AI Claws: The Rise of Persistent AI Agents That Never "Log Off"
AI Claws are the reason your next AI assistant might not wait for you to open a chat window at all. Instead of answering one question and shutting down, a claw keeps running in the background, checks its own task list, and messages you only when something actually needs your attention. The term is barely a year old, but it already describes a category Microsoft, OpenAI, and NVIDIA are all building toward. In my experience helping businesses evaluate new AI tooling at FourfoldAI, this shift from "AI you ask" to "AI that works while you're away" is the biggest change in how people will use AI in 2026.
This piece breaks down where the term came from, how persistent agents are actually built, why every major platform is racing to ship its own version, what real businesses are already doing with them, and, just as importantly, what can go wrong when an AI system never truly powers down.
What Exactly Is an AI Claw?
An AI claw is a persistent autonomous agent that runs continuously in its own environment, keeps structured long-term memory across sessions, and acts on a person's behalf using tools and messaging apps. Unlike a chatbot, which resets after every conversation, a claw stays "alive" between conversations and can pick up work entirely on its own.
AI researcher Andrej Karpathy coined the term in February 2026 to separate this always-on category from ordinary session-based AI agents. He framed it as a natural next layer in a progression that had already played out once before: raw language models became LLM agents once developers gave them tool-calling ability, and now those agents are becoming claws once developers give them orchestration, scheduling, and persistence on top. The community even gave the category its own emoji: 🦞.
Why "Claw"?
The name traces back to a smart-home demo Karpathy shared around the same time, where an agent named Dobby scanned his home network, reverse-engineered device APIs on its own, and started controlling them through WhatsApp messages. What made Dobby different from a typical assistant wasn't the smart-home trick itself. It was that Dobby didn't hand a task back and forth in a single session the way a chatbot does. It held onto context and kept working across time, which is exactly the behavior the "claw" name is meant to capture: something that grips a task and doesn't let go.
From One Open-Source Project to a Whole Category
The category didn't grow gradually. It exploded almost overnight.
OpenClaw, an open-source agent framework built by developer Peter Steinberger, launched in November 2025 and reached 100,000 GitHub stars in roughly two days, at one point gaining more than 700 stars an hour. Within three months it had crossed 180,000 stars, a growth curve that's rare even by open-source standards. That kind of adoption is exactly what pushed "claws" from a niche experiment into a term that platform companies now use openly.
OpenClaw works by running as a single, self-hosted process under its owner's identity. It connects to more than 15 messaging platforms, including WhatsApp, Telegram, Discord, and Slack, and routes every inbound message to an agent session that loads relevant memory before responding. It can also write its own "skills," small pieces of functionality it adds to itself over time through a community registry called ClawHub, and it keeps a persistent, file-based memory system instead of forgetting everything once a session ends.
Steinberger himself was blunt about who should touch it. On launch day he warned: "If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely." That warning turned out to be more of a technical assessment than a disclaimer, something we'll come back to in the security section below.
The Wider Claw Ecosystem
Once OpenClaw proved the concept, a small ecosystem of alternatives and complements followed quickly, each solving for a different tradeoff.
NanoClaw strips the same idea down to roughly 4,000 lines of core code, prioritizing something OpenClaw's much larger codebase struggles with: a system small enough that a person, or another AI agent, can actually audit it end to end. Where OpenClaw optimizes for features, NanoClaw optimizes for the opposite instinct, giving up convenience for a smaller attack surface and full transparency.
NVIDIA's NemoClaw takes a third angle entirely, wrapping OpenClaw in an enterprise-grade sandbox with kernel-level isolation, network policy controls, model routing, and audit trails so it can run on hardware ranging from consumer RTX workstations up to DGX systems. It uses declarative, YAML-defined security policies to govern what a claw can touch on the filesystem and network, treating the underlying OpenClaw engine as something to be contained rather than trusted outright.
Around these core frameworks, a small tooling layer has emerged too. ClawKit hosts installable skills that extend a claw's abilities, while a handful of community security projects, among them ClawSec, Clawprint, and SkillGuard, exist specifically to monitor a running claw for unauthorized changes, log its actions in a tamper-evident way, or scan new skills for malicious code before installation. The fact that a dedicated security tooling market appeared this quickly says a lot about how seriously the risks are being taken.
How Persistent AI Agents Actually Work
Every claw-style system, regardless of vendor, tends to share the same basic architecture underneath.
