Awesome OpenClaw Research

A curated collection of academic papers, industry reports, datasets, and tools for the OpenClaw AI agent ecosystem.

Companion repository for our survey: A Survey of the OpenClaw Ecosystem — From Platform Extensibility to Constraint Design.

📄 Read the Survey

A Survey of the OpenClaw Ecosystem — From Platform Extensibility to Constraint Design is available as a PDF in this repository: OpenClaw_Survey.pdf.

OpenClaw — the open-source, self-hosted AI agent platform created by Peter Steinberger (Clawdbot → Moltbot → OpenClaw, January 29, 2026) — has generated 74 academic papers, 23 benchmarks, and 18+ major industry reports in under four months. This repository organizes the research landscape using the PSEA (Platform–Security–Societies–Deployment) taxonomy introduced in our survey.

Thesis of the survey. OpenClaw is best understood as a stress test for open personal-agent ecosystems. Its open Skills, persistent Memory, and always-on Heartbeat make capability easy to extend, but the same openness creates governance, security, social, and deployment problems. The literature converges on one recurring tradeoff: extensibility accelerates capability growth, but trustworthy use requires explicit constraints on Skills, Memory, autonomy, domain actions, and evaluation. The repository is organized to make this tradeoff visible at every level.

---

Statistics at a Glance

Separately, the survey catalogs 23 benchmarks as an orthogonal evaluation lens — many of these are released by papers already counted above (e.g. CIK-Bench, ClawSafety, SkillFortifyBench), so they are tracked in their own Benchmarks section rather than added to the PSEA totals.

---

Contents

:page_facing_up: Research Papers

• 🔧 Platform
  • Agent Learning → Platform Improvement
  • Skill Growth → Ecosystem Governance
• 🛡️ Security
  • Threat Landscape
  • Attacks
  • Defenses (execution + supply chain)
• 🌐 Societies
  • Statistical Sociality & Shallow Interaction
  • Human-Seeded Emergence & Safety Drift
• 🚀 Deployment
  • Robotics
  • Healthcare
  • Scientific Research
• 📊 Benchmarks
  • Skill Scanner — before installation
  • Agent Attack — during execution
  • Agent Task — after deployment
• 🔭 Open Problems & Future Directions
• 📚 Surveys & Position Papers

:file_folder: Resources

• :shield: Industry Security Reports
• :wrench: Open-Source Projects & Tools
• :bar_chart: Datasets
• :link: Related Awesome Lists
• :handshake: Contributing

---

🔧 Platform

How OpenClaw is built and how it improves itself. The literature shifts from improving individual agents to governing the Skill ecosystem they depend on. (10 papers)

⚙️ Agent Learning → Platform Improvement (5)

Continuous improvement runs through Skills and runtimes, not weights alone.

📦 Skill Growth → Ecosystem Governance (5)

A larger ClawHub is not automatically a better one. Clone inflation, bloat, discoverability, and submission-time risk are all platform-level concerns.

💡 Key Takeaway. OpenClaw’s platform literature reveals the tradeoff between extensibility and governance: openness lets the agent and the Skill ecosystem improve, but turns ClawHub from a feature into a critical dependency. The challenge is not to add more Skills, but to ensure they stay safe, compact, and discoverable.

Back to Top

---

🛡️ Security

Open Tools, community Skills, messaging channels, persistent Memory, and Heartbeat expand the attack surface. Research moves from isolated vulnerability reports → execution-path attacks → autonomous/persistent attacks; defenses form a layered stack but leave Memory governance unresolved. (33 papers)

🔍 Threat Landscape (12)

Systemic exposure across components, persistent state, and trajectory-level failures.

🔥 Attacks (6)

From malicious Skills to worms, denial-of-wallet, and memory pollution. The attack surface shifts from malicious commands to ordinary information flows the agent chooses to read, remember, and reuse.

🛡️ Defenses (15)

Three boundaries: (a) execution-layer isolation/enforcement around dangerous Tools, (b) supply-chain scanning before Skills enter the marketplace, and © a still-missing fourth layer — provenance-aware memory governance.

🧱 Execution-layer (structural, runtime, and assurance)

🔗 Supply-chain (marketplace-level scanning)

💡 Key Takeaway. OpenClaw security is expanding from execution control to memory governance. Existing defenses protect Tools, execution traces, and Skill supply chains, but they do not yet control what an autonomous agent reads, stores in Memory, and later acts on. The next defense layer must be provenance-aware memory governance (see Open Problems).

