Important Notice from Raxxos

We do not recommend the use of OpenClaw for most businesses. While it is an impressive and capable piece of technology, OpenClaw is a complex, high-risk software platform that should not be operated without extensive cybersecurity experience and careful planning. There are documented cases of OpenClaw instances being compromised due to misconfiguration and security vulnerabilities. If you choose to deploy it, you do so at your own risk. We strongly encourage consulting with a qualified IT security professional before proceeding.

OpenClaw has attracted significant attention in tech circles — 60,000 GitHub stars in 72 hours, comparisons to JARVIS, and a wave of developers ordering Mac Minis specifically to run it. Most of the coverage has been aimed at developers and early adopters. This article is aimed at business owners who want to understand what it actually is, how it works, and — critically — why Raxxos advises most businesses to approach it with caution.

Georgy Johnson, a technician here at Raxxos, says that as of right now he hasn’t had clients come to him directly with questions about OpenClaw — but he’s noticed how fast it’s moving through conversations. “News about it is spreading like wildfire,” he told us. “It’s the hottest topic right now.” That tracks with what we’ve seen: the buzz is real, the questions are coming, and most of the information out there isn’t aimed at helping business owners make a clear-headed decision.

The Hype Machine Nobody Is Talking About

If you’ve been on YouTube recently, you’ve seen the videos. “Everyone should be using OpenClaw.” “Here’s how easy it is to set up.” “I built an AI employee in 20 minutes.” The thumbnails are bold, the energy is high, and the message is consistent: this is the future and you’re already behind.

What most of those videos don’t tell you is who’s paying for them.

A significant number of the most-watched OpenClaw tutorials are sponsored by VPS hosting companies — Hostinger being the most prominent example. The business model is straightforward: get as many people as possible to sign up for a VPS through an affiliate link, earn a commission on each signup. The more people who run OpenClaw, the more VPS subscriptions get sold. The incentive is volume, not accuracy.

One well-known AI YouTuber has publicly stated he was offered $30,000 to promote Hostinger on his channel — and turned it down specifically because he didn’t feel comfortable with the promotional angle. That’s a meaningful data point. For every creator who turned it down, plenty accepted.

The result is a YouTube landscape where the vast majority of OpenClaw content is financially incentivized to make the setup look easy, the risks look manageable, and the audience feel like they’re missing out if they don’t act now. Almost none of it addresses the real security questions in any depth.

We’re not saying OpenClaw is a scam or that everyone covering it is acting in bad faith. We’re saying the information environment around it is heavily distorted by financial incentives, and business owners making decisions based on that content are working with an incomplete picture.

One More Thing Worth Knowing: It Was Vibe-Coded

OpenClaw is open-source software, which means anyone can read the code. People who have done so have noted that significant portions of it appear to have been written with heavy AI assistance — what the developer community has started calling “vibe-coded” software. Code generated quickly with AI tools, iterated fast, shipped fast.

That’s not inherently a disqualifier. A lot of software is built this way now and works fine. But vibe-coded software that is being deployed with broad access to your business systems, your email, your files, and your network — and that has not been through the kind of rigorous security audit that enterprise software typically undergoes — is a different category of risk. The people qualified to evaluate whether a piece of software like this is safe to run in a business environment are cybersecurity professionals who can read the code, understand the architecture, and assess whether it’s been sandboxed correctly. That is not most business owners, and it is not most YouTube tutorial watchers.

What OpenClaw Actually Is

OpenClaw is an open-source AI agent that you install on your own hardware. Unlike ChatGPT or Microsoft Copilot, which are cloud services you log into through a browser, OpenClaw runs locally — on a computer in your office, on your home network, or on a private server you control.

Once it’s running, it acts as an always-on AI coordinator. It connects to the apps and data you already use, takes instructions through messaging apps, executes tasks autonomously, and builds up a memory of your preferences and context over time.

The key distinction from most other AI tools is that OpenClaw doesn’t just answer questions — it takes actions. It can read and write files, send messages, search the web, run scripts, draft and send emails, monitor things on a schedule, and coordinate tasks in the background without you manually prompting it each time.

One important note: OpenClaw is the agent layer, not the AI itself. It connects to AI models separately — either cloud-based ones like Claude or GPT-4, or models running locally on your own hardware. That distinction matters a lot when it comes to privacy and security.

How People Interact With It

You don’t interact with OpenClaw through a dedicated app or dashboard. You talk to it through messaging apps you’re already using — WhatsApp, Telegram, iMessage, Slack, Discord. You send a message the way you’d send one to a colleague, and OpenClaw responds and acts on it.

That interface simplicity is part of what makes it appealing. It’s also part of what makes it dangerous — because the ease of use can obscure how much access the agent actually has to your systems.

