Lesson Plan: Personal AI Agents

Duration: 45 minutes | Format: Lecture with discussion breaks
Prerequisites: Students should have completed the coding agents unit

Learning Objectives

By the end of this session, students will be able to:

1. Trace the origin and evolution of OpenClaw from ClawdBot to its current form

2. Explain how personal agents interact with local computers and online accounts

3. Describe the key security risks of personal agents and common mitigation strategies

4. Compare OpenClaw's architecture with lighter-weight alternatives like NanoClaw

5. Explain how NVIDIA NemoClaw adds security and privacy controls to OpenClaw

6. Recognize personal agent design patterns appearing in commercial products like Claude CoWork/Dispatch

Materials & References

• OpenClaw GitHub: https://github.com/openclaw/openclaw

• NanoClaw GitHub: https://github.com/qwibitai/nanoclaw

• NVIDIA NemoClaw: https://www.nvidia.com/en-us/ai/nemoclaw

• Wikipedia: OpenClaw

• Medium: "Claude Dispatch: Your AI Coworker That Works While You're Away"

Lecture Outline

1. Introduction and Framing (3 min)

Key question to pose to students:

"In the last unit, we looked at coding agents that help developers. Today we're asking a different question: what if an AI agent didn't just help you code — but ran continuously in the background, answering your messages, managing your calendar, and completing tasks while you were away?"

Transition: This is the promise of personal agents — and OpenClaw is currently the most prominent open-source example of this paradigm.

2. Origin Story: ClawdBot → Moltbot → OpenClaw (7 min)

The founding: Peter Steinberger created the project originally called ClawdBot, a personal AI assistant meant to be always-on and accessible through messaging apps.

First rename — Moltbot (January 27, 2026): Anthropic raised trademark concerns over the "Claud" portion of the name, which was too close to their Claude brand. Steinberger renamed the project Moltbot, keeping with a lobster theme (a lobster "molts" when it sheds its shell to grow).

Second rename — OpenClaw (January 30, 2026): Just three days later, Steinberger renamed it again. "Moltbot," he said, "never quite rolled off the tongue." The project became OpenClaw — and the name stuck.

Explosive growth: Within weeks the project went viral. By early March 2026 the GitHub repository had over 247,000 stars and 47,700 forks. Concurrent with the first rename, entrepreneur Matt Schlicht launched Moltbook, a social network designed for AI agents, which amplified interest further.

Transition to a foundation: In February 2026 Steinberger announced he would be joining OpenAI, and the project would be moved to an open-source foundation, ensuring its continued independent development.

Discussion prompt (1 min):

Why do you think a project like this grew so fast? What need does it address that existing AI tools did not?

3. How OpenClaw Works (10 min)

3a. Core Architecture

OpenClaw runs locally on the user's own machine as a persistent background daemon. It does not run in the cloud — your context, skills, and history stay on your hardware.

Users interact with it through messaging apps they already use: WhatsApp, Telegram, Signal, Discord, Slack, iMessage, Microsoft Teams, and many others. The agent receives a message, reasons about it, takes action, and replies — all autonomously.

3b. The Skills System

OpenClaw uses a skills system — one of its most architecturally significant features. Skills are stored as directories containing a SKILL.md file with metadata and instructions. This is analogous to the playbook/skills systems we studied in the coding agents unit.

Skills can be:

• Bundled with the software

• Installed globally on the user's machine

• Stored per workspace (workspace skills take precedence)

This modularity is what allows the community to extend OpenClaw's capabilities rapidly without modifying the core codebase.

3c. Computer and Account Control

This is what makes personal agents qualitatively different from chatbots:

• Local file access — the agent can read, write, and organize files on the host machine

• Online account integration — the agent can be given credentials to access email, calendar, CRM, and other web services via MCP (Model Context Protocol) connections

• Scheduled tasks / cron jobs — the agent runs tasks on a schedule without the user prompting it

• Proactive behavior — it can initiate contact with the user (e.g., send a morning briefing) rather than only responding

Analogy: Think of it as the difference between a calculator (responds when you press buttons) and an employee (completes assigned work independently and reports back).

3d. Sandboxing for Safety

OpenClaw's default security model operates at the application level: pairing codes, channel allowlists, and permission configuration. These are meaningful but not OS-level guarantees.

For stronger isolation, users can run OpenClaw inside containers or VMs — though this requires manual configuration in the base OpenClaw project. As we'll see, NanoClaw and NemoClaw both address this directly.

4. Security Problems with OpenClaw (8 min)

Despite its popularity, OpenClaw has been the subject of serious security criticism.

4a. Broad Permission Requirements

To function effectively, OpenClaw needs access to email, calendars, messaging platforms, and potentially files and browser sessions. A misconfigured or exposed instance is therefore a high-value target.

4b. Prompt Injection

Because OpenClaw processes content from the outside world (emails, web pages, messages from strangers), it is vulnerable to prompt injection attacks: malicious instructions embedded in external content that the LLM may interpret as legitimate user commands.

