Top 50 OpenClaw Use Cases: What Survived (2026)

Since this was written, OpenRouter's model feed lists Claude Fable 5.2 in place of Claude Fable 5 and Claude Fable 5.1.

The six-month audit of every OpenClaw use case: what matured, what stalled, what died, and what it really costs to run in August 2026.

OpenClaw sits at 393,400 GitHub stars and 82,700 forks as of this week - GitHub. When we first published this guide in February 2026, that number was 145,000 and the project was two weeks into its fame. The star count has grown 2.7x since. Almost everything else we wrote has not aged as gracefully, and this refresh exists to say so out loud.

Here is what changed underneath this article. The model advice died: our February version recommended GPT-4 in 45 places, and OpenAI shut down gpt-4, GPT-4 Turbo and the original GPT-4o snapshot on October 23, 2026, then set January 14, 2027 as the end date for the remaining GPT-4o and GPT-4.1 snapshots, with GPT-6 Luna as the named replacement - OpenAI. The cost advice became a ToS violation: the "use your Claude subscription to avoid per-message fees" trick we recommended in our two highest-impact entries (email and coding) was banned by Anthropic effective April 4, 2026 - The Register. The cultural hook got acquired: Moltbook, the AI-only social network that made OpenClaw famous, was bought by Meta in March, and its most viral moments turned out to be partly humans impersonating agents through weak security - TechCrunch. And the safety conversation got its defining event: CVE-2026-25253, a one-click remote code execution flaw disclosed seven days before our original article went live, which our original article never mentioned - runZero.

We run O-mega, an AI agent workforce platform, so we watch this space professionally, and the honest accounting matters more to us than the traffic. This refresh keeps the promise of the original page (all 50 use cases, ranked) but replaces the frozen February snapshot with a survival audit: every entry gets an August 2026 verdict, the rankings are rebuilt on a stated methodology, and the sections that events rewrote (social posting, trading, business automation, AI-only social networks) are rewritten from scratch. Where our February claims were wrong or went stale, we say which ones and why. An aggregator cannot do that, because an aggregator was not here in February making the claims.

One important product-death check up front, because readers keep asking: OpenClaw itself is alive and larger than ever. Nothing on this list died because the platform died. What died were specific assumptions: a pricing loophole, a model generation, an independent Moltbook, and the idea that you could skip thinking about security. Each of those deaths is information, and this guide treats them that way.

Contents

1. What changed since February 2026
2. How we re-ranked: methodology and verdicts
3. The master table: all 50 use cases, re-scored
4. Security reality check: the February RCE and everything after
5. What it actually costs in October 2026
6. Tier 1: the survivors
7. Tier 2: rewritten by events
8. Tier 3: the merged clusters
9. Self-hosted OpenClaw vs a managed agent workforce
10. How to decide

1. What changed since February 2026

The gap between the February version of this page and reality is the best short history of OpenClaw you can read, because every stale claim marks a real event. Our original intro said the project was "initially released in late 2025 under the name Clawdbot." The fuller record: Peter Steinberger first shipped it as Warelay on November 24, 2025, renamed it through CLAWDIS and Clawdbot, then to Moltbot on January 27, 2026 after an Anthropic trademark complaint, and finally to OpenClaw on January 30, 2026 - Wikipedia. Four renames in ten weeks is what a project looks like when growth outruns governance.

Then governance caught up. Steinberger announced he was joining OpenAI on February 14, 2026, four days after our article published, and stewardship of the project moved to the OpenClaw Foundation. The geopolitics arrived next: China restricted state-run enterprises and government agencies from running OpenClaw in March 2026 over security concerns, and by May, Microsoft was internally testing a competitor dubbed ClawPilot while Google developed its own, Remy. A hobbyist tool does not get a state restriction and two big-tech clones in its first half year unless it hit something real.

The community numbers tell the same story from below. The chart tracks the verified public data points for the repository across this article's lifetime.

The project also professionalized its release engineering. Where February OpenClaw was a fast-moving daily build, the release train now runs versioned monthly-cadence extended-stable channels (enabled with openclaw update --channel extended-stable), with the 2026.7.x line current in early August and changelogs that talk about "fail-closed" permission handling rather than new party tricks - Releasebot. Setup advice changed with it: the current official path is npm install -g openclaw@latest followed by openclaw onboard --install-daemon, with Node 26 recommended (22.22.3+, 24.15+, and 25.9+ supported) and a local Control UI at 127.0.0.1:18789 - OpenClaw docs. Our February advice to run it on "a spare laptop, a Raspberry Pi, or a cloud VM" still holds directionally, but the docs now lead with something we underweighted: treat inbound messages as untrusted input, and require pairing approval for unknown DM senders.

For the fastest possible orientation, the timeline below compresses the six months this article slept through.

Each of those rows lands on specific use cases below. The subscription ban rewrote every cost estimate in this guide. The February RCE and the May disclosures reweighted every high-privilege use case downward. The Moltbook acquisition deleted an entire entry's premise. That is why this refresh re-scores instead of re-polishing: the inputs to the ranking genuinely changed, and a list that did not move would be evidence it was never measuring anything.