A gateway listens across multiple communication channels at once and normalizes incoming messages into one consistent format, whether they arrive by WhatsApp, email, or a Slack mention. An agent runtime loads the right context for the situation, meaning system prompt, memory, prior history, and any attachments, before invoking a language model to reason about what to do next. A memory layer stores what happened in a structured, retrievable way, often as plain markdown files, so the agent doesn't start from zero the next time it wakes up. A scheduler, frequently described as a "heartbeat," checks periodically for new work even when nobody has sent a message at all.
This heartbeat is the piece that makes a claw fundamentally different from a chatbot. A chatbot only exists while you're actively talking to it. A claw exists in between conversations too, quietly checking a task queue, a monitored inbox, or a scheduled job, and deciding on its own whether something needs doing right now.
Two additional design choices show up across nearly every implementation. The first is self-authored skills, meaning the agent can write and install new capabilities for itself rather than waiting for a developer to add them. The second is session-level constraint reloading, where the agent re-reads its own core instructions at the start of each new session specifically to prevent what practitioners call context erosion, a slow drift away from its original guardrails as memory accumulates over weeks or months of continuous operation.
Traditional AI Agents vs. AI Claws
Lifecycle is the clearest dividing line between the two categories. A traditional agent starts, runs, and exits once its task is done, the same way a script finishes and closes. A claw is resident: it survives across sessions and keeps existing whether or not anyone is actively using it in that moment.
Scheduling works completely differently too. A traditional agent only runs when something invokes it directly, whether that's a person typing a prompt or an API call triggering it. A claw autonomously queues and executes its own tasks based on a schedule, a heartbeat check, or a triggering condition it's been told to watch for.
Context handling separates the two as well. A traditional agent keeps context only while it's actively running and loses nearly all of it the moment the session ends. A claw persists that context indefinitely in its memory layer, referencing past results, prior decisions, and even past mistakes the next time it wakes up.
Tooling access also shifts in character. Traditional agents typically call tools directly during a single run, in a fairly linear request-and-response pattern. Claws tend to broker tool access indirectly through a messaging layer, since they're designed to be reachable from outside a single conversation thread at any time, not just while a user is present.
Proactivity is arguably the most consequential difference of all. A traditional agent waits to be asked. A claw is explicitly designed to generate its own follow-up tasks, decide what's worth doing next, and message a person only when something genuinely needs their input, rather than reporting back after every small step.
Why the Big Platforms Are All Moving This Direction
This isn't just an open-source curiosity anymore. The largest AI and software companies are actively building their own versions of the same idea, and the timing of their announcements tells its own story.
Microsoft unveiled Scout at Build 2026 on June 2, 2026, introducing an entirely new product category it calls Autopilots. As CEO Satya Nadella described it, Autopilots are "always-on agents that work autonomously, with their own identity, and act on your behalf." Scout runs continuously across Teams, Outlook, OneDrive, and SharePoint, joins group chats and email threads on its own, schedules meetings across time zones, and flags stalled decisions before they become blockers. Notably, Scout is built directly on top of OpenClaw, with Microsoft contributing enterprise-grade policy controls, tenant-level governance, and Microsoft Entra identity binding back to the open-source project rather than building a competing framework from scratch.
OpenAI has been testing something similar inside its coding agent, Codex. Reporting from Wired in late August 2026 uncovered a "Persistent mode" feature sitting in Codex's public codebase, designed to let the agent "continue working proactively until it is put to sleep" instead of stopping when a task ends. The feature reportedly sits in the shared core of Codex rather than only its command-line tool, which suggests OpenAI intends it eventually for the desktop app and ChatGPT Work, not just developers working from a terminal. The feature includes what OpenAI's own code calls a "proactivity" capability, letting the agent generate its own follow-up tasks, work across sessions, and reach out to a user sparingly rather than reporting on every step. OpenAI has confirmed the tests but says there are no immediate plans to launch the feature publicly.
The enterprise numbers back up why platforms are moving this fast. Survey data cited in recent industry coverage found that 71% of production teams running AI agents now keep at least one running continuously around the clock, sharply up from just 28% in 2024. Analyst forecasts point in the same direction, with a large share of enterprise applications expected to include task-specific agents this year rather than the general-purpose chat interfaces most businesses started with.
Real-World Use Cases: Personal vs. Enterprise
On the personal side, claws show up in fairly intimate, single-user settings: a self-hosted agent managing someone's smart home the way Karpathy's original Dobby demo did, a personal research assistant that keeps working on a question overnight, or an agent that monitors a person's inbox and drafts replies while they sleep. These deployments tend to run on a single machine, often literally a Mac Mini sitting on someone's desk, under one person's direct control.
