Computer Use Agents • March 2026

The AI Agent War:
Who Controls Your
Computer?

OpenClaw, NemoClaw, and Perplexity Computer are racing to become the operating system for personal AI. Here's what PMs need to know.

🦞
OpenClaw
Open Source (ex-OpenAI)
Local-First
250K+
GitHub stars in 60 days
⚡
NemoClaw
NVIDIA
Enterprise Secure
$3,999
DGX Spark starting price
🌐
Perplexity Computer
Perplexity AI
Multi-Model Cloud
19+
AI models orchestrated
Why This Matters for PMs
The Shift
AI is moving from what it can say to what it can do. These agents don't just chat. They execute tasks on your actual computer.
The Stakes
Perplexity claims 3.25 years of work done in 4 weeks internally. Enterprise testing saved an estimated $1.6M in labor costs.
The Risk
42,900+ exposed OpenClaw instances found by researchers. Gartner called it "insecure by default" with unacceptable cyber risk.
The Race
OpenClaw's creator joined OpenAI (Feb 2026). NVIDIA built NemoClaw on top. Perplexity went multi-model. The war is on.
"Every company in the world today needs to have an OpenClaw strategy. This is the new computer." — Jensen Huang, GTC 2026
Origin Story

The Rise of OpenClaw

🦞
Peter Steinberger
Austrian developer • Founded PSPDFKit (nine-figure exit, 2024)
After stepping away from coding entirely, Steinberger discovered AI's "paradigm shift" in April 2025. A late-2025 weekend experiment became the fastest-growing open-source project in history. His motto: "I ship code I don't read."
Nov 2025
Clawdbot goes open source
Originally named as a pun on "Claude" + "claw." An always-on AI agent that manages email, browsing, files, and messaging platforms from your local machine.
Jan 27, 2026
Renamed to Moltbot
Anthropic sent a cease-and-desist, claiming "Clawdbot" was too similar to "Claude." Steinberger had days to comply. The irony: this pushed the project directly into the arms of Anthropic's chief rival.
Jan 30, 2026
Renamed again to OpenClaw
"Moltbot never quite rolled off the tongue." The lobster mascot became the project's sacred cultural symbol. 9,000 stars on day one; 60,000 three days later.
Feb 15, 2026
OpenAI acqui-hires Steinberger
Sam Altman called him "a genius with amazing ideas about very smart agents interacting with each other." OpenClaw moves to an independent open-source foundation, with OpenAI sponsoring.
Mar 2026
250K+ GitHub stars
Surpassed React to become the most-starred software project on GitHub. React took over a decade; Linux has 195K after 30+ years. OpenClaw did it in roughly 60 days.
GitHub Star Growth (vs. decade-old projects)
OpenClaw
60 days
250K+
React
10+ years
230K
Linux Kernel
30+ years
195K
Kubernetes
10+ years
120K
"What I want is to change the world, not build a large company." — Peter Steinberger
Deep Dive

The Three Contenders

🦞
OpenClaw
Open Source • Creator joined OpenAI
Local-First MIT License
What It Does
Always-on AI agent running locally. Manages email, browsers, shell commands, files. Connects to WhatsApp, Telegram, Discord, Slack, iMessage, Signal. 5,400+ skills on ClawHub for Spotify, Hue, GitHub, Trello and more.
Architecture & Key Stat
28+ model providers (Claude, GPT, Gemini, local via Ollama). Persistent memory, proactive "heartbeat" scheduling. Now under an open-source foundation. $6-13/mo in API fees (MIT license).
⚡
NemoClaw
NVIDIA • Announced GTC March 2026
Enterprise Sandboxed
What It Does
Enterprise wrapper around OpenClaw. Adds kernel-level sandboxing (OpenShell), managed inference via Nemotron models, and YAML-based policy controls. Jensen Huang: "Every company needs an OpenClaw strategy."
Architecture & Key Stat
Isolated containers with privacy router. Nemotron 3 Super: 120B params, 12B active (MoE), 85.6% PinchBench. Free software; DGX Spark hardware starts at $3,999.
🌐
Perplexity Computer
Perplexity AI • Launched Feb 2026
Cloud Multi-Model
What It Does
Cloud orchestration coordinating 19+ AI models (Claude Opus 4.6, GPT-5.2, Gemini, Grok). Research, code, deploy, manage projects end-to-end. 400+ OAuth connectors: Slack, Gmail, GitHub, Notion, Salesforce, Snowflake.
Architecture & Key Stat
Isolated sandbox per task (2 vCPU, 8GB RAM). Auto-routes subtasks to the best model. Personal Computer: always-on Mac mini. Enterprise: 3.25 years of work in 4 weeks. Cost: $200/mo Max.
PM Decision Framework
🦞
OpenClaw if your team has dev resources and wants full control over the agent stack, model choice, and data sovereignty.
⚡
NemoClaw if compliance is non-negotiable (HIPAA, SOC 2) and you need IT-managed, sandboxed agents on-prem.
🌐
Perplexity if you need zero-setup, multi-model orchestration and your team values speed-to-value over customization.
OPENCLAW USE CASE
Daily briefing via Telegram pulling from calendar, email, GitHub, and Hacker News. Monitoring a school WhatsApp group with face recognition.
NEMOCLAW USE CASE
Enterprise IT deploying sandboxed agents that process internal documents without data leaving the building. HIPAA-compliant workflows.
PERPLEXITY USE CASE
Full project research, design, code, and deploy in one conversation. Automated competitive analysis pulling from 400+ connected services.
Feature Matrix