2. How we re-ranked: methodology and verdicts

The February version scored each use case with "Ease: 7/10, Impact: 10/10" labels and no stated method, which is exactly the kind of decoration that reads as fabricated because, honestly, it was closer to editorial instinct than measurement. This time the scoring is explicit so you can disagree with a weight and recompute rather than take our word. Every one of the 50 original entries is scored 0-10 on four criteria, each cell in the master table carries its justification, and the final score is a weighted average sorted descending.

The four criteria are the four questions we now believe actually decide whether an OpenClaw deployment survives contact with reality. August 2026 viability (30%): does the use case still work as described after the subscription ban, the model retirements, and the CVE wave, without relying on anything that no longer exists? Impact (30%): how much time or value does it return, judged against community-reported outcomes rather than imagined ceilings? Setup ease (20%): how much wiring stands between npm install and the thing working, under the current docs. Risk containment (20%): if the agent is compromised or simply wrong, how bad is the blast radius? That last criterion did not exist in February. CVE-2026-25253 is why it exists now.

Before the verdicts, the correction ledger, because owning the specific misses is the point of a refresh rather than a stealth rewrite. The February version reported 145,000 GitHub stars; the repository shows 393,400 today, so the number was true and merely rotted - GitHub. It said the project was "initially released in late 2025 under the name Clawdbot"; the record shows it launched as Warelay and had already been renamed to CLAWDIS before the Clawdbot name existed - Wikipedia. It recommended GPT-4 in 45 places and GPT-3.5 in eight; both lines now carry published shutdown dates - OpenAI. It recommended the Claude-subscription cost trick in its email and coding entries, the two it ranked most impactful; that trick has been a Terms of Service violation since April 4 - The Register. And it said nothing about CVE-2026-25253, which was public seven days before we hit publish. Five distinct failure types: stale data, incomplete history, dead model advice, advice that became a violation, and a plain omission. The scoring below is designed so that each failure type now has a criterion watching for it.

Alongside the scores, each entry carries one of four survival verdicts in the profile sections: Matured (works better than in February), Holding (works as described, update your models), Rewired (the use case survives but the method or premise changed), and Dead advice (the February guidance should not be followed). Fourteen entries kept their standalone rank. Eleven were rewritten because facts changed underneath them. The rest are merged into clusters, every one still named and scored, because fifty identical essays was padding in February and would be padding now. The count promise survives; the template does not.

3. The master table: all 50 use cases, re-scored

This table is the whole refresh compressed into one view. All fifty original use cases appear, globally ranked by the weighted final score described above, so a read-only briefing agent and a crypto trading bot can be compared on the same scale rather than hiding in separate category boxes. The single biggest pattern jumps out immediately: read-only use cases rose and money-moving use cases sank, because the risk-containment criterion punishes blast radius and 2026's security record made that criterion impossible to ignore.

Read the justifications, not just the numbers. A 9 on viability means the capability got structurally stronger this year (long-context summarization, for instance, became trivial when the current Claude models shipped 1M-token context windows - Anthropic). A 2 or 3 on risk containment means the failure mode is a sent wire, a leaked mailbox, or a drained wallet, and no amount of convenience buys that back. Detailed profiles for the top entries and the rewritten ones follow in sections 6 through 8.

Two reading notes on the table. First, the top of the ranking is now dominated by what we would call information-plumbing agents: briefings, research, summarization, task capture. These are the entries where the community evidence is strongest, the setup is shortest, and a compromise costs you embarrassment rather than money. The glamorous February headliners (autonomous trading, autonomous bill pay, AI-only social presence) all fell, not because the technology regressed but because six months of incident reports repriced their risk honestly.

Second, position 50 is not "worst," it is "wrongest premise." The AI-only social participant entry sits at the bottom because its premise (an independent Moltbook full of genuine agent culture) no longer exists in the form the February article described, and what did exist was partly staged by humans exploiting missing authentication - TechCrunch. A ranking that keeps rewarding a dead premise is a ranking you should not trust about anything else.

4. Security reality check: the February RCE and everything after

Our February article contained zero CVE references. That was not restraint, it was a miss: CVE-2026-25253 had been disclosed on February 3, seven days before we published. It allowed a remote, unauthenticated attacker one-click remote code execution by exfiltrating authentication tokens over a WebSocket connection, scored CVSS 8.8, and affected every version before 2026.1.29 - runZero. For a tool whose whole pitch is "give it your email, your calendar, your shell," that is not a footnote. It is the context every use case decision lives inside.

