What started as a personal experiment quickly grew into a global open source project with incredible momentum. OpenClaw is a personal AI assistant that runs on users’ devices and connects to the messaging channels they already use. His GitHub repository, started by Peter Steinberger over the weekend in November 2025, had grown to approximately 388,000 stars, 81,000 forks, and over 80,000 commits by August 26, 2026. In this video interview, filmed just six months into the project, creator Peter Steinberger and several OpenClaw maintainers discuss managing the flow of pull requests, rethinking contributor trust and code reviews, addressing risk in the software supply chain, and balancing powerful agent capabilities with security. They also share security lessons from the GitHub Secure Open Source Fund and the value of communicating with maintainers facing similar issues. Watch the full video above, then explore the key lessons below. People in this video The following maintainers have shared their experiences supporting and securing OpenClaw. Peter Steinberger, creator of OpenClaw Brad Grokes, CEO of Digital Meld Josh Avant, OpenClaw Foundation Technical Staff Member Josh Lehman, Martian Engineering Sally O’Malley, Principal Software Engineer, Red Hat Val Alexander, OpenCoven Vincent Kok, Chief Architect of the OpenClaw Foundation Here are the top 10 lessons we learned from this conversation. Lessons 1–3: How AI Changed Contribution and Community 1. Pull requests have become fast requests OpenClaw maintainers had to manage thousands of pull requests and issue fixes, with some contributors opening hundreds of pull requests at once. I don’t even call them pull requests. I call them quick queries. Peter Steinberger There were some members who had several hundred pull requests that ran sort of automated software factories that just searched everything for problems. Josh Lehman The challenge has shifted from attracting participation to finding valuable input in a stream of activity that might overwhelm human consideration. 2. Keep the door open for new members. The OpenClaw maintainers wanted the project to welcome new contributors, whether those contributing to open source for the first time, non-developers solving a specific problem, or people using artificial intelligence agents to help. Instead of rejecting imperfect proposals, they looked for promising ideas and worked with participants to refine, rewrite, or complete the final changes themselves. I know what it was like when my first request for inclusion was accepted many years ago. Peter Steinberger Some of the first-time contributions came from people with no development experience. They used an agent to create a pull request and worked with maintainers to complete the change. A significant portion of the first time merged pull requests come from non-developers. These are simply people who have a specific problem and need. Vincent Kok 3. Agents save time, but make signing a contract more difficult. Maintainers described two very different results from the same technology: Agents can help people reclaim time, but they can also make it harder for people to stop working. I’ve seen the flip side of it where people love it so much and they realize, wow, if I don’t sleep tonight, I can do something that used to take me a week to do. Val Alexander I have three children. They are very small. OpenClaw allows me to manage agents who work for me so I can get back to playing with my kids. Josh Lehman Sometimes the attendants come out to the canal and say: “Now I’ll touch the grass.” I’m taking a few hours off. Sally O’Malley Agents are neither good nor bad for work-life balance. But they reinforce both the opportunity to do more and the importance of knowing when to step back. Lessons 4–6: How Maintainers Adapted 4. Build trust by finding where you can add value. There was no one path to becoming an OpenClaw maintainer. Some participants came through security work, others through integration or community involvement, but the common thread was finding a way to add value and take ownership. Peter ignored me, and I thought: how else can I get his attention? Safety. Vincent Kok I’m a Microsoft guy so I was wondering if there was a plugin for Microsoft Teams? Brad Grokes I looked into the community and I was in voice chat and people were asking a lot of questions and I thought, well, how can I add value to these conversations? Val Alexander 5. The new signal of trust is your job. As contribution counts became less informative, the team identified evidence that could help a pull request stand out: agent transcripts, screenshots, testing, and explanations of participants’ thoughts. If you provide us with transcripts, we will actually see how you arrived at the inclusion request and your discussion with the agent. Incredibly valuable. If you add screenshots, you can prove that you checked it. Peter Steinberger The important question was not simply whether the code was written by a human or an agent. The question is whether the contributor has understood the feature and thought through how it interacts with the rest of the project. Nobody cares whether you wrote the code or not, but we do care whether you thought about this feature. Peter