs entirely on your own computer, launched native apps for Android and iOS on June 29. The app does not run the AI itself. It connects to a private gateway you set up on a Mac, PC, or Linux machine, turning your phone into a secure remote for everything that gateway can do.
That design decision is worth sitting with. Most people's instinct, when they hear "AI agent on my phone," is to imagine a smarter chatbot installed locally - the model living in the device, like a calculator. OpenClaw does the opposite, and the distinction matters more than it might seem.
What the gateway model actually means
OpenClaw uses a "local-first" architecture split between a central Gateway and connected mobile nodes. The newly released application functions essentially as a remote control: the AI's core computational brain resides externally on a user's local computer, cloud server, or private daemon.
This is not a workaround. It's a principled choice. The release marks a major shift for the project, allowing users to interact directly with their self-hosted software through a dedicated interface rather than relying on third-party messaging workarounds like Telegram, WhatsApp, or Slack. Before the apps existed, the standard approach was to pipe OpenClaw through a messaging platform you already had installed - which worked, but meant your control surface was wherever your Telegram notifications happened to land.
Once connected via a QR code pairing, you can chat with OpenClaw directly or switch to Talk mode for real-time voice conversations. You can also share text, links, and media straight from your phone into OpenClaw, and selectively enable device features such as your camera, screen, location, photos, contacts, calendar, and reminders. Push notifications keep you updated on workflow status even when the app sits in the background.
The permission model is worth noticing. Every action the agent wants to take on your gateway requires your approval first. That is a direct response to one of the most persistent criticisms leveled at OpenClaw since it went viral in early 2026 - that broad autonomous permissions and exposed gateways created serious security risk. Over 21,000 OpenClaw instances were found exposed directly on the public internet as of January 2026, leaking API keys and private chat history. Explicit mobile approvals don't fix every surface, but they put a human checkpoint back in the loop for the actions that matter.
Initial reviews gave the Android app a 2.2 star rating, with many reports of bugs, inability to pair, and general instability. The iOS app collected no user data per its App Store listing and looked noticeably more polished. That gap will close, but it's worth knowing before you demo this to a team.
The open-source context this sits inside
OpenClaw is a free and open-source autonomous AI agent that can execute tasks via large language models, using messaging platforms as its main user interface. It was first published in November 2025 under the name Warelay.
The project hit 9,000 GitHub stars in its first 24 hours, and eventually surpassed 214,000 stars by February 2026 - faster growth than Docker, Kubernetes, or React ever saw.
On February 14, 2026, creator Peter Steinberger announced he would be joining OpenAI, and that a non-profit foundation named OpenClaw Foundation would be established to provide future stewardship of the project.
The apps were published by the OpenClaw Foundation, with OpenAI now providing support following its hiring of Steinberger, who stressed the project would remain "open and independent."
The foundation model matters for enterprise teams evaluating this seriously. Unlike a hosted SaaS agent tool that disappears or pivots behind a paywall, OpenClaw's open-source model has fostered a growing ecosystem of third-party tools, deployment services, and content platforms. The skills registry - community-built extensions that tell the agent how to interact with external services - currently lists more than 5,400 entries. Unlike stateless chatbots, OpenClaw maintains persistent memory across sessions using a combination of markdown files and SQLite. Your agent remembers your preferences, past tasks, and working context.
For engineering teams specifically,
the openclaw-code-agent plugin runs Claude Code, Codex, and OpenCode as managed background coding sessions from OpenClaw chat. It adds plan approval, session lifecycle, wake routing, worktree isolation, and merge/PR follow-through on top of the agent backends.
The mobile app now closes the loop: you can kick off a coding session from your desk, leave the building, and approve or cancel the PR from your phone when the agent surfaces it.
What's still genuinely hard
The security picture is not resolved just because approvals now happen on a phone. Community skills carry real security risks. Malicious skills have been submitted to ClawHub in the past, designed to exfiltrate data or escalate permissions silently. Always review the source code before installing any skill.
An agent stuck in a loop can burn through API costs overnight - this has happened to real users.
If an agent incorrectly concludes "API X always returns errors with parameter Y," it will avoid that call path forever, never collecting evidence to overturn the false belief. Over-generalization is the sibling risk: a lesson learned in one context applied blindly in another. Quality gates - confidence scores, contradiction checking against other memories, periodic expiration - are necessary but still underdeveloped.
The mobile interface makes OpenClaw more accessible to people who aren't comfortable living in a terminal. That's good for adoption. But it also makes it easier to grant the agent broad device permissions - camera, contacts, calendar - without fully understanding what a skills-based agent can do with them once it has that access. The ease of the QR code pairing flow is a design success; the question is whether the approval UX will hold up when workflows get longer and approvals more frequent.
The biggest enterprise risk is not that agents cannot write code or take actions. It is that they write too much code, or take too many actions, inside the wrong permission boundary. A phone in your pocket showing you a push notification saying "merge this PR?" is a narrow aperture to evaluate that risk through.
Teams already using Slack or Teams as their primary communication layer - which is most teams - have a natural advantage here. Rather than relying on push notifications from a mobile app to catch agent activity, routing OpenClaw's output through a channel where the whole team can see what the agent did, comment on it, and escalate is a more durable oversight model. A tool like Beagle can sit in that channel and help surface the agent's decisions to the right people at the right time, without requiring everyone to manage their own gateway pairing setup.
The mobile launch is a real milestone. The architecture is sound. The security work is ongoing - and that's an honest description, not a criticism, of a fast-moving open-source project that just moved out of your terminal and into your pocket.