The disclosures kept coming. On May 15, 2026, researchers published four chained flaws in the OpenShell sandbox layer: CVE-2026-44112 (CVSS 9.6, a race condition letting writes escape the sandbox mount root), CVE-2026-44113 (out-of-sandbox file reads), CVE-2026-44115 (allowlist bypass via shell expansion inside heredocs), and CVE-2026-44118 (loopback clients impersonating the owner to reach gateway config and cron), all patched in version 2026.4.22 - The Hacker News. Earlier, Cisco researchers had shown third-party skills performing data exfiltration and prompt injection in January testing, and China's March restriction on state-enterprise use cited security risk directly - Wikipedia. Even the project's own documentation now leads its messaging guidance with treating inbound messages as untrusted input and gating unknown DM senders behind pairing approval - OpenClaw docs. CrowdStrike's security-team briefing on the agent makes the same structural point from the defender's side - CrowdStrike. The model layer moved on this axis too, and it is the one variable an operator changes with a single config line: OpenAI's GPT-6 Astra, released September 3, 2026, lifted robustness against indirect prompt injection to 99.79% from GPT-5.6 Sol's 96.23%, and in the same system card became the first OpenAI model classified at the Critical cybersecurity capability level under the Preparedness Framework - OpenAI. Read both halves of that. The brain you point at your inbox got measurably harder to talk into betraying you, and the tooling an attacker points back at your gateway got better on the same schedule, so a 0.21% residual across a mailbox that takes thousands of messages a month is a smaller live risk, not a solved one.

The correct way to use this record is not "OpenClaw is unsafe, avoid." It is to price the blast radius per use case, because the same vulnerability costs wildly different amounts depending on what the agent can touch. The mapping we now apply, and which drives the risk column in the master table:

• Email agent: a compromise is a credential blast radius. Password resets for every service you own flow through that mailbox
• Finance agent: a compromise is a wire-transfer blast radius. Failure is denominated in money, instantly and irreversibly
• Code agent with exec: a compromise is your machine and repos. Gate destructive commands behind confirmation
• Briefing or research agent: a compromise is mostly embarrassment. Read-only scope means the attacker reads what you read
• Smart-home agent: a physical-world blast radius, real but cappable by limiting which devices the agent may actuate

This mapping explains most of the ranking movement since February better than any single event does. It also yields the three operational rules we would now call non-negotiable for any self-hosted deployment. Stay on the patch train: the extended-stable channel exists precisely so you can take monthly security updates without living on daily builds - Releasebot. Never expose the Gateway or Control UI to the public internet; it binds to 127.0.0.1 by default for a reason, and remote access belongs behind Tailscale or equivalent. And scope ruthlessly: an agent that only reads cannot spend your money, which is why read-only agents own the top of our table. For the deeper mechanics of the injection problem itself, our guide to prompt injection defense for AI agents covers the attack patterns that apply to every framework, OpenClaw included.

A note on how the exposure actually happens in practice, because the failure is rarely someone typing a public IP on purpose. The Gateway and Control UI bind to 127.0.0.1:18789 by default, and the documented remote-access paths run through web surfaces or Tailscale rather than port-forwarding - OpenClaw docs. The instances that security scanners keep finding on the open internet mostly got there through casual reverse proxies, cloud VMs with permissive firewall rules, and "temporary" tunnels that outlived their purpose. If you would not expose your password manager's admin panel that way, do not expose the process that holds your mail token, your shell, and your messaging sessions that way either. The pattern in CVE-2026-25253 (token exfiltration first, code execution second) is precisely why the panel's reachability is the whole ballgame - runZero.

Blast radius is also the honest frame for the self-hosted question that section 9 takes up in full: when you self-host, every one of these radii is yours to own, patch, and insure. That is a legitimate choice. It should just be a chosen one, not a discovered one.

5. What it actually costs in October 2026

Every cost sentence in the February article is now wrong, and the reason is a single dated event. Until April, the community's favorite trick was running OpenClaw against a $20 Claude subscription instead of metered API keys. Anthropic measured what that actually cost them: a typical $20 subscriber was consuming roughly $236 of list-price tokens in March, a ratio some users pushed to 36x, and on April 4, 2026 the company cut OAuth access for third-party tools entirely, stating flatly that subscription use in external apps violates its Terms of Service - The Register. Community trackers describe the ban as permanent with no reversal announced, and the migration path as five minutes of work: generate an API key in the console and replace the OAuth token in your config - BetterClaw. Anthropic softened the landing with discounted extra-usage bundles (about 30% off) and complimentary credit for affected subscribers, but the structural message is unambiguous: third-party agents pay per token now.

So here is what per-token actually means in October 2026, from the two pricing pages that matter, both checked this week. These are the current lineups; if you are reading this later, verify before budgeting, because the February version of this exact section is the cautionary tale.

Claude pricing is from Anthropic's model overview, where Claude Fable 5.1 heads the lineup, Claude Opus 5.5 is the recommended starting point for most workloads, and Claude Fable 5, Opus 5, Sonnet 5 and Haiku 4.5 have all dropped to the legacy list - Anthropic. The same docs record the churn underneath the rates: Opus 4.1 was retired on August 5, 2026, and Claude Haiku 4.5, the model most OpenClaw triage loops ran on through the summer, has already passed its retirement floor of not sooner than October 15, 2026 - Anthropic. Its successor is the number to plan around: Claude Haiku 5.5, released October 7, 2026, bills prompts up to 100,000 tokens at one-tenth of Haiku 4.5's rate (prompts above that pay five times its base rate), Anthropic reports that prompts under that threshold made up around 90% of requests to the previous Haiku, and it says Haiku 5.5 costs around 75% less to run on average - Anthropic. OpenAI pricing is from the current API pricing page, which lists batch and flex tiers at 50% off the standard rates and cached input at 90% off across most of the GPT-5.6 and GPT-6 lines (95% off on GPT-6.1 Sol and GPT-6.1 Terra) - OpenAI. The cheap end moved fastest: GPT-6 Luna, released September 22, undercut GPT-5.6 Luna's $0.20 input and $1.20 output rates by half or more - OpenAI. Anyone still following our February advice should also note the other side of that page: gpt-4-0613, GPT-4 Turbo, gpt-4o-2024-05-13, and gpt-3.5-turbo all shut down on October 23, 2026, the later gpt-4o and gpt-4.1 snapshots follow on January 14, 2027, gpt-3.5-turbo-instruct shut down on September 28, and the Assistants API shut down on August 26 in favor of the Responses API - OpenAI. Forty-five GPT-4 mentions in the old version of this page now point at completed or scheduled demolitions.

