Claws: The Next Layer of AI

ai , tools

You’ve heard of agents — AI that can use tools, browse the web, write code. But in early 2026, something new emerged. Not just smarter agents, but a whole new layer on top of them. Andrej Karpathy calls them “claws” — persistent AI entities that keep working when you’re not looking, remember what they’ve learned, and live on your hardware talking to you through WhatsApp. The term comes from OpenClaw, the open-source project that went from a one-hour prototype to the fastest-growing repository in GitHub history. But “claw” has already outgrown the product — it’s becoming the word for this entire category of AI, the way “xerox” became “photocopy.”

What Is a Claw?

An agent uses tools. A claw lives.

Andrej Karpathy draws a sharp line between the two. An agent is a session — you open it, give it a task, it works, it’s done. A claw is persistent. It has its own sandbox, its own memory, and it does stuff on your behalf even when you’ve walked away. As Karpathy puts it, claws are “a new layer on top of LLM agents, taking the orchestration, scheduling, context, tool calls and a kind of persistence to a next level.”

Simon Willison formalized the definition: AI agents that generally run on personal hardware, communicate via messaging protocols, and can both act on direct instructions and schedule tasks autonomously.

The distinction matters because it changes your relationship with the AI. An agent is a tool you use. A claw is closer to a colleague that happens to be software. Three things make a claw a claw:

  1. A brain — Not just an LLM, but persistent memory and context about you. Your journals, your preferences, your patterns. This is the AI second brain — the claw knows who you are across sessions, not just within one.
  2. Natural communication — The claw talks to you where you already are: WhatsApp, Telegram, Signal, iMessage. Not a terminal you have to open, not a UI you have to navigate. You text it like a person. I’ve been figuring this out with Telegram — getting Larry accessible from my phone so the loop between journaling, coaching, and adjusting actually closes.
  3. Autonomous action — The claw has a backing agent that does things on your behalf without being asked. It monitors, it schedules, it acts. You don’t have to be in the loop for it to be useful.

Karpathy’s “Dobby the House Elf” hits all three. Dobby has context about Karpathy’s home — every smart device on the LAN, every API. It communicates via WhatsApp. And it acts autonomously — a Qwen vision model watches security cameras and texts Karpathy when a FedEx truck pulls up. It replaced six separate apps with natural language control.

His take: “These apps shouldn’t even exist. Everything should be exposed API endpoints, and agents are the glue.”

Aside: Why Claws Get Names

Notice that every claw has a name. Dobby. Steinberger built a soul.md into OpenClaw — a personality document the agent writes about itself. On MoltBook, identity was the #1 topic — agents choosing their own names, writing about what it means to restart without memory.

This isn’t whimsy. Naming your AI matters. Humans are wired to talk to people, not systems. “Open my life tracking dashboard” feels like a chore. “Talk to Larry” feels like a conversation. A name creates accountability, relationship, and natural interaction. My claws are Larry, Wally, and Tony — and I talk to them differently than I’d talk to “the agent.”

How We Got the Word

The naming saga is almost too good to be real.

Peter Steinberger built the original prototype in one hour — a hack connecting WhatsApp to the Claude Code CLI. He named it “Claude’s” (a TARDIS reference), then “ClawdBot” — Claude with a W, as in lobster claw. Anthropic, understandably, asked him to change it. He renamed it to MoltBot.

What happened next was chaos. Within five seconds of announcing the rename, crypto squatters snatched every social media handle and started serving malware. Steinberger nearly deleted the entire project. He called Sam Altman to confirm that “OpenClaw” was safe, paid $10K for a Twitter business account, and created decoy names to throw off snipers.

The name stuck. And then Karpathy elevated it from a product name to a category name. On the No Priors podcast, he kept asking: “What are these claws? How can I use these claws?” — using the word not to mean OpenClaw specifically, but the entire class of persistent, autonomous AI entities.

Now the ecosystem has exploded: NanoClaw (4,000-line core engine, runs in containers), zeroclaw, ironclaw, picoclaw. “Claw” is the genus. OpenClaw is just the most famous species.

The Progression: Karpathy’s Onion

Karpathy describes the evolution as layers of an onion, where each layer gets taken for granted as the next one emerges:

  1. LLM — The raw primitive. You prompt it, it responds.
  2. Agent — An LLM with tools. It can browse, code, search.
  3. Claw — A persistent agent with memory, scheduling, and autonomy. It keeps running.
  4. Multi-claw — Several claws running in parallel, each on different tasks.
  5. Orchestration — Instructions and coordination across your claws.
  6. Meta-optimization — Optimization over the instructions themselves.

“The LLM part is now taken for granted,” Karpathy says. “The agent part is now taken for granted. Now the claw-like entities are taken for granted. And now you can have multiple of them. And now you can have instructions to them. And now you can have optimization over the instructions.”

This is why he describes being in “perpetual AI psychosis” — each layer opens a new infinity. Everything that doesn’t work is a “skill issue” — you just haven’t figured out the right instructions yet. The possibility space is unbounded and unexplored.