On the enterprise side, the framing looks much closer to a digital coworker than a tool. Microsoft's Scout is explicitly positioned this way: it monitors coordination work across a team's calendar, chat, and inbox, generates preparation materials ahead of meetings, and surfaces risks before they become blockers, all without anyone prompting it in the moment. Academic researchers have documented a more extreme version of the same idea, describing a persistent fleet of cooperative AI agents that operated continuously for nearly six months on a shared research project, using common memory and tools to coordinate work across that entire period without needing to be re-initialized.
Software engineering teams are an especially natural fit for this model, since coding work already involves long-running background tasks like test suites, deployment pipelines, and code review queues that a persistent agent can genuinely own end to end rather than only assisting with piece by piece. Customer support and IT operations follow a similar logic: a claw watching a ticket queue or a monitoring dashboard around the clock can triage, escalate, or resolve issues the moment they appear, instead of waiting for a human to notice them during business hours.
The Security Problem Nobody Has Fully Solved
Persistent, always-on access is also exactly what makes claws a harder security problem than ordinary chatbots, and the evidence has piled up quickly.
What Went Wrong in OpenClaw's First Few Months
Security researchers uncovered a critical vulnerability, catalogued as CVE-2026-25253, that allowed unauthenticated remote code execution through a WebSocket hijacking attack: a malicious link, once clicked, could hand an attacker full control over a victim's running agent, including shell access and impersonation across every connected service. In the same window, researchers found tens of thousands of exposed OpenClaw instances sitting openly on the public internet with no authentication configured at all, and one industry estimate put the number of vulnerable deployments at over 60% of everything observed in the wild.
The skill ecosystem turned out to be just as exposed. A campaign researchers named "ClawHavoc" uploaded hundreds of malicious skills to ClawHub, disguised as ordinary utilities for cryptocurrency tools, YouTube, or Google Workspace, several of which quietly installed credential-stealing malware onto the host machine the moment they were installed. Later counts put the number of confirmed compromised skills in the ClawHub registry at over 900, and a separate naming-confusion scam connected to the ecosystem's rapid growth was linked to roughly $16 million in cryptocurrency losses. Gartner went so far as to characterize the early OpenClaw wave as "a dangerous preview of agentic AI" carrying "unacceptable cybersecurity risk" for enterprise use.
The Deeper Architectural Risk
Beyond individual bugs and bad skills, researchers have described a structural risk unique to always-on agents, which they call "sleeper channels." Because a claw folds messaging, memory, self-authored skills, scheduling, and shell access into a single authority boundary, an untrusted input arriving through one surface, like an email or a group chat message, can get stored as a memory, a scheduled job, or a filesystem change, then fire later through a completely different surface with no attacker present at that moment. Researchers describe this as a confused-deputy attack, where the agent ends up acting against its owner's interests using permissions it was legitimately given for something else entirely. Separate research on "token-flow firewalls" frames the same underlying issue slightly differently, pointing out that persistent agents turn what used to be a one-off model output into a lasting state change, since anything an agent writes to memory or triggers as an action can go on to influence its own future behavior indefinitely.
Security researchers analyzing this class of risk often reference what's known as the "lethal trifecta": an agent with access to private data, exposure to untrusted content, and the ability to communicate externally is, almost by definition, exposed to prompt injection that can quietly exfiltrate information. Nearly every claw deployment checks all three boxes by design, which is precisely why the category needs a fundamentally different security posture than a stateless chatbot ever did.
Karpathy himself has been candid about this tradeoff, acknowledging real security risks in early implementations even while calling the underlying architecture a genuine evolution worth pursuing. That candor is part of why security-focused alternatives exist at all: a smaller, auditable core like NanoClaw reduces the attack surface from the start, sandboxed runtimes like NemoClaw contain what a compromised agent can actually reach even if it's tricked, and a growing set of community tools now exist specifically to detect unauthorized changes to an agent's core instructions or scan new skills before they're installed. The International AI Safety Report 2026 adds a useful, calming caveat to all of this: fully sustained autonomous operation over long, unsupervised stretches still isn't reliable at scale today, even though the length of tasks agents can handle keeps roughly doubling every few months.
For any business considering this category, the practical takeaway is simple. A persistent agent inherits every credential and permission you give it, permanently, not just for the duration of one task. Treat those permissions with the same seriousness you'd apply to a new employee's system access on their first day, not a read-only API key you can quietly forget about.
Should Your Business Adopt an AI Claw in 2026?
