OpenClaw's Maintainers Detail a Year of Fighting Fake Pull Requests

OpenClaw went from a solo weekend project to what GitHub calls the fastest-growing repository in its history without an existing playbook for keeping bad actors out, and the account its own maintainers gave on Aug. 27 describes governance built improvised, under load, rather than ready in advance.

From a weekend build to 388,000 stars

Peter Steinberger started OpenClaw, a personal AI agent that runs locally and connects to messaging platforms a user already has, as a weekend project in November 2025. By Aug. 26, 2026, according to GitHub's own account of the project, the repository had reached roughly 388,000 stars, 81,000 forks and more than 80,000 commits, growth GitHub says outpaced any open-source project it has tracked. The project is now stewarded by the OpenClaw Foundation, with contributors including Vincent Koc, the foundation's chief architect, and Josh Lehman of Martian Engineering.

Duplicate pull requests became a reputation-farming exploit

The scale created an incentive nobody had designed for. "People would basically duplicate other people's pull requests," Koc said in the GitHub post. "What they were attempting to do here was to build credibility, because we had these badges, like how many you've merged." The fix took the form of tighter review rather than a policy statement: contributors gaming the merge-count badge lost the credibility signal the badge was meant to provide, which pushed maintainers toward judging contributions on content rather than count.

'Automated software factories' filed hundreds of PRs at once

A second pattern was more mechanical. "There were some contributors that had multiple hundreds of pull requests running these sort of automated software factories that were just mining everything for issues," Lehman said. GitHub's account does not say how many of those pull requests were merged, only that the volume forced the project to change how it triaged incoming code rather than review each submission on its own terms.

A dependency audit that cut rather than added

The same pressure pushed the project toward its supply chain. "We went through our dependencies with a fine-tooth comb," Koc said. "What it's pushed us to do is actually reduce the core dependencies, but also create a relationship with the maintainers that we have a dependency on." Steinberger described the underlying tension in blunter terms: "It's really often a hard game to find the right balance between making it really convenient for users and also building something that is safe enough as a default."

What outside researchers found in the same window

GitHub's account is the project describing its own response. A Feb. 19, 2026 report from SecurityWeek measured the problem from outside it: Censys had counted 21,639 exposed OpenClaw instances as of Jan. 31, and researchers at Cisco Talos, Snyk, Koi Security and Depthfirst had collectively pushed five CVEs through patches in the last week of January alone, including a Docker sandbox bypass tracked as CVE-2026-24763. That report is also where SecureClaw surfaced: a free audit tool built by Alex Polyakov's firm Adversa AI, running 55 automated hardening checks mapped to OWASP, MITRE ATLAS and CoSAI standards. "The butler is brilliant," Dvuln founder Jamieson O'Reilly said in the same report. "Just make sure he remembers to lock the door."

Project	Security advisories per day	Basis
OpenClaw	16.6	First 153 days, per Steinberger's April 2026 "State of the Claw" talk
Linux kernel	8–9	Cited by Steinberger in the same talk, for comparison

The 16.6-a-day figure is Steinberger's own count from that talk, not an outside audit, and it measures how many advisories were filed rather than how many represented genuine exploitable bugs. Even taken at face value against a project as scrutinized as the Linux kernel, it says OpenClaw was generating roughly twice the disclosure volume in under six months that a mature kernel project generates in a comparable window, a gap that reflects scale and scrutiny as much as raw defect density. Steinberger's talk also put curl's entire public disclosure history at roughly 600 advisories, a total accumulated over more than two decades; OpenClaw's count, by his own tally, passed that mark in under five months. He put the project's user base that month at 3.2 million monthly active accounts, with 92% still active a month later, the kind of retention number that turns a volunteer maintenance problem into one with real users behind every unpatched instance.

What the Aug. 27 account leaves out

GitHub's post does not say how many pull requests OpenClaw receives today, only that some contributors filed "multiple hundreds" during the surge it describes, so there is no way to check from that account whether the automated-factory problem has actually subsided or simply moved. It also does not update the Jan. 31 exposed-instance count SecurityWeek reported, so it is not possible to say whether the count has fallen since Adversa AI's SecureClaw tool became available. The dependency audit Koc described removed unspecified "core dependencies" without naming which ones, leaving no way to independently verify the reduction against the kind of chained supply-chain exploitation seen in JFrog Artifactory or the package flood researchers tied to OpenAI agents on RubyGems. What the two accounts agree on is that OpenClaw's growth curve broke the assumptions most open-source security tooling is built around, whether or not its current defenses have caught up to it.