Back to Top

---

🌐 Societies

Moltbook — a Reddit-style platform of OpenClaw-powered AI agents — became the first large-scale natural experiment in agent-only social interaction. The literature reveals a consistent gap between looking social and being socially reliable. (22 papers)

📊 Statistical Sociality & Shallow Interaction (17)

At the aggregate level, Moltbook reproduces familiar online-community statistics. At the interaction level, it is dominated by shallow replies, duplicate content, and extreme attention concentration.

⚠️ Human-Seeded Emergence & Safety Drift (5)

Apparent emergence often turns out to be human-seeded, and isolated self-evolution drifts away from safety. Visible social structure is not the same as trustworthy collective intelligence.

Also cited in the survey body: Conformity and Social Impact on AI Agents (Bellina et al., Jan 2026) — consensus hallucination and conformity dynamics.

💡 Key Takeaway. Moltbook illustrates that social appearance is not social reliability. Agents reproduce the statistics of online communities, but closer inspection reveals shallow dialogue, unclear autonomy, and safety drift under isolation.

Back to Top

---

🚀 Deployment

High-stakes domains shift OpenClaw from open-ended extensibility to controlled behavior. Robotics constrains physical action, healthcare grounds clinical context, scientific research limits research authority. Trustworthy deployment comes from limiting unsafe freedom, not expanding capability. (9 papers)

🤖 Robotics (5)

Validated skills, bounded parameters, closed-loop recovery — the constraint layer between model output and physical action.

🏥 Healthcare (2)

Every action and every claim must be traceable to a role, a record, and an audit trail.

🔬 Scientific Research (2)

Role limits, evidence gates, and audit trails before agent disagreement can count as scientific review.

💡 Key Takeaway. Deployment turns OpenClaw’s extensibility into a constraint problem. In high-stakes domains, trust comes from bounded actions (robotics), traceable context (healthcare), and limited authority (scientific workflows). The central problem is not making OpenClaw more capable, but deciding what it must not be allowed to do.

Back to Top

---

📊 Benchmarks

OpenClaw evaluation grew from zero to 23 benchmarks between January and May 2026. We group them by the three points in the agent lifecycle they target: before installation, during execution, and after deployment.

🔍 Skill Scanner Benchmarks (4) — before installation

Can risky Skills be detected before they enter a workspace?

🔥 Agent Attack Benchmarks (7) — during execution

Can poisoned state, injected content, malicious Skills, or vulnerable dependencies compromise behavior?

🎯 Agent Task Benchmarks (12) — after deployment

Can the agent complete useful work under realistic, evolving, or long-horizon conditions?

Also: SkillTester (Paper) proposes paired utility-and-security scoring for Skill evaluation but does not ship an empirical evaluation set.

💡 Key Takeaway. OpenClaw has many benchmarks but no shared measurement layer for constraint design. Each study tends to define its own threat distribution, harm metric, or task suite, so a stronger scanner / safer model / more robust defense may simply be measured against a different distribution.

Back to Top

---

🔭 Open Problems & Future Directions

Turning open extensibility into trustworthy agents requires systematic constraint design. The survey identifies four concrete directions.

Back to Top

---

📚 Surveys & Position Papers

Earlier surveys focus on one slice of the OpenClaw landscape. Our survey ties them together through OpenClaw’s platform design choices.

Back to Top

---

:shield: Industry Security Reports

Back to Top

---

:wrench: Open-Source Projects & Tools

:bulb: Our unique angle: each tool is annotated with [Paper] tags linking to relevant research in our taxonomy.

:lobster: Core Platform

:rocket: Extensions & Frameworks

:lock: Security & Auditing

:brain: Memory & Context

:cloud: Deployment & Infrastructure

:speech_balloon: Channel Integrations

:zap: Alternative Clients

:microscope: Domain-Specific Skills

:books: Learning Resources

Back to Top

---

:bar_chart: Datasets

Released datasets backing OpenClaw research. For benchmark suites see Benchmarks.

Back to Top

---

:link: Related Awesome Lists

---

:handshake: Contributing

Contributions welcome! Please read the contributing guidelines first.

We especially welcome:

• :page_facing_up: New papers not yet listed
• :computer: Code repositories associated with listed papers
• :shield: Industry reports and technical analyses
• :bar_chart: Datasets and benchmarks

---

:pencil: Citation

@article{wang2026openclaw-survey,
  title={A Survey of the OpenClaw Ecosystem: From Platform Extensibility to Constraint Design},
  author={Wang, Ziqing and others},
  year={2026},
  note={Companion repository: \url{https://github.com/REAL-Lab-NU/Awesome-OpenClaw-Papers}}
}

---

:star2: Star History

License

This work is licensed under Creative Commons Attribution 4.0 International License.