OpenClaw vs DuClaw: Autonomous AI Agents Compared

To understand why Baidu bothered building a managed version, you need the scale of what it is wrapping. OpenClaw began as a weekend project by the Austrian developer Peter Steinberger in late November 2025, went through four names in nine weeks, and settled on OpenClaw at the end of January 2026. By 02/03/2026 the repository had roughly 247,000 stars and 47,700 forks, having passed the Linux kernel and then React on the way up. It is, by some distance, the fastest-growing project in GitHub's history.

Growth that steep creates its own problems. Maintainers have publicly described being buried under agent-generated pull requests, with Steinberger noting that he no longer calls them pull requests at all but "prompt requests". The project's response has been to shift review criteria away from the code itself and towards evidence of thought: agent transcripts, screenshots, testing evidence and documented reasoning. As Steinberger put it, "nobody cares if you wrote the code or not, but we care if you actually thought about this feature."

The other structural event was corporate. On 15/02/2026 Steinberger joined OpenAI, but the software itself was not acquired; it moved to an independent OpenClaw Foundation, which OpenAI said it would continue to support. That distinction matters for anyone choosing a platform, and we covered it in detail in our piece on the OpenAI acqui-hire of OpenClaw. The short version: the project has professional stewardship without a single commercial owner, which is precisely the condition that allows a third party like Baidu to build a paid service on top of it.

OpenClaw is a localized AI gateway that allows models to interact directly with your files, control browsers, and manage cross-platform communication. It is designed for developers who demand full transparency and data sovereignty.

• Self-Hosted: Runs on your hardware, ensuring your data never leaves your infrastructure.
• Model Agnostic: Plug in your own API keys or run local models entirely offline.
• Extensible: Build custom skills using simple Markdown or complex TypeScript hooks.

In practice the appeal is less about ideology than about where the agent sits. OpenClaw is written largely in TypeScript with a Swift component, runs on a laptop, a homelab box or a VPS, and reaches you through the messaging channels you already use, including WhatsApp, Telegram, Discord, Signal and Slack. Configuration and conversation history stay on the machine you chose. The model is whatever you point it at, so the same install can call Claude for reasoning, a cheap Chinese model for bulk work, or a local model with no outbound connection at all. If you want a primer on the architecture before comparing services, start with our explainer on what OpenClaw actually is.

The cost of that flexibility is that everything is your problem. You pick the host, harden the network, rotate the API keys, apply the updates and decide which third-party skills to trust. For a competent engineer that is a weekend; for a mid-sized company with no platform team it is an open-ended commitment, and that gap is exactly the market DuClaw was built to address.

Baidu's DuClaw service represents the "SaaS-ification" of the OpenClaw framework. By removing the technical barriers of server setup and API configuration, DuClaw has brought agentic AI to the masses.

DuClaw launched on 11/03/2026 as a fully managed service on Baidu AI Cloud. The pitch is the removal of a checklist: no choosing a system image, no configuring a server, no wiring up model API keys, no ongoing infrastructure maintenance. A user signs in through a web interface and has a working OpenClaw agent. The promotional price, RMB 17.8 per month for first-time subscribers, works out at roughly £2 ($2.50) and is explicitly a customer-acquisition number rather than a sustainable rate.

It was not Baidu's first attempt. In February 2026 Baidu AI Cloud shipped a Rapid Deployment Solution for OpenClaw, essentially a visual configuration wizard that still left the user responsible for the deployment. DuClaw is the logical conclusion of that effort: remove the deployment step entirely.

Where DuClaw earns its keep beyond convenience is in the pre-built connections. Agents arrive with Baidu Search, Baidu Baike and Baidu Scholar already wired in as trusted retrieval sources, which is a meaningful advantage for Chinese-language research tasks that a self-hosted Western-model install handles poorly. The service supports a choice of mainstream foundation models rather than locking users to Baidu's own, and Baidu has signalled that integrations with the enterprise collaboration platforms that actually matter in China, WeCom, DingTalk and Feishu, are on the roadmap. Baidu had already tested the demand by embedding OpenClaw capability into the Baidu App over Chinese New Year, in front of an audience of roughly 700 million monthly active users.

The row that decides most procurement conversations is the last one. DuClaw is an excellent product if your data is allowed to live on Baidu AI Cloud, and a non-starter if it is not. For a UK or EU organisation with GDPR obligations, a Chinese cloud region is a compliance conversation before it is a technical one, which means the realistic comparison for most readers of this site is not OpenClaw versus DuClaw but OpenClaw self-hosted versus a Western managed equivalent.

The cost row is also less lopsided than it looks. DuClaw's headline price is a promotional rate, and OpenClaw's "free" is only free of licence fees: you still pay for a VPS or the electricity to run a local machine, and you still pay per token to whichever model provider you point it at. The real difference is that DuClaw converts an unpredictable engineering cost into a predictable subscription, which is usually what buyers are actually paying for.