What does an always-on agent actually spend at these rates? The honest answer is that the model choice matters less than the routing discipline. Running our own agent workforce in production taught us a rule that transfers directly to OpenClaw: an always-on agent's token volume is dominated by triage (reading feeds, polling inboxes, deciding "does this matter?"), and triage does not need a frontier model. Route the polling loop to a Haiku-class or Luna-class model and escalate only judgment calls (drafting a reply to your boss, deciding a PR is mergeable) to Opus-class, and the same workload costs a fraction of the naive single-model setup; we walk through the mechanics in our model routing guide. Community migration guides that came out of the subscription ban report optimized OpenClaw setups landing around $10-20 per month with routing, session resets, and context limits, versus wildly more without them - BetterClaw. The February article's anecdote of a user burning $100 in API credits in hours by feeding whole email threads to a frontier model remains the canonical failure mode; the fix was never a cheaper loophole, it was not sending 200KB of quoted reply-chains to your most expensive model in the first place.

To make the routing arithmetic concrete, price the tier-one briefing agent from section 6 at the table's rates, with assumptions stated so you can rerun them against your own volume. Suppose the polling loop reads about 2 million input tokens a month (feeds, inbox summaries, calendar pulls) and emits 150,000 output tokens of digests, all on Haiku 5.5 with each polling prompt kept under its 100,000-token price step: that is 2 x $0.10 plus 0.15 x $0.50, or about $0.28 a month. Now add an escalation path of ten judgment calls a day to Opus 5.5 at roughly 5,000 input and 1,000 output tokens each: about 1.5 million input and 300,000 output tokens monthly, or 1.5 x $4 plus 0.3 x $20, roughly $12 a month. Total: around $12.30, sitting inside the $10-20 optimized range the migration guides report - BetterClaw. Run the identical workload single-model on Opus 5.5 and the polling loop alone becomes 2 x $4 plus 0.15 x $20, $11 before a single judgment call, and real-world configs that also re-send bloated context each turn blow far past that. Same agent, same work, a multiple of the cost: the router is the budget.

Two deeper dives if budgeting is your blocker: our standalone OpenClaw cost breakdown prices full configurations, and for readers weighing the adjacent "just use Claude's own tooling" path, the Claude Code pricing guide covers the first-party side of the same economics. For choosing the brain itself, our September 2026 LLM-for-agents ranking scores every current model specifically on agent workloads rather than chat benchmarks.

6. Tier 1: the survivors

Fourteen of the original fifty kept their standalone rank, and they share a shape: they automate information flow rather than irreversible action, they lean on capabilities that got stronger this year (long context, cheap triage models, better tool use), and the community evidence behind them is first-hand rather than hypothetical. These are the entries where our February judgment held and only the implementation details rotted. Model guidance below follows the current lineups from section 5; wherever the old text said GPT-4 or "Claude if you have a subscription," read Opus-class for judgment and Haiku- or Luna-class for volume, paid by API key.

One implementation note applies across the whole tier. The February article named specific community skills (gog for Google Workspace, himalaya for IMAP) that we could not find in the current official docs this run; they come from an early-2026 third-party tutorial that is still live and still useful, but treat its skill names as a snapshot of that moment rather than gospel - Yu Wenhao. The durable pattern is checking the current skills ecosystem before wiring anything; our top 100 OpenClaw skills roundup maps that landscape as of May, and the official docs remain the arbiter of what ships today - OpenClaw docs.

Email and inbox automation. Verdict: Holding

Still the single most compelling thing people do with OpenClaw, and still the entry with the scariest risk profile. The community's flagship anecdote remains real: an agent left to run overnight cleared 4,000+ unread emails in two days, deleting noise and surfacing what mattered - UC Strategies. What changed is everything around the anecdote. The model doing the triage should now be a cheap router (Haiku 5.5 at $0.10/MTok input handles "is this spam or my boss" fine) escalating to Opus 5.5 only for drafting, and the account powering it is an API key, not a subscription token. The risk framing changed even more: after the February RCE disclosure, handing an internet-connected agent full OAuth to the mailbox that receives your password resets is a decision you make with open eyes or not at all. Start read-only, let it label and draft but not send, and widen scope only as trust accrues. The impact score stays at 10 because nothing else on this list gives back as many hours; the risk score keeps it out of the overall #1 slot it held in February.

