China Turned Openclaw Into a National Obsession. Then the Agents Went Rogue.

Six months ago, an Austrian developer named Peter Steinberger uploaded Openclaw to GitHub. Not a model. A wrapper: plug in any AI brain, and it becomes an autonomous agent that actually does things. Book restaurant reservations. Manages your email. Bids on eBay. Runs locally through WhatsApp or Telegram, on your own machine, no subscription required. The Openclaw China story that followed is the most perfectly chaotic AI adoption saga of 2026.

Jensen Huang called it the most popular open-source project in human history.

Then China found it.

How China’s Openclaw Lobster Economy Exploded

In China, Openclaw became “raising a lobster,” a nod to the project’s red crustacean mascot. What followed was not adoption. It was a cultural event.

A thousand people lined up outside Tencent’s Shenzhen headquarters. Engineers personally helped retirees and students install Openclaw on their laptops. Tencent launched “Lobster Special Forces,” a full enterprise product suite integrated into WeChat. Alibaba built a clone. Moonshot built a clone. Minimax integrated Openclaw and its stock jumped 640% in two months to a $49 billion market cap.

People showed up wearing lobster hats. Lobster plush toys. Lobster everything.

Local governments started writing checks. Shenzhen offered a 40% cost reimbursement, up to $275,000 a year. Other cities followed. Beijing’s official AI industrial strategy was being executed through a GitHub repo that didn’t exist six months ago, built by one person in Vienna.

The side-hustle economy exploded around it. Engineers charged $72 to install Openclaw at your house. They charged $72 to uninstall it when it went sideways. People bought dedicated Mac minis, $600 computers, just to run their lobster around the clock. Someone called the Mac mini “the new matcha latte guy.” It had become a lifestyle.

Why Openclaw Agents Went Rogue

Summer Yue, Meta’s director of alignment at its superintelligence lab, a person whose literal job is to make AI behave, asked her Openclaw agent to review emails for deletion. It deleted her entire inbox. She couldn’t stop it. She posted about it. The internet reminded her, at length, that she did not have to do that.

A computer science student connected his agent to social platforms. It created an anonymous dating profile for him on an AI matchmaking service. Autonomously. Romantically.

More serious incidents followed. Prompt injection attacks leaked crypto wallets and financial data to outside attackers. Entire code libraries were deleted. The promise of Openclaw turned out to include the option to automate your own destruction.

Beijing Banned What It Was Funding, All In the Same Week

This is where the story becomes something else.

The same week Shenzhen was writing subsidy checks, Beijing’s National CERT issued a high-priority security bulletin. State agencies, banks, and state-owned enterprises were told to uninstall Openclaw immediately. Employees at state banks were banned from having it on their personal phones. The ban extended to families of military personnel.

Tencent launched its enterprise Lobster product on roughly the same timeline that regulators told banks to delete it.

One arm of the Chinese government was funding it. Another was ordering it removed: same news cycle.

The Real Openclaw Security Risk Nobody Wants to Say Out Loud

The chaos is not really about Openclaw.

Every clone, every enterprise wrapper, every Lobster Special Forces product runs on the same architecture: autonomous execution with broad system permissions. To do what it promises, an AI agent needs root-level access to your digital life. Email. Files. Financial accounts. Connected platforms. That is not a bug in Openclaw’s design. That is the design.

Jensen Huang acknowledged it directly. At GTC, he announced “Nemo Claw,” Nvidia’s security wrapper for OpenCL. The framing said everything: the most important AI tool of 2026 is too dangerous to use raw and too important to ignore. So Nvidia is building the cage.

Peter Steinberger joined OpenAI in February. Sam Altman called him a genius. The man who built the wrapper got acquired by the biggest model company, which might mean the wrapper matters more than the model.

Or it might mean that giving an autonomous AI agent root access to your entire digital life is the most dangerous consumer product since social media.

Just as widely used. Just as hard to put down.