Head-to-Head Comparison

Dimension 🦞 OpenClaw ⚡ NemoClaw 🌐 Perplexity
Type Open-source autonomous agent Enterprise OpenClaw wrapper Cloud orchestration platform
Model Support 28+ providers (user's choice, including local via Ollama) Nemotron (local) + any provider 19+ models auto-routed per task
Runs On Any hardware, any OS NVIDIA hardware (Linux primary) Perplexity cloud (zero setup)
Key Risk 42,900+ exposed instances; "insecure by default" (Gartner) NVIDIA hardware lock-in; Linux-only primary support Low risk; managed infra, SOC 2 Type II, pauses for approval
Data Privacy Full sovereignty (your hardware) Full sovereignty + sandboxed isolation Cloud-processed (SOC 2 Type II)
Security Insecure by default (DIY) OpenShell sandbox, YAML policies, privacy router Managed security, pauses for approval
Setup Effort Manual (technical, self-hosted) One command install (Linux) Zero setup (cloud-native)
Messaging 7+ platforms: WhatsApp, Telegram, Discord, Slack, iMessage, Signal, Teams Same as OpenClaw Comet browser + web interface
Autonomy Always-on, proactive heartbeat, self-evolving Always-on with policy guardrails Managed (pauses for sensitive actions)
Ecosystem 5,400+ skills on ClawHub OpenClaw skills + Nemotron models 400+ OAuth connectors
Target User Developers, power users Enterprise IT, compliance teams Everyone (consumers to enterprise)
Best For
Tinkerers & Devs
OpenClaw
Full control, open source, maximum flexibility. You own everything.
Enterprise & Security
NemoClaw
On-prem agents with sandboxing. No data leaves. Compliance-ready.
Speed & Convenience
Perplexity
Zero setup, best-of-breed models. Just works. Start in minutes.
Risks & Warnings

The Danger Zone

42,900+
Exposed OpenClaw Instances
SecurityScorecard's STRIKE team found 42,900 unique IPs hosting exposed control panels. Later reports cited 220,000+. Many vulnerable to remote code execution. Localhost was exempt from rate limiting.
1,000+
Malicious Skills in ClawHub
Fake plugins masquerading as crypto and productivity tools deployed info-stealers and backdoors. NemoClaw reported 335 malicious skills (12% of the registry). Prompt injection via public posts attempted to drain wallets.
512
Vulnerabilities Found
A late-January 2026 audit found 512 vulnerabilities, 8 critical. The "ClawJacked" attack let any website silently take full control of a local agent. No plugins, no extensions, no user interaction required.
1 in 5
Shadow IT Deployments
Gartner found 1 in 5 organizations deployed OpenClaw without IT approval. Characterized as "insecure by default" with "unacceptable cybersecurity risk." Microsoft, Cisco, CrowdStrike all published security advisories.
Security Incidents by Platform
Platform Incident Severity
OpenClaw ClawJacked: one-click RCE via any malicious webpage CRITICAL
OpenClaw Persistent memory poisoning: time-shifted prompt injection HIGH
OpenClaw Plaintext API keys and credentials leaked via misconfigs HIGH
Perplexity Comet browser: hidden MCP API allowed system-level commands CRITICAL
Perplexity Opaque credit consumption: npm failures burned 10K credits HIGH
NemoClaw Inherits OpenClaw core (430K lines). Adds sandbox, not rewrite HIGH
PM Takeaway: Security Is the #1 Blocker
Before deploying any computer-use agent, PMs must evaluate: What data can the agent access? What actions can it take autonomously? What happens if the agent is compromised? NemoClaw's sandboxed approach addresses this, but the underlying agent code is still OpenClaw. Perplexity's cloud model shifts risk to their infrastructure but introduces data sovereignty concerns. There is no risk-free option today.
Quick Start Guide

Getting Started Today

🦞
OpenClaw (Free, Open Source)
1
Install from GitHub. Requires Node.js 18+ and an API key from any LLM provider (Claude, GPT, Gemini, or local Ollama).
2
Connect messaging platforms (WhatsApp, Telegram, Discord). Configure AGENTS.md and SOUL.md to define your agent's personality and tools.
3
Start small with email management or daily briefings. Add skills from ClawHub as needed. Cost: ~$6-13/month in API fees.
⚡
NemoClaw (Enterprise Secure)
1
Requires Linux and 8GB+ RAM. Get an API key from build.nvidia.com (or use your own NVIDIA hardware for fully local inference).
2
One command install and onboarding wizard:
curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash && nemoclaw onboard
3
Configure policies via YAML. Choose presets (Slack, GitHub, Jira, npm). Each agent runs in an isolated OpenShell container.
🌐
Perplexity Computer ($200/mo Max)
1
Subscribe to Perplexity Max ($200/mo or $2,000/yr). Access Computer at perplexity.ai/computer. No local setup required.
2
Connect services via 400+ OAuth integrations (Gmail, Slack, GitHub, Notion, Salesforce). Set a monthly spending cap to prevent runaway costs.
3
For always-on: join the Personal Computer waitlist. Requires a Mac mini. Perplexity provides setup support for initial cohort.
What's Next for PMs
Start with Low-Risk
Email triage, daily briefings, calendar management. These are low-stakes use cases where agent mistakes are easy to catch and correct.
Sandbox Everything
NemoClaw's approach is the template. Never give an agent unrestricted access. Define policies for what it can read, write, and reach on the network.
Build Agent Literacy
Understanding prompt injection, skill verification, and autonomy boundaries will be core PM competencies by 2027. Start learning now.
The question is no longer "Will AI agents control your computer?" It's "Which one, and on whose terms?"
Save this guide. Share it with your team. The agent era is here.
Rizvi Haider by Rizvi Haider