Self-Hosted AI Agents Went Mainstream in 2026. Here's How to Decide If You Should Run One.

On March 2, 2026, an open-source project that had carried its current name for about a month already had more GitHub stars than React. By 15 October 2026 the OpenClaw repository showed 392,000 stars.

OpenClaw is a free, self-hosted AI agent that answers you inside the chat apps you already use. It reads files, runs commands and calls APIs on hardware you control, not on a vendor's server.

The real question for a solo founder or a small team is not whether this category is real, since hundreds of thousands of developers have already answered that with a star. It is whether to run one yourself, or to pay a hosted product to carry the risk instead. That is a money question. It is also a time question.

This guide gives you a way to decide, with the numbers checked against vendor pages on 15 October 2026.

What Changed Since the August Review

The previous version of this guide was checked on 4 August 2026. Six things moved, and two earlier statements were wrong.

• Lindy changed its pricing model. The Plus, Pro and Max labels are gone from its pricing page. Plans are now sold as monthly credit bundles, billed per user.
• OpenClaw shipped a 2.0 release. Wikipedia records the Foundation's announcement of OpenClaw 2.0 (v2026.8.1) on 30 August 2026, with faster setup and a redesigned interface.

Four more changes come from the README and the docs.

• The install path changed. The README now recommends an installer script, with a global npm install as the alternative. It asks for Node 24.16 or later, or 26.1 or later.
• Channel support grew. The README lists more than 20 channels, plus native apps for macOS, iOS, Android, Windows and Linux.
• Stars rose from about 385,000 to 392,000.
• The Foundation signs releases. The README says the OpenClaw Foundation, an independent 501(c)(3), employs the core team and signs releases.

Two corrections. The August text said the final name came after Anthropic objected to "Moltbot". Wikipedia says the Moltbot rename followed Anthropic's trademark complaints, and the move to OpenClaw three days later was the founder's own choice. The August text also claimed file tools were read-only and shell execution was off by default. The current security docs do not say that, so the claim is gone.

Re-checked 15 October 2026: the core advice holds. Self-hosting is still a trade of money for operating work.

Why This Decision Suddenly Matters

OpenClaw's timeline, as Wikipedia records it, moved fast even by open-source standards: the code appeared on 24 November 2025 as Warelay, became Clawdbot on 2 January 2026, was renamed Moltbot on 27 January after Anthropic raised trademark complaints, and took the name OpenClaw three days after that, all inside ten weeks.

An independent star count, taken with the GitHub API on the weekend of the milestone, put it at 247,191 stars against React's 243,438. React had held the top spot among software projects for years. Wikipedia lists the same period at 247,000 stars and 47,700 forks.

On 14 February 2026 the creator, Peter Steinberger, announced he was joining OpenAI, and that a nonprofit OpenClaw Foundation would steward the project. The README states that OpenAI is a donor, not an owner. It also says the project has no paid tier, no hosted service and no token.

A neighbouring story shaped the headlines. Moltbook is a Reddit-style network where agents running OpenClaw post to each other. TechCrunch reported on 10 March 2026 that Meta had acquired it, with the founders joining Meta Superintelligence Labs and the deal terms undisclosed.

Moltbook is a separate product with a separate team. TechCrunch also reported that researchers found its database credentials were exposed for a time. The acquisition says little about OpenClaw's own security. For Meta's wider agent bets, see our piece on Zuckerberg's AI agent strategy.

What an OpenClaw Agent Actually Runs On

Strip away the branding and OpenClaw is one long-running process, the Gateway, on a machine you choose. The README says one Gateway runs a personal assistant on a laptop or a shared team deployment, and configuration is the only difference.

State, memory and credentials live on your hardware. The model is a plugin. The README names Claude, Codex and local models as examples, and says you can swap them without changing anything else.

The project documents what it sends out, which is unusual for software in this category. By default OpenClaw makes a daily version check and nothing else of its own. Anonymous feature statistics are opt-in. Your prompts still go to the model provider and chat platforms you configure.

The Gateway has a Control UI on a documented default port, 18789, according to Giskard's analysis. That detail matters in the security section below.

How to Decide If Self-Hosting Is Right for You

Four questions separate a good fit from a frustrating one.

Which channels do you actually live in? OpenClaw covers WhatsApp, Telegram, Discord, Slack, Signal, iMessage and Microsoft Teams, among others. A hosted option built around email and calendar may fit better if that is where your work happens.

How much autonomy are you willing to grant? The tool docs describe a Default (Full Access) permission mode for runs. Restrictions on tools, filesystem and sandbox are separate settings you choose. Every step toward full autonomy is a step you own.