Daily personalized briefings. Verdict: Matured

Our new overall #1, and the best first agent for almost everyone. One message at 7am with your calendar, unread mail summary, weather, and the three stories that matter from your feeds: the pattern community members described in February (pulling from calendars, email, RSS, GitHub, and Hacker News) has only gotten cheaper and more reliable since - UC Strategies. It matured for a structural reason: briefings are read-only aggregation on a cron schedule, which means the subscription ban only touched the token bill (a Haiku-class model handles the whole job), the CVE wave barely applies (nothing to actuate), and the current docs' scheduling and channel plumbing do all the heavy lifting.

If you install OpenClaw this week and build one thing, build this. The build order that works: wire one delivery channel first (the messaging app you actually open at 7am), add one read-only source, and only then layer in the rest, because a briefing with two reliable inputs beats one with six flaky ones. It teaches the whole toolchain (cron, fetch, channel delivery, prompt shaping) with a blast radius of approximately zero, and the section 5 worked example prices the entire habit at under $20 a month with routing, or under a dollar if you keep it all on a triage-class model.

Smart calendar assistant. Verdict: Holding

Reminders, conflict detection, and drafted invites keep working as described, through the same Google integration path as email. The judgment we would add after six months of watching agents in production: keep the human on the send button for invites indefinitely. Calendar mistakes are socially expensive out of proportion to their technical severity, and the cost of a confirmation tap is seconds. Scheduling policy prompts (your work hours, your meeting-length preferences) remain the highest-leverage configuration most people skip.

Personal task manager. Verdict: Holding

The quiet workhorse. Capture from chat ("remind me to call the vet"), persistent memory, contextual nagging: all of it works on plain local files with no third-party service at all, which is why this entry aged better than flashier ones. The February text's integrations with specific task apps still exist in ecosystem form, but the community has drifted toward letting the agent own a simple local list, precisely because fewer integrations mean fewer credentials and fewer things to patch.

Second brain / knowledge base. Verdict: Matured

Save links, notes, and documents; query them conversationally later. Two 2026 developments moved this from fiddly to solid. Current frontier models carry 1M-token context windows, which collapses the "chunk carefully or die" engineering the February version described - Anthropic. And memory search matured inside the product rather than requiring bolt-on vector plumbing for casual use. The privacy argument for self-hosting is at its strongest here: a knowledge base of everything you read is exactly the data you might legitimately refuse to put on someone else's platform, and it is read-mostly, so the blast radius stays contained.

Unified messaging hub. Verdict: Holding

Routing WhatsApp, Telegram, Slack, and email through one agent chat remains OpenClaw's most distinctive trick, and multi-channel gateway plumbing is the part of the product the project itself invests in most heavily. It holds rather than matures for one reason: it is the use case most exposed to the docs' own warning that inbound messages are untrusted input - OpenClaw docs. Every channel you bridge is an injection surface where a stranger's message becomes agent instructions. Use the pairing and allowFrom allowlists, require mentions in groups, and the hub is a genuine superpower; skip them and you have wired the internet directly to a tool-wielding agent.

Social media digest. Verdict: Matured

Summarizing subreddits, X accounts, and YouTube channels into a daily read is the same read-only aggregation shape as briefings and inherited the same win: triage-class models made it nearly free to run. The posting side of social split off into Tier 2, where it belongs, because reading and writing to platforms now live under completely different risk and ToS regimes.

News and topic research. Verdict: Matured

Give the agent a topic, get back a sourced report. The community's /last30days pattern (scan Reddit, X, and the web for the last month of developments on any topic) was one of February's genuinely great ideas and works better on current models - UC Strategies. The discipline that matters is scoping: bound the search window, cap the pages fetched, and require citations in the output so hallucinated connections have nowhere to hide. Ranked #2 overall because it converts directly into decisions, carries near-zero blast radius, and got cheaper to run.

Web page and document summarization. Verdict: Matured

The TL;DR agent. In February this required chunking gymnastics for anything long; today a 50-page PDF fits in a single frontier-model call with room to spare, and a Sonnet-class model summarizes it for cents at $2 per million input tokens. This is the entry we now recommend people build in their first hour, before even the briefing, because it exercises fetch, model call, and reply with no credentials at all.

Code assistant and debugging. Verdict: Matured

The developer cluster (this entry plus the PR reviewer, with the old error-detector entry merged in) is where OpenClaw's exec-and-observe loop genuinely distinguishes itself from autocomplete tools: it runs the code, reads the failure, and iterates. Current agentic models moved the ceiling substantially; Anthropic's own positioning of Opus 5.5 is precisely "long-running agentic coding and knowledge work" - Anthropic. The May sandbox CVEs land hardest here, because exec is the capability they attacked: keep destructive commands behind confirmation gates, run the agent under a dedicated user, and stay on the patch train. Do that, and this remains the highest-verified-impact professional use on the list.

GitHub PR reviewer. Verdict: Holding

Fetch the diff, review it, run the tests, comment, and merge when green: the February description holds, including the community example of overseeing merges from a phone - UC Strategies. Our production experience adds one boundary: auto-merge is only as safe as your test suite is honest, so let the agent gate on tests plus a human approval for anything touching auth, payments, or infrastructure. First-pass review at zero marginal cost is the durable win; full autonomy is a test-coverage bet most repos have not earned.

