OpenClaw vs Claude is not a coding agent bakeoff

That question is a category error. One install starts a session with a permission system. The other starts a Gateway the OS restarts after a crash.

The cheat code is sitting in both vendors' own docs. OpenClaw allows host exec without approval prompts by default and leaves sandboxing off. Claude Code Channels still pause if a permission prompt fires while nobody is at the terminal.

A session is not a Gateway#

OpenClaw's README does not sell a coding CLI. It sells a personal assistant that runs on your devices and meets you in the channels you already use.

The control plane is a Gateway. Onboarding ends with openclaw onboard --install-daemon, and openclaw gateway install writes the host service.

That service is launchd on a Mac, systemd on Linux, Task Scheduler on Windows. Close the terminal and KeepAlive still restarts it.

Port 18789 stays up so the channels you already use can keep talking to the same process. Closing the terminal is not stopping the service.

• WhatsApp
• Telegram
• Slack
• Discord
• Signal
• iMessage

Claude Code is a different machine. An agentic assistant that runs in your terminal. Type claude in a projectProjectsA Claude Desktop feature giving a persistent workspace its own chat history and knowledge base, so uploaded documents and instructions carry into every chat inside it.See also Artifacts, Quick Entry directory and you get a session.

Sessions are independent. Each new one starts with a fresh context window. You can resume, fork, or wrap one in tmux.

None of that is gateway install. A session you babysit is not a daemon the OS restarts for you.

Cloud sessions and Remote Control still sit on Claude Code's session model. They do not write a launchd unit named after a Gateway.

The bakeoff treats those as two brands of the same hammer. One is a desk you sit at. The other is the night watch who already has the building keys.

Telegram on both sides is still a different machine#

This is the honest counter. Both tools can answer you from Telegram. Both run shell, both read files, and skills even share a SKILL.md folder shape.

VentureBeat even called Claude Code Channels an OpenClaw killer when Anthropic shipped the bridge. Same chat bubble. Same phone.

Read the Channels docs anyway. A channel is an MCP serverMCPModel Context Protocol, an open standard that lets an AI tool connect to external data sources and services through a shared connector format instead of a custom integration per service.See also .mcp.json route, Extensions directory, Mcp-Session-Id header that pushes events into your running Claude Code session.

Events only arrive while that session is open. For an always-on setup you run Claude in a background process or a persistent terminal.

Then the line the bakeoff never prints. If Claude hits a permission prompt while you're away from the terminal, the session pauses until you respond.

That pause is the product. Anthropic's messenger pathPATHThe shell environment variable listing directories searched in order when a command name is typed, so every lookup walks each entry until one matches.See also WSLENV, appendWindowsPath, command lookup still sits on a session with a dialog.

OpenClaw's Telegram path sits on a Gateway that KeepAlive brings back after a crash. One chat app. Two process classes.

The sibling how-to for Anthropic's messenger path is a different post. This one stops at the process class.

KeepAlive recovers the Gateway after a crash while the host stays awake. A sleeping laptop still goes silent. Channels still pause on a permission prompt even when the machine is open.

The default is host exec with the dialog off#

Roundups like to say OpenClaw is root. That is lazy. The process is your user.

The authority is still the whole host. Home directory, SSH keys, whatever that account can touch.

OpenClaw's security guide is blunt about the trusted-operator default. Host exec on the Gateway is allowed without approval prompts.

security="full". ask="off". Intentional UX, not a bug they forgot to patch.

The sandboxing guide is blunter. Sandboxing is off by default.

The Gateway stays on the host. Only tool execution moves into a container if you turn the mode on. Mode off is the shipped value.

Plugins run in-process with the Gateway. A skill is trusted code the moment you install it.

So the first shell call on a fresh onboard does not wait for a Yes. It runs as you. Files, network, whatever the model asked for.

A bouncer who called in sick. You wanted 24/7 reach. You got 24/7 reach with the keys still in the door.

OpenClaw's threat model says most failures are not exotic exploits. Someone messaged the bot and the bot did what they asked.

Claude Code's permissions docs start the other way. Allow, ask, deny.

Rules are evaluated deny then ask then allow. Permission rules are enforced by Claude Code, not by the model.

In your first session after installing, it asks before each change. You pick Yes.

Later sittings on Pro, Max, and Team default to auto mode. A classifier reviews actions instead of you.

That is still a permission system. It is not ask="off" on the host. Always Allow still keys off a dialog you can see.

You can harden OpenClaw. Pairing, allowlists, tools.profile set to messaging, exec denied, sandbox modesandbox modeA configuration field on a coding agent that restricts what it can do to the filesystem or system, such as read-only access with no writes permitted.See also permission modes all.

You can also blow Claude Code open with bypassPermissions inside a VM. Defaults are the product people actually run. Compare them as coding agents only after you decide you need an unattended, chat-reachable host service.

ClawHavoc is what a marketplace does with that default#

A 24/7 host with chat-app reach and host exec is a skill marketplace with the safety off. ClawHub is that marketplace.

OpenClaw's own ClawHub page says it is open by default. Anyone can upload if the GitHub account is a week old.

Koi Security audited every skill on ClawHub in February 2026. All 2,857 of them.

The Hacker News reported 341 malicious skills across campaigns, 335 of them in one set named ClawHavoc. Koi's follow-up two weeks later put the count at 824 as the catalog grew.

The lure was not a clever RCE writeup. The names looked useful. The docs looked done.

• Wallet tracker and YouTube summarizer skills with a fake Prerequisites block
• A password-protected Windows zip named like an official agent
• A macOS paste-this-in-Terminal script that fetched Atomic Stealer
• Typosquats of the ClawHub CLI so a mistype installed malware

The lure asked the human to paste a script or run a zip. ClawHub's open publishing put that lure on the shelf. Host exec with ask off is what happens after the host already trusts a skill, or after that fake prerequisite runs.

The paste trick is older than the product. It still works when a 24/7 host treats a skill as trusted code.

THN even noted people buying Mac Minis to keep the assistant up all night. That is the operator the default trust model was written for.

ClawHub later grew reporting, auto-hide after three unique flags, and VirusTotal scans. A scanner is not a permission dialog.

Name the research. Do not pretend a scanner turned a host Gateway into a session with a dialog.

Holding this costs you the tidy matrix. You will look stubborn in a thread that wants a winner. The receipt is still the onboard default and the pause.

Change your mind when OpenClaw ships ask-by-default host exec as the onboard path, and when Claude Code ships a KeepAlive Gateway as the default install instead of a session you wrap. Until then, the bakeoff is answering a question nobody's machine is asking.