OpenClaw in your company – the shadow AI risk and how to control it

OpenClaw is a free, open-source AI agent that users install on their own computer or server. It is not an AI model itself. It connects to models from external providers (such as OpenAI or Anthropic) through an API key – effectively a password to a paid account with the provider – and uses them to carry out tasks. It is controlled through messaging apps: a message on WhatsApp or Telegram is enough for the agent to search the mailbox, draft a reply, open a file or run a system command.

The project began at the end of 2025 as Peter Steinberger’s hobby tool and changed its name several times (including Clawdbot and Moltbot) before adopting its current name at the end of January 2026. Within a few weeks it became one of the fastest-growing projects on GitHub. In February 2026 its creator joined OpenAI, and further development was taken over by the OpenClaw Foundation.

The agent’s capabilities are extended with add-ons (skills), most often downloaded from the public ClawHub catalogue. In practice, an add-on is a set of instructions and code that the agent executes with the user’s permissions.

Classic shadow AI is an employee pasting part of a contract into a personal AI chat. The damage is real but limited to what someone consciously copied. An agent like OpenClaw works differently: it gets permanent access to the mailbox, files and messaging apps, and then decides by itself what to read and what to send.

Installation takes a few minutes. The employee connects their work email or Slack because they want the agent to tidy their inbox or prepare meeting summaries. From the IT department’s point of view nothing changes – until the first incident.

Then there is the problem of controlling what the agent does. It also follows instructions found in the content it reads – an email, a web page, a document. A crafted message can therefore trick it into sending files or login details outside the company (so-called prompt injection), even though the employee clicked nothing.

OpenClaw is not a theoretical threat. In the first months of 2026 security researchers described several serious problems that affect any company where someone has installed it.

In March 2026 the Chinese authorities restricted the use of OpenClaw on office computers in state-owned enterprises and government offices. In Poland, warnings about malicious add-ons were published by CERT Orange Polska, among others.

If an agent with access to company email sends customer or employee data outside the organisation, the company is dealing with a personal data breach. If the breach poses a risk to individuals, it must be reported to the President of the Polish data protection authority (UODO) within 72 hours of discovery (Article 33 of the GDPR). This obligation does not disappear just because nobody officially rolled the tool out.

The amended Polish National Cybersecurity System Act (KSC Act), which implements the NIS2 Directive, has been in force since 3 April 2026. Essential and important entities must manage risk on their devices and report serious incidents, with an early warning within 24 hours. An uncontrolled agent with access to systems is exactly the kind of risk an auditor will ask about.

Since 2 February 2025 the AI Act has required companies that use AI to take steps to build their staff’s AI literacy (Article 4). A short training session explaining why an agent with access to email is different from a chat is a simple way to meet this obligation in practice.

The first step is an inventory – without it, any policy remains a declaration. In a Microsoft environment most of this work can be done with tools the company usually already has.

For most companies, a sensible default decision is this: OpenClaw and similar agents may not run on devices with access to company data. A ban on its own is not enough – it has to be enforced technically, and people need to be told clearly what to use instead.

If the IT department or a development team wants to test agents, it is better to give them a safe test environment than to pretend the problem does not exist.

Employees turn to agents because they want relief from email, notes and repetitive tasks. If the company does not give them a tool that does this, a ban will push the problem onto personal phones and computers.

In companies that work on Microsoft 365, the natural choice is Microsoft 365 Copilot. It works within the permissions and security controls of the company environment, and the administrator controls who uses it. Organisations with up to 300 users can choose the cheaper Microsoft 365 Copilot Business (list price USD 21 per user per month with annual payment, as of October 2026). Agents for specific processes, such as handling requests or documents, are built in Copilot Studio – with access control and an activity log.

Where data is particularly sensitive, the answer is so-called private AI: models and agents run in the company’s controlled environment, such as Azure, with a clearly defined scope of permissions.

Getting the issue under control usually takes about a month and does not require a large project. The order matters: first understand the scale of the problem, then set the rules, and finally provide a tool that genuinely replaces what people were looking for.