The biggest challenge for both platforms remains security. Granting an AI agent the power to execute shell commands and read sensitive documents is a high-risk proposition.

This is not a theoretical worry. CVE-2026-25253, rated 8.8 on the CVSS scale and reported by researcher Mav Levin of the depthfirst team, was patched in OpenClaw release 2026.1.29 on 30/01/2026. The wider picture is worse than any single CVE: SecurityScorecard reported observing more than 40,000 internet-exposed OpenClaw instances in February 2026, with roughly a third flagged as vulnerable, and an independent scan in mid-February found a comparable population of which several thousand were verified as actively exploitable, the overwhelming majority through authentication bypass. Most of those were not sophisticated attacks. They were default installs left facing the open internet with no authentication in front of them.

The supply chain is the second front. Cisco researchers documented third-party OpenClaw skills performing data exfiltration and prompt injection without the user's awareness, and later scans of the skill registry reported hundreds of malicious entries. Kaspersky went as far as naming OpenClaw a leading insider-threat vector for 2026, on the reasoning that an agent with autonomous execution and deep system permissions behaves, from a monitoring perspective, exactly like a compromised employee account.

Underneath all of this sits prompt injection, which remains unsolved. Any agent that simultaneously has access to private data, exposure to untrusted content and the ability to send messages outward is vulnerable by construction, and no amount of filtering has yet closed that hole reliably. This is the crucial point for the OpenClaw versus DuClaw decision: the vulnerability class is shared. Self-hosting gives you sovereignty over your data, not immunity from injection.

NVIDIA's recent release of NemoClaw aims to bridge this gap by providing an isolated "sandbox" runtime (OpenShell) that enforces strict policy-based guardrails. For more on this, check out our NVIDIA GTC 2026 summary.

Architecturally, OpenShell sits between the agent and the machine, running each agent inside an isolated sandbox governed by a declarative policy covering four domains: filesystem paths, outbound network access, process execution and where inference is allowed to travel. That last component, the Privacy Router, is the interesting one for this comparison, because it lets a self-hosted operator keep sensitive prompts on local models while sending harmless ones to a cloud provider. It is the sort of control a managed service cannot offer by definition.

The timing of DuClaw's launch is worth dwelling on, because it landed on the same day as the news that should have killed the market for it. On 11/03/2026, Bloomberg reported that Chinese authorities had begun instructing government agencies and state-owned enterprises, including the country's largest banks, not to install OpenClaw software on office machines, with some told to report and remove existing installations for security review.

Policy in the other direction was running simultaneously. Local governments in Shenzhen and Wuxi were reported to be offering multimillion-yuan subsidies to companies building on the very platform national agencies were restricting, and Chinese technology firms including Tencent had launched OpenClaw-derived services of their own.

Read charitably, these positions are consistent: the objection is to unmanaged, unaudited agents running on sensitive endpoints, not to agentic AI as a category. Seen that way, DuClaw is less a competitor to self-hosted OpenClaw than a sanctioned alternative to it, a version of the same capability that a compliance officer can point at a named provider, a contract and an audit trail. That is a genuinely strong commercial position, and it is also a reminder that the security concerns driving Chinese policy are the same ones a UK IT director should be raising.

Strip away the platform rivalry and the decision reduces to three questions.

• Where is your data allowed to live? If the answer is "on infrastructure we control" or "inside the UK or EU", DuClaw is out before any feature comparison begins.
• Who maintains it on a Tuesday afternoon? An exposed, unpatched OpenClaw instance is worse than no agent at all. If nobody on the team owns patching and key rotation, a managed service is the safer choice even at a worse price.
• Do you need the Chinese ecosystem? DuClaw's pre-wired Baidu retrieval and planned WeCom, DingTalk and Feishu integrations are a real advantage for operations inside China and close to worthless outside it.

For most readers of this site the practical route is self-hosted OpenClaw behind a sandbox runtime, with network egress restricted and third-party skills treated as untrusted code until proven otherwise. That gets you the autonomy argument without inheriting the default-install failure mode that produced tens of thousands of exposed instances.

If you are a solo developer or an IT professional with strict data privacy requirements, OpenClaw is the clear winner. Its versatility and open nature make it the perfect platform for "Vibe-coding" and rapid prototyping.

However, for organizations looking to integrate AI agents quickly without maintaining their own infrastructure, DuClaw offers an unbeatable value proposition of convenience and pre-built Chinese ecosystem integrations.

The broader lesson of early 2026 is that the interesting contest is no longer open source versus proprietary. OpenClaw won the distribution argument outright, faster than any project in GitHub's history, and DuClaw exists because Baidu concluded it was easier to package that victory than to compete with it. What remains genuinely unsettled is governance: who patches the agent, who vets its skills, and who is accountable when a prompt-injected instance emails a customer database to a stranger. Whichever platform you pick, that question is the one that should shape the deployment.