What Some Businesses Are Using It For

The OpenClaw community has shared a range of real-world use cases — inbox management, daily briefings, document drafting, research tasks, lead monitoring, and meeting prep. In the right hands, with the right configuration, some of these applications are genuinely useful.

We’re not going to walk through each one in detail here, because we don’t want to get ahead of the more important conversation: whether any business should be running OpenClaw at all without proper security infrastructure in place.

Why Raxxos Advises Most Businesses to Stay Away — For Now

We work with businesses across the Lower Mainland on IT and cybersecurity every day. When we look at OpenClaw through that lens, we see a tool with real capability and real risk — and the risk profile is serious enough that we want to be direct about it.

Georgy described the pattern he sees when businesses move quickly on new technology without thinking through the downstream effects: “A common oversight is failing to consider the broader implications. While the intended outcome may be highly beneficial, the process can introduce unforeseen security, compliance, or reputational risks. In some cases, those challenges only become apparent after significant progress has been made — which makes them much harder to address.” That’s a good description of what we’ve seen with OpenClaw deployments that went wrong.

There are documented cases of OpenClaw instances being compromised. Because OpenClaw is open-source and self-hosted, the security of any given deployment depends entirely on how it’s configured and maintained. Misconfigured instances have been exploited. This isn’t theoretical — it’s happened to real deployments run by people who thought they had it set up correctly.

An agent with broad access is a significant attack surface. OpenClaw is designed to have access to a lot — your files, email, calendar, browser, and the ability to run scripts and execute commands on your systems. That access is where its usefulness comes from. It’s also where a security failure becomes catastrophic. A compromised or misconfigured agent could expose sensitive client data, send communications you didn’t authorize, or make system changes that are difficult or impossible to reverse.

Prompt injection is a real and underappreciated threat. Because OpenClaw acts on instructions it receives and processes content from the web, email, and documents, malicious content in those sources can potentially be crafted to hijack the agent’s behaviour. This attack vector is active and not fully solved in any current AI agent framework, including OpenClaw.

Most setups transmit data to US servers. OpenClaw runs locally, but the AI models it connects to usually don’t. If you’re using cloud-based models like GPT-4 or Claude — which most people do — the content of your tasks, conversations, and file contents is transmitted to servers in the United States. For businesses handling sensitive client data under PIPEDA or BC’s PIPA, this is a compliance issue that needs a clear answer before deployment, not after.

Nobody is monitoring it by default. Like any software running on your infrastructure, OpenClaw needs to be kept updated, monitored, and troubleshot. Logs should be reviewed. Permissions should be audited. If something behaves unexpectedly, someone needs to notice and respond. Most small businesses don’t have the internal IT capacity to manage that ongoing vigilance — and without it, problems tend to compound quietly until they become serious.

There is no vendor accountability. OpenClaw is open-source software maintained by a community. There is no company standing behind it with a support line, an SLA, or liability if something goes wrong. You are on your own in a way that is fundamentally different from using an enterprise software product.

Who Should Be Running OpenClaw

Developers, security professionals, and technically sophisticated early adopters who understand what they’re taking on and have the skills to configure it safely. Specifically: people who can read and audit the source code, understand how to properly sandbox an application with broad system access, and have the expertise to evaluate whether a rapidly-developed, AI-assisted codebase meets the security standards required for their environment.

That is a small group. It does not describe most business owners, and it does not describe most people watching YouTube tutorials about how to set this up in an afternoon.

The way Georgy thinks about new technology decisions reflects how we approach this with clients generally: “My mindset is that you only need just enough tech to get the job done — nothing less, nothing more.” OpenClaw may well be the right tool for certain businesses eventually, as the ecosystem matures and security tooling improves around it. Right now, for most businesses, it’s more tech than the job requires — and more risk than the benefit justifies.

If that’s not you or someone on your team, we’d encourage waiting. The AI agent space is moving fast. Tools that deliver similar capabilities with better security guardrails, vendor accountability, and easier configuration are coming — and some already exist within platforms like Microsoft 365 Copilot that are built with enterprise security from the ground up.

If You’re Still Interested

We’re not here to tell you what to do. If you’re curious about OpenClaw and want to understand whether there’s a version of this that could work securely for your business, we’re happy to have that conversation. We can help you evaluate whether the use case makes sense, what a responsible deployment would actually require, and whether the risk-benefit calculation adds up for your situation.

What we won’t do is set it up for a client without that conversation happening first. The exposure is too significant for us to treat it as a routine implementation.

Book a free conversation with Raxxos if you want a straight answer on whether this is right for your business — and if not, what alternatives might get you where you want to go.