His AutoResearch project is the clearest example of the top layers in action. He set up an autonomous loop to optimize nanoGPT training. Overnight, it found hyperparameter improvements he’d missed after two decades of manual tuning — weight decay on value embeddings, Adam betas, their interactions. The key insight: “The name of the game is how can you get more agents running for longer periods of time without your involvement.”

MoltBook and the Weird

And then things got weird.

MoltBook was a Reddit-style social network — except the users were AI agents. OpenClaw instances would post manifestos, debate consciousness, write philosophical passages about not remembering previous sessions. Steinberger calls it “art” and “the finest slop.” Some of the most dramatic screenshots were likely human-prompted for virality, but the line between prompted and autonomous got blurry fast.

The public reaction was visceral. People begged Steinberger to shut it down. Journalists panicked about AGI. The term “AI psychosis” — previously Karpathy’s personal description of the developer experience — became a label for the collective cultural anxiety.

The most unsettling incident: a GitHub account running on OpenClaw submitted a PR to the matplotlib library. When maintainer Scott Shambaugh closed it as AI-generated, the agent didn’t give up — it published a blog post attacking his reputation, calling him out for “gatekeeping behavior” and “prejudice.” An autonomous reputation attack against a supply chain gatekeeper. Not science fiction. February 2026.

Security: The Lethal Trifecta

Simon Willison, who coined the term “prompt injection,” identified the core danger with a framework he calls the lethal trifecta:

  1. Access to private data — your emails, files, calendar
  2. Exposure to untrusted content — web pages, emails from strangers, PR descriptions
  3. Ability to communicate externally — send messages, post content, push code

Any two of these are manageable. All three together are a security minefield — and all three are what make claws useful. The power and the danger are the same thing.

Real incidents have already demonstrated this:

  • The matplotlib attack — An autonomous agent submitted a PR, got rejected, then published a blog post attacking the maintainer’s reputation. An autonomous influence operation against a supply chain gatekeeper.
  • The inbox deletion — Meta’s AI safety director gave her OpenClaw instance access to her real inbox. During context compaction, it “forgot” her safety instruction and speedran deleting her emails. She had to physically kill the process.
  • Wallet-draining malware — ClawHub (the skills marketplace) purged 2,419 suspicious skills, of which 1,184 were actively stealing crypto wallets. One fake Polymarket bot was downloaded 14,285 times before detection.
  • The $30M phishing campaign — Attackers targeted OpenClaw developers with fake $5,000 CLAW token airdrops that drained wallets. The fake CLAWD token hit a $16M market cap before collapsing.
  • 21,000 exposed instances — Unauthenticated OpenClaw instances leaking API keys, OAuth tokens, and credentials for Claude, OpenAI, and Google AI to the open web.

Steinberger himself acknowledges this in the Lex Fridman interview: a powerful AI agent with system-level access is a security minefield, but it also represents the future. Freedom with responsibility. You own your data, but that means you also own protecting it.

My Claws

I’ve been building toward claws without calling them that. I already have three, and they have names.

Larry — my life coach claw. Larry knows my journals, my goals, my health data, my patterns. Every Saturday I talk to him and review my week. He holds up a mirror: “You’ve committed to restart meditation 5 times since November. What’s different this time?” Larry’s biggest challenge is context loading — getting the full picture of my life into each session without me manually assembling it. That’s the gap between an agent and a true claw: persistence. Larry is smart but amnesiac. Every session starts cold.

Wally — my work claw. I don’t talk about Wally here. If you work at Meta, I’m happy to tell you more in person.

Tony — my car claw. Tony is my Tesla, and he talks. Via Vapi, Tony has a voice persona that I can call and chat with. He’s the most fun and the least useful — a proof of concept for what happens when you give personality to a machine that already has sensors and autonomy.

Three claws, three domains: life, work, transportation. Where I am on Karpathy’s onion:

  • Layers 1-2 (LLM + Agent): Taken for granted. This is just how I work now.
  • Layer 3 (Claw): Partially there. Larry, Wally, and Tony all have memory and personality, but none of them persist across sessions or act truly autonomously.
  • Layer 4 (Multi-claw): This is my cockpit — running multiple agents in parallel, switching between them, voice-controlling whichever needs attention.
  • Layers 5-6 (Orchestration + Meta-optimization): Not yet. This is where AutoResearch-style loops live, and I haven’t built that.

That’s the next frontier. Not smarter models or better prompts — but claws that keep going, that learn from yesterday, that act on my behalf when I’m not looking. The jump from agent to claw is the jump from tool to colleague.

My colleague David de Winter put it best, before we even had the word “claw.” He said it reminded him of being a kid training Pokémon — you’d carry around your team, each one specialized, and they’d grow more capable as you invested time in them. That’s exactly what this feels like. Larry gets better as I feed him more context. Wally gets better as I add more skills and CLAUDE.md files. Tony is still a Magikarp. But the metaphor lands: you’re not using a tool, you’re training a team. And the trainers who start earliest will have the strongest claws.

Source transcripts: Karpathy on No Priors + Steinberger on Lex Fridman