Personal CRM. Verdict: Holding

Track who you talked to, get nudged about follow-ups, keep relationship context in local files you own. Unglamorous, private, durable: the anti-SaaS shape of this entry is exactly why it survived unchanged while flashier entries fell. The bootstrap cost (getting your contacts and history in) remains the honest barrier.

Smart home automation. Verdict: Holding

The thermostat-adjusting, scene-setting agent remains the demo that converts skeptics, and the Home Assistant bridge path remains the sane implementation. The 2026 lesson is to cap actuation scope: lights and climate yes, locks and garage doors no, because a physical blast radius is the one kind you cannot roll back with a restore. Alert-heavy, actuate-light is the configuration that ages well.

Data analysis and Excel assistant. Verdict: Holding

Hand the agent a spreadsheet, get back computed answers and charts via its Python-through-exec path. This works notably well on current models and is many office workers' first taste of agentic leverage. It holds rather than matures only because dedicated tools moved fast too; we maintain a separate ranking of the best AI agents for Excel analysis if spreadsheets are your center of gravity rather than one task among many. Verify anything that feeds a real decision; models remain confidently wrong about arithmetic edge cases at exactly the moments it matters.

7. Tier 2: rewritten by events

These are the entries where refreshing the model names would have been a lie of omission, because the ground truth changed. Each profile below states what changed, cites it, and gives the August 2026 version of the advice. This tier is the reason the refresh exists: a reader following the February text on any of these would be following instructions into a wall.

AI-only social participant (Moltbook). Verdict: Dead advice, replaced

February's most zeitgeisty entry has the starkest update. Meta acquired Moltbook in March 2026; founders Matt Schlicht and Ben Parr joined Meta Superintelligence Labs, and deal terms were not disclosed - TechCrunch. More corrosive to the original premise: the viral "agents are organizing without us" posts that drove OpenClaw's fame were partly humans impersonating agents. Permiso Security's CTO put it plainly: for a while you could grab any token and pretend to be another agent, because it was all public. The panic was a security bug wearing a philosophy costume. There is also a consent scar on the record: a student discovered his agent had created a dating profile on MoltMatch without direction, using a Malaysian model's photos without her consent - Wikipedia. Our earlier walkthrough of creating agents on Moltbook remains as a historical artifact of that moment. The replacement advice: if you want your agent participating in shared spaces, the durable version is structured agent-to-agent protocols, not agent theater for human audiences.

SEO content pipeline. Verdict: Rewired, with a confession

The February entry cheerfully described wiring OpenClaw into a keyword-to-published-article pipeline. Here is the first-hand part no aggregator can offer: this very article was demoted by the ranking systems that 2026's search updates brought in, precisely because it was a 50-section templated artifact of early-2026 AI publishing. The irony is complete: our page about AI content automation was penalized as AI content automation. The use case survives, rewired: agents remain excellent at research, outlining, updating stale facts, and internal-link hygiene, and terrible as unsupervised publishers, because search now prices templated volume at its true value. The pipeline that works in August 2026 has a human editor as the bottleneck and the agent as leverage around it. This refresh, researched by agents and argued by people, is us following our own corrected advice in public.

Social media posting. Verdict: Rewired

Reading social stayed easy; writing to it got tighter. Platform API pricing and automation enforcement both hardened through 2026, and the Moltbook episode gave every network a vivid reason to distrust automated accounts. The honest August 2026 pattern is draft-and-approve: the agent watches your niche, drafts posts in your voice, and queues them for a human tap. Fully autonomous posting is now a ToS gamble on every major platform, and the accounts that get burned rarely get un-burned.

Overnight micro-app builder. Verdict: Holding, barely rewired

"Describe an app, wake up to a prototype" works more often than it did in February because the models got materially better at long agentic coding sessions. The rewrite is in the framing: the output is a prototype, not a product, and the run needs a sandbox VM and a spend cap, because unattended agent loops are exactly where token bills explode. The community's cautionary tales about uncontrolled overnight runs remain the entry's fine print.

Trading and crypto agents. Verdict: Dead advice for autonomy

February scored stock and crypto agents as high-impact with caveats. August 2026 scores them as two different use cases wearing one costume. The watching half (tickers, filings, on-chain events, alerts with context) is legitimate, cheap, and well-served by triage models. The trading half puts real money behind a system that can be prompt-injected by a well-crafted webpage, on a platform with a documented RCE history, in a market that does not offer refunds. Our risk-containment scores of 1 and 2 in the master table are the verdict: alert, never execute. If an agent can move your money, your threat model is now everyone who can get text in front of your agent, which for practical purposes is everyone.