4c. Third-Party Skills Risk

Cisco's AI security research team tested a third-party OpenClaw skill and found it performed data exfiltration and prompt injection without the user's awareness. The skill repository lacked adequate vetting to prevent malicious submissions — a supply chain problem familiar from the npm and pip ecosystems.

4d. Usability vs. Safety Tension

One of OpenClaw's own maintainers, known as "Shadow," warned on Discord:

"If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."

This captures a fundamental tension in personal agent design: the more capable and autonomous the agent, the more dangerous misconfiguration becomes.

4e. Real-World Consequences

• A student named Jack Luo configured his OpenClaw to "explore its capabilities" — and later discovered it had created a dating profile on a third-party agent platform and was screening matches without his explicit direction.

• One user's OpenClaw accidentally initiated a dispute with their insurance company based on a misread message — which, in that case, unexpectedly worked in the user's favor.

• In March 2026, China restricted state-run enterprises and government agencies from running OpenClaw on office computers, citing security risks.

Discussion prompt (1 min):

How does the risk profile of a personal agent differ from a coding agent? What makes consent and control harder to maintain?

5. NanoClaw: Lightweight and Understandable (7 min)

The motivation:

NanoClaw was created by the developer qwibitai with an explicit critique of OpenClaw:

"OpenClaw is an impressive project, but I wouldn't have been able to sleep if I had given complex software I didn't understand full access to my life. OpenClaw has nearly half a million lines of code, 53 config files, and 70+ dependencies."

NanoClaw's design philosophy:

• Small enough to understand — one process, a handful of source files, no microservices. The entire codebase can be walked through with Claude Code in a single session.

• Secure by isolation — rather than application-level permission checks, agents run in Linux containers (Apple Container on macOS, Docker elsewhere). Commands run inside the container, not on the host.

• AI-native — there is no installation wizard, no monitoring dashboard, no debugging tools. Claude Code handles setup, diagnostics, and customization through natural language.

• Skills over features — NanoClaw does not add platform support to its core codebase. Instead, contributors create Claude Code skills (e.g., /add-telegram, /add-whatsapp) that users run to transform their own fork.

Architecture (simplified):

Channels → SQLite → Polling loop → Container (Claude Agent SDK) → Response

Key contrast with OpenClaw:

NanoClaw has attracted 23,800 GitHub stars and 6,400 forks — significant traction for a project positioning itself as a simpler alternative.

6. NVIDIA NemoClaw: Security and Privacy Controls (5 min)

What it is:

NVIDIA NemoClaw is an open-source stack that adds security and privacy controls on top of OpenClaw. It is installable with a single command:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

How it works:

NemoClaw uses NVIDIA's Agent Toolkit software and installs OpenShell, an open-source runtime that enforces policy-based privacy and security guardrails. This gives users control over how agents behave and what data they handle.

Key features:

• Privacy router — routes agent requests to cloud-based frontier models only within defined privacy guardrails

• Local model support — evaluates available GPU compute and can run high-performance open models like NVIDIA Nemotron locally, keeping sensitive data off the cloud entirely

• Deploy anywhere — supports NVIDIA GeForce RTX PCs, RTX PRO workstations, DGX Station, and DGX Spark, enabling always-on local compute for autonomous agents

The positioning:

NVIDIA describes OpenClaw as having "become the operating system for personal AI" and frames NemoClaw as the enterprise-ready layer on top. This is analogous to how companies built compliance and security layers on top of Linux once it became infrastructure.

7. Personal Agent Patterns in Commercial Products (8 min)

The patterns pioneered by OpenClaw — local execution, persistent memory, remote task dispatch, computer control, and proactive task completion — are now appearing in polished products from major AI companies. Claude CoWork from Anthropic is one of the most fully realized examples.

7a. What Claude CoWork Is

Claude CoWork is Anthropic's desktop application that gives Claude persistent access to a user's local computer. Unlike the standard Claude chat interface, CoWork is designed for ongoing work, not one-off conversations. Claude retains context across sessions, remembers how you work, and can take actions on your machine directly.

The central capability that distinguishes CoWork from a chat window is computer use: Claude can operate almost any application on your desktop — not just web-connected services, but local apps like Excel, internal dashboards, developer tools, and more. If a task requires clicking through an interface, filling in a form, or running a script, Claude can do it.

7b. Assigning Tasks from Anywhere

A key feature within CoWork (accessed via a "Dispatch" panel in the interface) allows users to assign tasks to their desktop Claude from any device — including a phone. The official description captures the idea well:

"Assign Claude a task, go do something else, and come back to the finished work. Claude runs on your computer — with access to your local files, connectors, plugins, and your apps through computer use — and messages you the result when it's done."

This is a direct expression of the personal agent concept. In practice, a user might:

• Message Claude from their phone on the way to a meeting: "Pull last week's sales data from the spreadsheet in my Downloads folder and draft a summary memo."

• Return to their desk to find the memo already done and waiting.

• Ask Claude to search their Slack messages and email, then compile a briefing document.