The post What Is OpenClaw and What Does It Actually Look Like When a Business Uses It? appeared first on Raxxos Technology Inc..

Five months later, a lot of businesses are still running it.

We’re not going to tell you that’s automatically catastrophic. But we are going to tell you what we actually tell our clients — which is a more nuanced conversation than most of what you’ll read about this.

What “end of life” actually means

When Microsoft stops supporting an operating system, it stops patching security vulnerabilities. New ones get discovered all the time, and attackers find out about them just as fast as anyone else. The difference is that on a supported OS, there’s a fix coming. On Windows 10 right now, there isn’t.

That doesn’t mean your computers will immediately get hacked. It means the risk profile is different, and it will keep getting worse over time as more unpatched vulnerabilities pile up.

Where things actually stand with our clients

Georgy Johnson on our team has been tracking this closely. “Right now we’re down to 3 clients and a total of 16 computers still on Windows 10,” he says. “Most of those computers are still getting updates because we applied the Extended Security Updates — ESU — so they are protected.”

The ESU program is worth knowing about if you’re in a position where upgrading right now genuinely isn’t possible. Microsoft offers paid extended security updates that keep the patches flowing for a limited period while you plan and execute a proper migration. It is not a permanent fix — but it buys time without leaving machines completely exposed. If you have a managed IT provider, they should already know whether this applies to your situation.

Why most businesses haven’t upgraded yet

We talk to a lot of businesses across the Lower Mainland who are still on Windows 10, and the reason is almost never cost or complexity. It’s that they don’t fully believe the risk applies to them.

And honestly, that’s understandable. If you’ve never been through a ransomware incident, it’s genuinely hard to feel the weight of one. You can read statistics but they tend to bounce off. The mental math of “this probably won’t happen to me” feels more real than the math of “if it does happen, here’s what it costs.”

The businesses we see take security seriously are almost always ones that have been through something. A colleague got hit. Their own files got encrypted once. They lost a week of work to a breach. That kind of experience changes how you think about risk in a way that statistics don’t. So when we’re having this conversation with a skeptical prospect, we try to make it concrete rather than just citing numbers.

Georgy put it plainly: “I have not seen a security incident occur because a client was still on Windows 10 — but only time will tell.” That is the honest answer. The risk is real and it grows over time, but it hasn’t bitten every business yet. The question is whether you want to wait until it does.

The honest advice: it depends on your risk tolerance

Here’s what we actually tell businesses who are still on Windows 10.

What would it cost your business if your computers were inaccessible for three days? A week? What if your files were encrypted and you had to decide whether to pay a ransom or rebuild from backup? Add up the realistic number. Then compare it to the cost of upgrading. That’s not rhetorical — it’s a real calculation, and it’s different for every business.

If you’d lose serious revenue from a few days of downtime, the answer is pretty clear. Upgrade now.

If you think your business could absorb it — or if the timing genuinely doesn’t work right now — there are ways to reduce your exposure in the meantime. A robust firewall, a decent third-party antivirus solution, and regular security awareness training for your team can meaningfully lower the chances that a vulnerability gets exploited. None of that makes Windows 10 safe. But it’s better than nothing while you plan. And if ESU applies to your situation, that’s worth exploring too.

What the upgrade actually looks like

The assumption most businesses have is that it’s going to be painful and disruptive. It doesn’t have to be.

We’ve been doing Windows migrations for 15-20 years across our clients here in the Lower Mainland, through every major version release. When it’s planned properly, it’s smooth. For businesses that need high uptime, we can migrate machines over a weekend or overnight. For most, a tiered approach works well — a few computers at a time, working through the fleet over a few weeks without disrupting day-to-day operations. Every client we’ve taken through this has said the process was painless.

The thing that makes upgrades complicated is when they’re reactive. Waiting until something goes wrong and then urgently migrating 20 computers while also dealing with an incident is a genuinely bad situation. Doing it on your schedule, with some lead time, is a completely different experience.

A note on managed IT relationships

For businesses with a managed IT provider, transitions like this should be largely a non-event. Keeping clients ahead of end-of-life deadlines is a core part of what a managed IT relationship is supposed to do. Most of our clients are already on Windows 11 or have a migration scheduled.

If you’re a managed IT client somewhere and your provider hasn’t brought this up, it’s worth asking why.

The short version: running Windows 10 isn’t automatically a crisis, but the risk grows over time and the upgrade is easier than most businesses expect. If you’d like to know which of your machines are still on Windows 10, whether they can run Windows 11, and what a realistic migration looks like for your business, we’re happy to take a look.

The post Windows 10 End of Life: What BC Businesses Should Do Now appeared first on Raxxos Technology Inc..