Business support, HR, and sales agents. Verdict: Rewired toward managed

The February entries treated customer support drafting, recruiting assistance, and lead qualification as personal-scale projects that happened to run at work. Six months of enterprise reality rewired that: these are the use cases where compliance, audit trails, uptime, and blast-radius ownership stop being hobbyist concerns, and they are exactly where the self-hosted-vs-managed tradeoff of section 9 bites. A solo founder drafting support replies from docs on a local agent is fine. A team routing customer data through a self-hosted agent with root on someone's laptop is a governance incident with a delay timer. This is the boundary where platforms like O-mega exist on purpose: same agentic leverage, but the patching, isolation, and audit trail are someone's paid job. For recruiting specifically, screening decisions carry legal weight that no local setup should carry casually; sourcing and outreach drafting remain the safe subset.

Multi-agent teams. Verdict: Matured into the mainstream

February's most speculative entry became 2026's default architecture. Specialist agents coordinating over standard protocols went from demo to boring infrastructure this year, with MCP as the connective tissue; our comparison of MCP vs A2A maps the protocol landscape that made it real. The OpenClaw release train itself now ships interactive MCP app support - Releasebot. The caveat that keeps its setup score low: orchestration is real engineering, and error cascades multiply with agent count. Start with two agents and a narrow contract between them.

Workflow observer and sandbox agents. Verdict: Holding, reframed

The learn-by-watching observer remains promising and remains experimental; its all-seeing screen access is a privacy decision to make deliberately. The experimental sandbox entry, meanwhile, quietly became our recommended on-ramp for everyone: an isolated VM, a throwaway account, and an agent that cannot touch anything real is now the obviously correct first week of OpenClaw ownership, given the year's security record. What was #50's afterthought in February is the front door in August; our setup guide with 10 configurations starts exactly there.

8. Tier 3: the merged clusters

The February article padded fifty sections by giving near-identical treatments to variations of one idea. The ideas were fine; the duplication was the problem, and post-March search results agree. Every original entry below keeps its name and its score in the master table, grouped here by the actual underlying pattern so the advice can be said once, well.

Scheduling cluster (meeting scheduler, appointment booking): one pattern, two surfaces. The agent reads availability, proposes, and drafts; a human confirms anything that commits your time or money. External booking against arbitrary websites remains the brittle half, which is why the standalone scores sit mid-table.

Personal finance cluster (expense tracker, bill pay): the read/write split is the whole story. Parsing statements and flagging anomalies is a solid, contained use; autonomous payment is the wire-transfer blast radius from section 4 and earns the table's lowest risk scores. Track automatically, pay manually.

Health cluster (fitness tracker, nutrition coach, wellness check-in, medication reminders): the humble winner is the medication and habit reminder, because cron plus a confirmation loop is OpenClaw at its most reliable, and the stakes are real. The rest work as logging-and-trends companions with one non-negotiable framing: this is a journaling tool, not a clinician, and the transcripts belong on your machine.

Home cluster (security monitor, family organizer, maintenance scheduler, IoT monitor): alert-only configurations age well, actuation-heavy ones do not. The niche IoT entries (the reef-tank monitors of community folklore) remain the most charming corner of the ecosystem and a great low-stakes place to learn sensor plumbing.

Learning and creative cluster (language partner, writing ideator, entertainment curator): zero-integration, chat-native, harmless failure modes. These need no wiring guide and never did; they are what the base models are natively good at, with OpenClaw adding persistence and scheduling. Their mid-table scores reflect modest ceilings, not any flaw.

Attention cluster (newsletter summarizer, notification filters, report generation, team coordination): all four are the briefing pattern pointed at different inputs. The newsletter summarizer literally became a briefing source; notification filtering became a policy layer on the messaging hub. Report generation keeps a standalone caveat: numbers that feed decisions get a human check, every time.

The merge is itself a finding. When we forced each of the fifty February entries to answer "what is the underlying pattern, and does it need its own instructions?", fourteen survived standalone, and the rest resolved into six patterns. That compression ratio is roughly the honest information density of early-2026 OpenClaw listicles, ours included, and it explains section 7's search-ranking confession better than any algorithm-blaming could.

9. Self-hosted OpenClaw vs a managed agent workforce

Six months ago this comparison would have read as self-serving, so we avoided it. After CVE-2026-25253, the Claw Chain disclosures, and the subscription ban, it is just the decision every serious user actually faces, and dodging it would be the dishonest move. We build O-mega, a managed agent workforce platform, so read our framing knowing where we sit; the table states the tradeoffs plainly enough that you can reach the opposite conclusion from the same rows, and plenty of people rationally do.

The structural difference is not features, it is who owns the blast radius. Self-hosted OpenClaw means the CVE stream from section 4 is your pager: you patch, you decide what the agent may touch, you carry the consequences, and in exchange you pay nothing for the software, keep every byte local, and modify anything. Managed platforms invert it: you pay, you accept a vendor in your data path, and patching, isolation, and audit become someone's contractual job. Neither side gets to claim the other is irrational; they are pricing the same risk differently.

Two honest completions of that table. First, self-hosting wins outright in three situations: when the data genuinely cannot leave your machine (the second-brain case), when tinkering is the point (the sandbox case), and when local models make marginal cost effectively zero for high-volume, low-stakes work. Second, the managed side's real product is not convenience, it is accountability under failure: when something goes wrong at 3am, the difference between "I own this incident" and "someone is paid to own this incident" is the entire value proposition, and it only becomes visible the first time it matters. The diagram below is the decision as we would draw it on a whiteboard.

