We started using OpenClaw a few months ago to explore . At the beginning of the year OpenClaw represented the cutting edge on this front. It answers the question of what happens when you just give AIs full access. The answer is a lot of interesting, positive things. And possibly a few really bad things as well. The name is appropriate because it is a tool with some sharp, pointy edges that can and will draw blood when used in anger.
This article is mostly about how we set it up and why it sucks. And it has a happy ending because better tools are becoming available!
How We Set It Up
One of the first things we did, after experimenting with Slack and WhatsApp, was to set up Matrix.
Matrix is an open-source alternative to Slack, but the more important difference is that it gives you much richer access. Slack is heavily locked down. Adding bots means stepping through a ridiculous permission maze, and a lot of it is manual. Every time you want to add or adjust something, Slack reminds you who is in control.
Matrix is a lot more open. If you run your own setup, you can give an agent full admin access and let it do real work. So that is what we did.
We gave OpenClaw full admin access to our Matrix setup.
OpenClaw has a concept of agents. Each agent gets its own work directory, its own files, its own , its own tools, and its own agentic loop. That part is good. It gives you a workable mental model for creating specialised actors instead of one giant general-purpose assistant trying to do everything.
The first agent we created was called ClawdAdminime.
Its job is to administer our OpenClaw setup. It can create Matrix rooms, create Matrix bot users, invite people into rooms, and set up the OpenClaw Matrix bot user connection for each new agent. That means I can prompt it with something like “create an agent called X” and it will go off and provision the room, invite the relevant people, and leave the bot ready to respond.
That is genuinely useful.
It compresses a bunch of annoying setup steps into one request. It also shows what these systems are supposed to become: operational layers that take care of recurring admin work, not just chat toys that sit on the side of your workflow looking clever.
Why OpenClaw Sucks
It self-destructs on a regular basis. It’s a fast-moving project with lots of updates. OpenClaw ships frequent updates and releases. That sounds good until you realise that almost every release seems to break something. Configuration changes, new features, an extra permission that is missing, etc.
All the channels I have tried are a bit wonky and flaky in different ways. With the WhatsApp integration, you basically end up having a schizophrenic chat with yourself because OpenClaw posts its replies as you. Yes, you can work around that with multiple phone numbers.
Slack is bad for a different reason. The product itself is fine for people chatting, but it is a complete pain to integrate with. You end up having to micro-manage a huge list of scopes and access rules. And you have to do this manually in a UI that is barely fit for purpose. It seems Slack has lost the plot when it comes to agentic AIs.
This is the main reason we switched to Matrix. Matrix is great. Everything we liked about Slack but without the limitations, cost, etc. The OpenClaw integration with Matrix unfortunately is a bit flaky. It works great, for a while. And then it will stop responding and you have to debug why.
If you leave OpenClaw alone for a few days, there is a decent chance it will stop working.
Fighting AI flakiness with more AI
I used to fix these things manually, but I gave up on doing that. It’s just too much. These days I let Codex deal with figuring out how to fix things. It will dutifully dig through logs, issue trackers, etc., and it will do an accelerated version of “bang on it until it works again” that you would otherwise have to do manually. I’ve actually set up a Codex automation to do this on a schedule now. It checks in on our OpenClaw server every morning and kicks it back into shape again.
But of course this flakiness is a show-stopper issue. First, even if you do know how to fix things, it is still annoying to have to do it. And most business users would of course get stuck on the first issue. You can’t organize your life around something this poorly engineered.
OpenClaw is slow.
OpenClaw is not just flaky. It is also very slow. Slow to wake up. Slow to construct a context and eventually call a model. And then slow to funnel the answer back to you. It’s completely unlike chatting to a person. Every interaction takes at least a few tens of seconds. And you can’t really interrupt it. This is called steering in Codex, and it’s super useful. You can’t do this with OpenClaw.
Slow systems train people not to use them; they’ll prompt and then go do something else. It breaks their flow. One reason ChatGPT got so popular is because it feels like you are chatting to a person. It starts responding right away. A slow AI agent is a lot less fun to talk to.
All this is the consequence of OpenClaw just being a huge spaghetti ball of JavaScript that just keeps absorbing more features, more layers, etc. It seems the contributors are mostly amateurs doing whatever without much architectural discipline.
At least, that is my read as a backend engineer anyway. Everything about this feels deeply wrong at an architectural and conceptual level.
It is a big monolith. It has too much built in that should probably live outside it. Channels are an obvious example. Model configuration and connectors are another one. There is too much tightly coupled product inside one pile, which means every change has more surface area to disturb something else. It’s not surprising it is flaky, slow, and insecure.
The Security Story Is Bad
If you add all of this up, the security story is not good.
In fact, I would go further than that. It is hopelessly insecure in the sense that I do not think this gets fixed with a few patches, a few best practices, or one more round of hardening work. It would need a serious rethink by people who actually understand how to design this kind of system properly.