Steinberger 6. Maintenance specialists check the agent code together with the agents. Maintainers have increasingly relied on AI tools to review AI-generated contributions, while also taking a more hands-on approach to improving submitted code. Whenever I get a pull request from AI, I like to use GitHub Copilot for all reviews. I just click the button right here. It checks and gives clarity about all the attached files, what those files mean and how they have changed. Val Alexander This is the first project where I’ve seen it become the norm that when someone submits a pull request as a maintainer, you simply edit it. You just do it right. Josh Lehman Lessons 7–9: Security Issues 7. Reputation has become an attack surface. The contribution history itself can be manipulated. The OpenClaw maintainers have seen people duplicating existing pull requests, and Vincent Kok explains why. People were basically duplicating other people’s pull requests. They were trying to build trust here because we had icons like the ones you merged. So the more mergers you had, it was kind of a trust signal for us maintainers. Vincent Kok Peter described a company that uses automated pull requests to promote their product. The team had to identify duplicate work and determine which pull request was the original one. The code wasn’t the only thing the project needed to evaluate. Escorts also had to reconsider the social cues they used to decide what and who to trust. 8. “Secure by default” depends on who you ask. What seems safe to one user may seem unnecessarily restrictive to another. In practice, the compromise was obvious. Tighter workspace restrictions led to user complaints, while fewer restrictions could put the project at risk of a security breach. It can often be difficult to find the right balance between user experience and creating something that is reasonably secure by default. Peter Steinberger Secure default settings should take into account the capabilities of the agent, what users understand, and what the particular environment is willing to allow. 9. Know who supports your dependencies Recent supply chain attacks have forced developers to think more carefully about both the dependencies they relied on and their relationship to the projects behind them. We have carefully reviewed our dependencies. This has pushed us to actually reduce our core dependencies, but also create relationships with the maintainers we depend on. Vincent Kok Companies by default don’t try to contribute instead of just supporting the fork and not caring about it. Peter Steinberger Lesson 10. How GitHub Secure Open Source Fund helped Participants described the GitHub Secure Open Source Fund as a security learning experience and a way to connect with maintainers facing similar, often insurmountable problems. The host said, “First, go have a cup of coffee.” Step one, exhale. This connected us to the human element of the escort’s work. Josh Avant The program increased awareness of safety practices and helped participating service technicians understand how to prompt agents. Now we have agents and they can do almost anything you ask them to do, but you still need to know what to ask them to do. Now I have the opportunity to know what to ask for. Josh Lehman Vincent emphasized the value of meeting other maintainers who were facing the same challenges in securing open source projects. The program gave participants a community they could tap into and learn from while these issues continued. Continue conversation Watch the entire conversation to learn how OpenClaw maintainers are adapting as contributions scale faster than the human systems used to validate, secure, and support them. OpenClaw took part in the fourth session of the GitHub Secure Open Source Fund. To learn more, read What 50 Open Source Projects Taught Us About Security in the Age of Artificial Intelligence. Applications for GitHub Secure Open Source Fund are now open. If you support an open source project, apply to learn from security experts, connect with other maintainers, and strengthen your project’s security. Head over to the GitHub community and ask developers what it’s really like to build the fastest-growing open source project in GitHub history! Thanks to all GitHub Secure Open Source Fund partners. Together we help protect the open source ecosystem for everyone! Funding partners: Alfred P. Sloan Foundation, American Express, Chainguard, Datadog, Herodevs, Kraken, Mayfield, Microsoft, Shopify, Stripe, Superbloom, Vercel, Zerodha, 1Password Ecosystem Partners: Atlantic Council, Ecosyste.ms, CURIOSS, Digital Data Design Institute Innovation Science Lab, Digital Infrastructure Analysis Foundation, Microsoft for Startups, Mozilla, OpenForum Europe, Open Source Collective, OpenUK, Open Technology Fund, OpenSSF, Open Source Initiative, OpenJS Foundation, University of California, OWASP, Santa Cruz OSPO, Sovereign Tech Agency, SustainOSS Looking for practical safety measures you can take for your project? Set up a basic security level for your project in one minute > Posted by Post navigation Creating Web Widgets Using the Picture-in-Picture API for Documents | CSS Tricks How Internet Quality Affects Remote Work, Streaming, and Calling