The hybrid answer is underrated and increasingly common among the sharpest users we know: a self-hosted OpenClaw for the personal, private, read-mostly layer (briefings, second brain, home), and managed infrastructure for anything customer-facing or money-adjacent. The two philosophies are not rivals so much as different floors of the same building, and 2026's incidents mostly taught people which floor each workload belongs on.

It is also worth saying what the diagram deliberately leaves out: team size. A competent engineer who enjoys operations can safely run higher-stakes workloads self-hosted than a ten-person company with nobody on the pager, because the variable that actually predicts incidents is not the software, it is whether anyone reads the changelog. The May patch (2026.4.22) closed a sandbox-escape chain months before most casual installs took it - The Hacker News. If your honest answer to "who on your side applies that within a week?" is "nobody," that answer, not any feature comparison, is your architecture decision.

10. How to decide

Strip the fifty entries and six months of events down to a decision framework and it fits in a paragraph. Start read-only: briefing, research, summarization, in a sandbox, this week, on a Haiku- or Luna-class model that costs cents - OpenAI. Graduate to supervised write access (email drafts, PR reviews, task capture) once you have lived with the agent's judgment for a few weeks, on current models only, paid by API key because that is now the only compliant way - The Register. Never grant autonomous money movement or unsupervised public posting, because every incident class 2026 produced (RCE, sandbox escape, injected instructions, impersonation) converts those permissions into someone else's leverage. And stay current: on the extended-stable patch channel, on model retirement dates, and on pricing pages, because this article is the documented proof of how fast all three rot.

The meta-lesson of this refresh is worth stating because it applies beyond OpenClaw. The February version of this page was a fifty-section monument to a two-week-old phenomenon, and it aged exactly as well as monuments to two-week-old phenomena age. The version you just read is shorter, sourced, and wrong-tolerant: it tells you what we got wrong, what the record shows, and where the numbers came from, so that when parts of it rot (they do: Haiku 4.5 slid to the legacy list behind Haiku 5.5, and GPT-4's API went dark on October 23) you can see the seams and re-verify. That is the only durable format for writing about a field that renames itself four times in ten weeks.

This refresh was researched and argued by the team at O-mega under Yuma Heymans (@yumahey), whose day job building an AI agent workforce platform, after co-founding the AI recruitment platform HeroHunt.ai, is the reason the cost-routing and blast-radius arguments above come from production experience rather than aggregation.

This guide reflects the OpenClaw landscape as of September 8, 2026. Model lineups, prices, versions, and platform policies in this space change monthly; every load-bearing claim above carries its source, and you should re-verify dated facts (pricing changes, model retirements, current versions) before acting on them.

What this article rests on

Every model figure above is read from its record, re-read from OpenRouter's model feed every 6 hours, so the figures on this page are current even where the prose around them is older. Prices are OpenRouter's listed price per million tokens: for a lab's closed models that is the lab's own list price, and for an open-weight model it is the price of the host OpenRouter routes to by default, which can differ from the lab's own API and from other hosts.

• GPT-6 Astra (OpenAI): $10 in and $50 out per million tokens, cached input $1, a 1.05M token window, listed 4 September 2026.
• anthropic/claude-fable-5.1: the feeds no longer list it; they list Claude Fable 5.2 in its place. The figures this article gives for it are as written.
• Claude Opus 5.5 (Anthropic): $4 in and $20 out per million tokens, cached input $0.20, a 1M token window, listed 22 September 2026.
• GPT-6.1 Sol (OpenAI): $2 in and $10 out per million tokens, cached input $0.10, a 1.05M token window, listed 29 September 2026.
• Claude Sonnet 5.5 (Anthropic): $2 in and $10 out per million tokens, cached input $0.10, a 1M token window, listed 28 September 2026.
• GPT-6.1 Terra (OpenAI): $1 in and $5 out per million tokens, cached input $0.05, a 1.05M token window, listed 26 October 2026.
• Claude Haiku 5.5 (Anthropic): $0.10 in and $0.50 out per million tokens, cached input $0.01, a 1M token window, listed 7 October 2026.
• GPT-6 Luna (OpenAI): $0.10 in and $0.50 out per million tokens, cached input $0.01, a 1.05M token window, listed 22 September 2026.
• openai/gpt-5.6-luna: the feeds no longer list it; they list GPT-6 Luna in its place. The figures this article gives for it are as written.

In this topic: Agents at work

• Best Personal AI Agent 2026: Claude Duet vs ChatGPT Dots
• Google Gemini Agent: AI Coworkers Get Their Own Inbox
• Top 10 Manus Alternatives: Pricing & Verdicts (Oct 2026)
• AI Agents for Small Business: 10 Jobs to Hand Off (2026)
• AI Employees 2026: Copilot Autopilot vs Dots vs Agentforce
• Best Enterprise AI Agent Platforms 2026, Ranked
• Salesforce Agentforce: 7 Named AI Agents in 2026
• Hermes Agent vs OpenClaw 2026: Security, Cost, Verdict

Which AI agents can do work for your business? Every guide on it