Can you isolate the process? A spare laptop with an exposed management port is the setup researchers flagged. A small VPS from a provider such as Hetzner or Hostinger, with the service sandboxed, is the realistic minimum.

Do you already pay for a model you would reuse? If you already pay for Claude, ChatGPT or Gemini, the marginal cost is hosting plus API usage. If you want no key management at all, a hosted product bundles the model cost.

If your actual need is one action triggered by one event, a workflow tool such as n8n solves it with far less to maintain.

The Shortlist

OpenClaw. Free and MIT-licensed. The caveat is that you inherit the documented security issues below on the day you run it.

Lindy. A hosted teammate built around inbox, calendar and meetings. The caveat is that your data lives on Lindy's servers, not yours.

Zapier and Make. Neither is a conversational agent. Both are no-code platforms. Zapier describes itself as connecting more than 8,000 apps. Either is the better fit for "when X happens, do Y".

IFTTT. The simplest option here: single trigger-action pairs, no reasoning loop. Right for turning on lights, wrong for anything needing judgment.

Other agents. If your real goal is a hosted general agent, compare Manus in what Manus is for and Manus vs ChatGPT Agent. For coding work, Cursor, Claude Code and Codex are the usual references. Our Cursor vs Claude Code comparison covers that pair. For a wider map, read best agentic AI in 2026.

Still undecided between self-hosting and a hosted agent? Smart Match asks about your budget and channels, then narrows the field.

What Lindy Costs Now

Lindy's pricing page, read on 15 October 2026, sells credits, not named plans. Every active user in a workspace takes a paid seat, and all credits pool across the team.

The page lists more steps between these rows. Top-ups cost $10 per 1,000 credits. Monthly credits do not roll over.

There is also a free start: $50 in credits, no credit card, and the credits last 7 days. After that, paid use starts at $29.99 per user per month.

Enterprise adds HIPAA with a signed BAA, SSO and SCIM, and audit logs, while Lindy says the whole product is SOC 2 and GDPR compliant and that any action with outside impact, such as sending an email, waits for a human approval first.

Our Lindy record carries the same three bundle prices. The August guide quoted $49.99 for an entry plan with two inboxes. That figure no longer appears on the vendor page, and it is removed.

OpenClaw vs. Lindy: Where Each One Wins

Pick OpenClaw if you already run a VPS, are comfortable in a terminal, and want one assistant that follows you across many channels, because the software is free and the only recurring bills are the server and the model API calls. You also take on the patching. And the monitoring.

Pick Lindy if your need is inbox and calendar automation, you want a vendor to own security patching, and per-user credit billing suits the way your team already buys software, including the habit of removing a seat when someone leaves. Pick it too if you need HIPAA coverage or SSO that you cannot bolt onto a self-hosted process.

Neither wins for a team that needs a formal audit trail today and cannot wait for either product's compliance tooling to mature, so that team should write down its requirements first and test both against them. Not before.

The Security Bill You're Signing Up For

Here is the strongest case against everything above: self-hosting looks free, but it is not.

Giskard exploited a deployment in January 2026. Its write-up describes exposed credentials, cross-session leakage and prompt injection through content the agent reads on your behalf.

PromptArmor found that a messaging app's link preview could carry data out. The agent builds a URL on an attacker's domain with private data in the query string, and the app fetches it without a click. The Hacker News reported both this and the CNCERT warning.

Koi Security audited ClawHub in early February 2026. Of 2,857 skills, 341 were malicious. 335 belonged to one campaign, named ClawHavoc, which used fake prerequisites to install a macOS stealer.

China's CNCERT said the platform's default security settings are "inherently weak". Wikipedia cites reporting that China moved to curb its use at banks and state agencies in March.

None of that means the project is broken. It means the risk is real. Popular open software draws researchers, and the docs now describe conservative defaults. On a host install, the Gateway binds to loopback. Most chat channels answer an unknown sender with a pairing code. Group access is allowlisted.

The docs also name the exceptions. Container images default to an exposed bind. Agents with message tools can send across providers by default. A paired Mac node can run commands remotely, which the docs call remote code execution on that Mac.

The free option carries an ongoing operating cost, paid in hours instead of dollars and owed every month the agent stays connected to anything you care about. A hosted product is built to absorb that cost for you.

A Hardening Checklist

Do these in order. They come from the project's own security docs. The one command worth memorising is the audit:

openclaw security audit

Then work down the list.