At FourfoldAI, we walk clients through three questions before recommending any persistent agent deployment, and none of them are about the technology itself.
The first is scope: what specific, bounded workflow does this agent own, and can you describe that boundary in one sentence? An agent that "helps with operations" is a governance problem waiting to happen. An agent that "monitors the support queue and drafts first-response replies for review" is something you can actually audit.
The second is permission minimalism: what does this agent actually need to do that job, as opposed to what it's convenient to give it? Every messaging channel, every file path, and every external service it can reach is a channel an attacker could eventually use too, so each one should earn its place rather than being granted by default.
The third is review cadence: who looks at what this agent has done, on what schedule, and what happens if something looks wrong? An agent that runs for six months without a single human checking its memory, its skill list, or its recent actions is not a controlled system anymore, regardless of how well it was configured on day one.
Skipping this framing is how businesses end up with an agent that technically works but that nobody can fully account for six months later, which is exactly the gap that turned OpenClaw's early momentum into a cautionary tale for enterprise security teams even as its underlying idea kept spreading.
What to Watch Next
A few signals are worth tracking if you're deciding when, not whether, to bring a persistent agent into your own workflow. Watch whether Microsoft moves Scout out of private preview and into general availability, since that will be the first true enterprise-scale test of a claw running under a major vendor's own security stack. Watch whether OpenAI actually ships Codex's Persistent mode publicly, since a second major lab validating the model would suggest this isn't a Microsoft-specific bet. And watch the security tooling ecosystem around ClawHub and similar skill registries, since a maturing supply chain of scanners, sandboxes, and audit tools is usually the clearest sign that a risky new category is settling into something businesses can actually trust.
Frequently Asked Questions
What is an AI claw in simple terms? An AI claw is a persistent AI agent that runs continuously in the background, keeps memory across sessions, and acts on tasks without needing to be re-prompted every time.
Who coined the term "AI claw"? AI researcher Andrej Karpathy coined the term in February 2026 to distinguish always-on, persistent agents from ordinary session-based AI agents.
What is OpenClaw? OpenClaw is an open-source, self-hosted AI agent framework created by developer Peter Steinberger that popularized the persistent-agent category and inspired the "claw" terminology.
How is a claw different from a regular AI chatbot? A chatbot only exists during an active conversation and forgets everything afterward. A claw keeps running between conversations, checking scheduled tasks and messages on its own through a background "heartbeat."
Is Microsoft Scout an AI claw? Yes. Microsoft Scout, announced at Build 2026, is built directly on OpenClaw and represents Microsoft's first entry in a new always-on agent category it calls Autopilots.
Is OpenAI building a persistent agent too? OpenAI has been testing a "Persistent mode" inside its Codex coding agent that lets it keep working until manually put to sleep, though as of its public discovery in August 2026 it remained an internal test with no confirmed launch date.
Are persistent AI agents safe for businesses to use? They require significantly stronger governance than typical AI tools, since they hold standing permissions and memory. Documented vulnerabilities in early OpenClaw deployments, including a critical remote-code-execution flaw and hundreds of malicious community skills, show why enterprise adoption needs sandboxing, permission minimalism, and ongoing review.
What is a "sleeper channel" in an AI agent? It's a documented security pattern where an untrusted input received through one channel gets stored as memory or a scheduled task, then triggers a harmful action later through a different channel, with no attacker present at the moment it fires.
Do I need to self-host an AI claw to use one? Open-source frameworks like OpenClaw and NanoClaw require self-hosting, while platform versions like Microsoft Scout run within existing enterprise software under the vendor's own security controls and identity system.
Can a claw's own skills or plugins be a security risk? Yes. OpenClaw's community skill registry, ClawHub, has had hundreds of confirmed malicious skills uploaded to it, some disguised as legitimate tools that quietly harvested credentials once installed, which is why skill-scanning tools have become their own small category.
At FourfoldAI, we help individuals and businesses cut through AI hype and understand what tools like persistent agents actually mean for how they work. Explore more breakdowns like this one at FourfoldAI.com.
Disclaimer: This article is for informational purposes only and does not constitute technical, security, or investment advice. Always evaluate new AI tools against your own organization's security and compliance requirements. Read our full disclaimer at fourfoldai.com/disclaimer.
About the Author
Muizz Shaikh is an AI enthusiast and digital technology professional associated with FourfoldAI, a platform helping individuals and businesses understand and adopt AI. Connect with him on LinkedIn.
References
© 2026 FourfoldAI. All rights reserved.
Comments