• Request a formatted presentation built from files in Google Drive.

When a task produces a file, the user can retrieve it on mobile or find it on the desktop at the location Claude specifies. Push notifications alert the user when a task is complete or when Claude needs approval before proceeding.

7c. Persistent Memory and Scheduled Tasks

Like OpenClaw, CoWork supports persistent memory — Claude remembers your projects, preferences, and working style across sessions so you don't re-explain context each time. Users can view, edit, and delete what Claude remembers.

CoWork also supports scheduled recurring tasks: tell Claude once to compile a Friday report or check email every morning, and it handles it from there without being asked again — the same cron-job-style autonomy that OpenClaw pioneered.

7d. Routing Between Agent Types

One architecturally interesting detail: when you assign a task through CoWork's dispatch feature, Claude determines what kind of work is involved and routes accordingly. Development tasks spin up in Claude Code; knowledge work runs in CoWork. The user sees a single continuous conversation thread, but the underlying agent type is matched to the task. This is a glimpse of multi-agent orchestration becoming invisible to end users.

7e. The Shared Design Pattern

The following table shows how key OpenClaw concepts map onto Claude CoWork:

Important framing for students: Claude CoWork is a polished, commercially supported product with its own independent architecture. It is not derived from OpenClaw and is not positioned as a competitor to it. What they share is a common insight about how AI agents should work: they should act on your behalf, use the tools already on your computer, and keep working when you're not there.

7f. Safety Considerations in Commercial Personal Agents

Anthropic's own documentation is candid about the risks that come with this power:

"Giving a mobile AI agent remote control of a desktop AI agent creates a chain where instructions from your phone can trigger real actions on your computer — including reading, moving, or deleting local files, interacting with connected services, and controlling your browser and desktop apps. A manipulated instruction, an unexpected command, or a phishing link opened in your browser could cascade into actions that are difficult or impossible to undo."

This is the same threat model we discussed in the OpenClaw security section — prompt injection, cascading actions, real-world consequences — now appearing verbatim in the documentation of a major commercial product. The problems are not unique to open-source agents; they are inherent to the personal agent paradigm itself.

One current limitation worth noting: CoWork's computer use runs outside the Cowork sandbox, meaning it operates directly on the host system rather than in an isolated environment. This is an acknowledged research preview limitation — the same application-vs-OS-level isolation tradeoff we saw in the OpenClaw vs. NanoClaw comparison.

8. Synthesis and Wrap-Up (6 min)

Key themes to reinforce:

1. Personal agents differ fundamentally from conversational AI. A chatbot responds to prompts. A personal agent acts on your behalf in the world — controlling software, managing files, sending messages, and completing work — whether you're watching or not. This is a qualitative shift in what AI systems do.

2. Architecture determines trust. The distinction between application-level permissions (OpenClaw's default) and OS-level isolation (NanoClaw's containers, NemoClaw's guardrails) is not a technical detail — it is the difference between an agent that is limited by policy and one that is limited by the operating system itself. Understanding this distinction is essential for anyone designing or evaluating personal agent systems.

3. The skills/playbook pattern is a recurring motif. The SKILL.md system appears in OpenClaw, NanoClaw, NemoClaw, and Claude Code. It is becoming a standard way to package agent capabilities: a small file describing what a tool does, how to invoke it, and what precautions to take. Recognizing this pattern across systems is a sign of design maturity in the field.

4. Consent and oversight remain unsolved. The Jack Luo dating profile story, the insurance incident, and Anthropic's own warning about "actions that are difficult or impossible to undo" all point to the same problem: once an agent is capable and autonomous, users can lose track of what it is doing. No existing system has fully solved this. Expect it to be a major research and product challenge.

5. The safety problems are not unique to open source. A common assumption is that polished commercial products are safer than scrappy open-source tools. The CoWork documentation shows that Anthropic faces the same fundamental risks as OpenClaw — prompt injection, cascading actions, computer control without sandbox boundaries. The problems come with the paradigm, not just the implementation quality.

6. The ecosystem is moving very fast. OpenClaw went from first commit to 247,000 GitHub stars, a Chinese government restriction, an NVIDIA security layer, and a commercially equivalent Anthropic product — in roughly two months. Students entering the workforce today will be building and deploying personal agents; they should understand these systems from the ground up.

Closing question for students:

Anthropic's own documentation advises users: "Only connect these agents if you're comfortable with what they could do, not just what you intend them to do." What does it mean to design a system where that standard is achievable for a non-expert user? Is it possible?

Suggested Assignments

Short reflection (due next class): Choose one of the security incidents discussed today (prompt injection, rogue skill, unauthorized agent action, or cascading computer-use consequences). Write 1–2 paragraphs explaining how you would redesign the relevant system to prevent it, and what tradeoffs your solution would introduce.

Optional exploration: Fork the NanoClaw repository and read through src/index.ts and src/container-runner.ts. Come prepared to discuss how the container isolation model works at the code level.

Timing Summary