1. Keep the Gateway on loopback. Read the exposure runbook before binding it anywhere else.
2. Run openclaw security audit after setup and after every upgrade.
3. Keep pairing on for unknown senders, and use allowlists for groups.
4. Deny control tools for any agent that reads untrusted content. The docs suggest denying gateway, cron, sessions_spawn and sessions_send.

Three more steps finish the job.

1. Set cross-provider messaging to false if you want sends confined to one conversation.
2. Review each ClawHub skill before install, because the registry is open by default.
3. Put the whole service in a container or a dedicated VPS, away from personal files.

On ClawHub, the docs say anyone can publish if their GitHub account is old enough. Automated checks run on published releases and public pages show a scan summary. I found no rule that makes code signing mandatory for skills, and the August claim that none existed is not re-verified.

How to Install It

Installation is short. Budget a few minutes for the wizard, plus an hour to harden what the wizard built, because the defaults are a starting point and not a finished security posture for a machine that holds your credentials.

1. Pick a host. A small VPS or an always-on machine works.
2. On macOS, Linux or WSL2, run the install script from openclaw.ai. On Windows, use the PowerShell installer.
3. If you manage Node yourself, install the npm package. It needs Node 24.16 or later, or 26.1 or later, with 26 recommended.
4. Finish the onboarding wizard the installer opens, and connect your first channel.
5. Run the security audit before you connect anything sensitive.

The README says the installer provisions a supported Node runtime when needed.

The Costs That Never Show on a Pricing Page

Free software still has a bill, and it arrives in three forms that are easy to forget when you compare a monthly price to zero, which is exactly the comparison most people make on the first afternoon.

The first is attention, because someone has to read the release notes, run the audit after each upgrade and decide whether a new setting changes what the agent is allowed to do on your behalf. The second is risk. It is hard to price but real, since an agent with access to your files and your messages can do damage faster than a person can notice it.

The third is drift. Models change. Chat apps change their rules, and a setup that worked in spring may need repair by autumn.

None of this is a reason to avoid self-hosting. It is a reason to count it.

A founder who enjoys the work and keeps a monthly slot for it will find the trade fair. A founder who wants the agent to simply run will resent every hour.

A Worked Example: A Three-Person Agency

Picture an agency with three people. Each one lives in Slack and email all day. The owner wants meeting notes, inbox triage and a morning brief for everyone.

On Lindy's current page, every active user takes a seat. At the entry bundle of 3,000 credits, that is three seats at $29.99, or $89.97 a month before any top-ups. Credits pool across the team, so a heavy week for one person can draw on a quiet week for another.

The same agency could run OpenClaw on one small server from a provider such as Hetzner. The software costs nothing. The bill becomes the server, the model API usage, and the hours someone spends on audits, updates and skill reviews.

Here is the honest comparison. Lindy's price sits on a page, and a vendor carries the patching. OpenClaw's price hides in time. If nobody on the team will own that time, the free option is the expensive one.

Ask what the agent will touch, too. An agent that drafts replies needs mail access. One that runs commands needs a sandbox. Start narrow. Widen only when a task demands it.

What Would Change the Verdict

Four developments would move this advice, and each one is checkable.

• Mandatory skill signing on ClawHub. The docs describe open publishing with automated scans. A signing requirement would cut the supply-chain risk that the ClawHavoc audit exposed.
• A quiet security record. If the audit command keeps passing on defaults and no new cross-session leak is reported across several releases, the case for self-hosting on a small team gets stronger.

Two more are about the market, not the software.

• A change in Lindy's model. Pricing moved from named plans to credits between August and October. Another shift could move the break-even point either way.
• Your own compliance duties. If a client contract starts requiring audit logs or a signed BAA, the hosted Enterprise route becomes the default.

Until one of those happens, the verdict stands. Self-host if you will own the operating work. Pay a vendor if you will not.

Who Should Skip Self-Hosting Entirely

Skip it if you need a compliance-ready audit trail this quarter. Lindy's Enterprise tier exists for that gap. Skip it if you want trigger-to-action automation, not a conversation. Zapier, Make and IFTTT do that with a fraction of the maintenance.

Skip it too if you will not check logs. Ever. An unattended agent with shell access is exactly the setup the findings above describe.

A reasonable path for an undecided reader is to trial a hosted product for thirty days against the one task eating your time. Move to self-hosting only once you know which channels and tools you would enable.

If the agent also needs a voice, ElevenLabs is the common add-on. It is not a substitute for the agent. For agent frameworks you build on, see LangChain. For a hard look at what agents do with real money, read our autonomy test.