You are talking about a slow-moving monolith with a lot of built-in capability, lots of connectors, lots of channels, lots of moving parts, and a design that already feels wrong before you even get to the security review.
That is not where you want to start if you care about enterprise-grade data handling, auditability, or compliance.
Could you use it anyway in a smaller context, with limited exposure, to learn things quickly? Sure.
Would I want to defend it in front of a responsible CIO, security lead, or compliance team at a large company? Absolutely not.
So Why Use OpenClaw At All?
Because it got a few important things right.
If you want to work with agentic workflows in teams, OpenClaw is or at least was one of the easier systems to get running in a form that feels real. It gives you agents, files, tools, skills, channels, and loops in one place. That makes it easier to see the shape of what multi-agent team workflows can become.
Most AI tools are still single-user. But with OpenClaw, connecting it to team chat tools is a thing. Even if it is wonky and less than perfect, it is actually nice to be able to involve multiple people. And of course a lot of real-world workflows in companies involve more than one person. So for an AI to be able to talk to everyone involved is crucial to automating these workflows and reducing people’s workloads.
Good news: other tools are available!
Developers had a year’s head start getting agentic coding tools that they could delegate a lot of work to. But recently a lot of agentic tools are becoming available that give similar benefits to business users. There is a growing number of SaaS tools you can connect to AI tools. Claude CoWork is great for business users. Codex is catching up fast. Tools like Perplexity Computer and Manus are also going in this direction.
These tools are generally easier to use than OpenClaw. They are easier to connect to things. They feel less like you have to become the unpaid maintainer of a confused internal framework just to get value out of them. Of course, the catch is that these tools are still mostly designed for one person at a time.
But the good news is that we can emulate a lot of what we did in OpenClaw with Codex automations. And we can even make Codex send messages into Matrix rooms so the team can get daily meeting briefs, industry news summaries, and a lot of the other useful automations we experimented with. You can’t prompt from Matrix unfortunately, so you still have to drop back to single-user mode for a lot of stuff.
Enterprise Agentic Tools Are Getting There Too
Then there is the enterprise side of the market. If you want something a responsible company can actually use at scale, with a straight face, products from companies like Tines or Langdock are closer to what a serious CIO can justify. They are built for organisations that care about security, compliance, oversight, and controlled deployment rather than just enthusiast energy and feature accumulation.
The Hard Problems Are Still Ahead
Multiplayer is going to be a game-changer for serious teams. But it will also make a lot of the already quite obvious issues even more painful. For example, giving blanket access to your inbox is already a bit questionable if you do it in a one-on-one chat in Claude CoWork. But how would you do that in a team context? We talk to people who manage several different inboxes for the executives they support. That’s a great use case for agentic AIs. But it’s also a huge security problem.
Trust me! I know what I’m doing!
The big unsolved problem here is how to deal with security and permissions. There are companies that try to address this, but it’s a very fragmented space, and most SaaS tools either force you into micromanaging permissions (like Slack) or you end up giving blanket access (Gmail). And neither is a good solution.
The problem is rather urgent because the tools are getting useful enough that important people are going to insist on using them. And without good solutions this will result in exactly the same type of security issues that pop up every few years in IT. Remember when people were bringing USB keys to the workplace and could introduce viruses and worms to the intranet? Remember Wi-Fi and using your laptop on insecure hotel networks? Email? The pattern is always the same: something new comes along, people start using it, and by the time IT figures out they need to do something, it’s too late. Eventually they figure out how to constrain the new thing without throwing the baby out with the bathwater. We’re about to go through that cycle again with agentic AIs.
Wrapping it up
We learned a lot using OpenClaw, but of course we cannot recommend it to business users. Forget about using this if you do not have CLI skills. And if your IT department finds out you are using it, they will probably be horrified for very good reasons.
But it gave us a way to learn and experiment. It allowed us to fast-forward to a future that the rest of the world can have in a more polished form in a few years. OpenClaw makes multi-agent workflows usable right now. Multiplayer agentic tool usage in teams is a killer feature. Having agents send meeting digests, answer questions from Google Drive, resurrect old sales leads from your inbox, and do many other useful things is gold. And you can do so much more with these tools. We’re only scratching the surface of what is possible.
We can now reproduce most of what we found useful in OpenClaw with Codex or Claude Code automations. These tools provide a much more polished experience. We can even push useful outputs into Matrix rooms so our people can get shared meeting briefs, summaries, digests, and other recurring updates. Prompting these tools from there is still a challenge. But it’s a relatively simple one. It will get solved eventually.
This is a chaotic space. But if you are a bit brave and adventurous, the future can be now, not in two years. And you don’t have to figure all of this out by yourself. We specialize in coaching teams and executives on getting their feet wet with agentic tools. You can wait a few years for the tools to catch up. Or you can claim back some of your time now.
Would you like to jump forward in time a few years? Are you spending too much time in your SaaS tools doing things that clearly can and should be automated? Want to claw back some time? Come talk to us. We can help. We can make this happen right now. We’ll get you started. We’ll help you tackle the first few automations.