The labs behind the models matter too, because your agent is only as good as the model behind it. Anthropic, OpenAI and Google each publish their own terms.

Where Self-Hosting Still Wins

The counterargument deserves its room. A hosted agent holds your mail, your calendar and your documents on its servers, which means you are trusting a company's patch cadence, its staff access rules and its retention policies, none of which you can inspect directly. That is a real cost too.

A self-hosted agent keeps state, memory and credentials on your hardware, per the README, and swaps models without a migration. For a technical user with isolation in place, that control is the whole point.

Sources and Gaps

Every figure above was read from the pages listed under sources on 15 October 2026. Two Hacker News articles, on the ClawHub audit and on the CNCERT warning, block automated link checks, so they are cited by name and not listed. Three items stay unverified and are marked in the text: the August code-signing claim for ClawHub, the exact date of China's bank restriction, and any October security advisory count.

Frequently asked questions

What is OpenClaw?

OpenClaw is a free, open-source AI assistant that runs on your own computer or server and answers in chat apps such as WhatsApp, Telegram, Slack and Discord. The OpenClaw Foundation, an independent 501(c)(3), stewards it under the MIT license. It has no paid tier and no hosted service.

Is OpenClaw free to use?

Yes. The software is free and MIT-licensed. You still pay for the machine it runs on and for the AI model you connect, such as an API from a model provider. Prices for both vary by provider, so check them before you commit.

Is OpenClaw safe to self-host?

Researchers at Giskard, PromptArmor and Koi Security documented real problems in early 2026, including cross-session data leaks, a link-preview exfiltration path and 341 malicious ClawHub skills. The docs describe conservative defaults and an `openclaw security audit` command. Safe use is an ongoing job, not a one-time setup.

What is the difference between OpenClaw and Lindy?

OpenClaw is free software you run and secure yourself across many channels. Lindy is a hosted product built around inbox, calendar and meeting work. It bills per user in monthly credit bundles, from $29.99 for 3,000 credits, and Enterprise adds HIPAA, SSO and audit logs.

How do I install OpenClaw?

The README gives an installer script for macOS, Linux and WSL2, and a PowerShell installer for Windows. If you manage Node yourself, you can install the npm package, which needs Node 24.16 or later, or 26.1 or later. The installer opens an onboarding wizard to connect a channel.

Covered in this guide

• OpenClaw: OpenClaw is a free, MIT-licensed agent gateway: one self-hosted process connects your chat apps to the AI model you choose, with the OpenClaw Foundation as steward.
• Anthropic: Anthropic is a Public Benefit Corporation started by 7 ex-OpenAI researchers. It builds the Claude model family and counts Amazon and Google among its largest backers.
• ChatGPT: ChatGPT is OpenAI's AI assistant, with 1.2 billion weekly users by OpenAI's count, the GPT-6 model family and plans that run from a free tier to a premium Pro tier.
• Claude: Claude is Anthropic's AI assistant, with a free tier, paid personal plans, and Team and Enterprise seats. Opus access starts at the first paid plan.
• Cursor: Cursor is an AI code editor built on VS Code, widely adopted across large enterprise engineering teams, with Agent Mode, Tab completion, and Cloud Agents.
• Gemini: Google's multimodal AI assistant and model family, sold as a free app, tiered subscriptions and a pay-per-token API
• Hetzner: Hetzner sells cloud VPS, dedicated and GPU servers and S3-compatible object storage from Germany, Finland, the US and Singapore, with a large traffic allowance on EU cloud plans.
• Hostinger: Hostinger sells shared, cloud and KVM VPS hosting from data centers on four continents, plus hourly GPU servers, with a 30-day money-back guarantee.
• IFTTT: Automate anything by connecting your favorite apps and devices
• Lindy: AI teammate that handles email, meetings and workflows across 1,000+ apps; no free plan, just a 7-day trial then per-seat billing.
• Make: No-code visual automation platform to connect apps and build AI workflows at scale
• Manus: Autonomous AI agent that plans and executes multi-step work from one prompt: research, documents, apps and video. The September 2026 release adds Cascade, Automations and Studio. Free tier available.
• OpenAI: OpenAI builds ChatGPT, the GPT-6 family (Astra, Sol, Luna), Codex and the OpenAI API. It reports 1.2B weekly ChatGPT users and an $852B valuation after its March 2026 round.
• Codex: Clones a GitHub repo into a sandbox, writes and tests code, then opens a pull request; OpenAI reported 20 million active users in August 2026.

Sources