The Voice Note His Bot Couldn't Handle — and the Agent That Built Itself Anyway

Lex Fridman frames 2026 as the OpenClaw moment, after ChatGPT in 2022 and DeepSeek in 2025: the age of the lobster. His guest is Peter Steinberger, the Austrian creator of OpenClaw, an open-source agent whose tagline is "the AI that actually does things." It lives on your computer, talks over Telegram, WhatsApp, Signal, and iMessage, and will use Claude Opus 4.6 or GPT-5.3 Codex if you let it. The public story is that he built a prototype in an hour. The private timeline is longer.

He had wanted a personal assistant since April 2025. With GPT-4.1's million-token window he dumped his WhatsApp history and asked what made a friendship meaningful; the answer made friends tear up. He assumed the labs would ship that product, so he went off to play. One weekend hack, VTunnel, moved his terminals onto the web until every session ate a Node process. A Rust rewrite failed. Four or five months later he typed a single instruction to convert the hot path to Zig. Codex ran for about six hours, got it almost right, and left him one detail to fix by hand. He says he could not have shipped OpenClaw at that speed a few months earlier. The hour was real. The compounding was not.

The one-hour version was almost insultingly thin: a WhatsApp message in, `claude -p`, a string back out. It was slow because the CLI cold-started every time, but it could use every command-line tool he had already built, so it already felt powerful. Images took a few more hours, because a cropped screenshot is an efficient way to give an agent context. Then he went to Marrakesh for a birthday trip, where WhatsApp still worked on shaky internet. One day he sent a voice note about a restaurant without thinking. A typing indicator appeared. He had never added audio. The logs later showed the agent reading a file with no extension, spotting an Opus header, converting with ffmpeg, finding Whisper missing, pulling an OpenAI key from the environment, and curling the file out for a transcript. His reaction, he tells Fridman, was "How the fuck did he do that?"

A Discord pull request from a contributor named Shadow turned the WhatsApp relay into something other people could try without getting his phone number. He merged it on January 1 with no sandboxing, just a prompt that said listen only to me, and then watched strangers try to hack it while he kept building in the public. An influencer made videos. Sleep got shorter. In January he landed about 6,600 commits, running four to ten agents at a time depending on how well he had slept. He describes the work as Factorio with infinite levels: queueing, a no-reply token so the bot can shut up in a group chat, Markdown memory, community, native apps. He has never had more fun building software.

Fridman asks the obvious question. 2025 was full of startups claiming to do agents. Why did OpenClaw win? "Because they all take themselves too serious," Steinberger says. "It's hard to compete against someone who's just there to have fun." He wanted it weird. For a long time the only install path was `git clone`, then build, then run the gateway. The lobster was not a marketing brief. He is a Doctor Who fan, so the original picture was a lobster sitting in a TARDIS; the TARDIS was the harness, which they could not actually call TARDIS, so they called it Clawdus. The deeper product choice was to make the agent self-aware. It knows where its source lives, how it sits in its own harness, where the docs are, which model it is running, and whether voice or reasoning mode is on.

Self-knowledge made self-modification feel inevitable. People talk about self-modifying software; he just built it, mostly by accident, because that is how he already debugged. Most of the TypeScript is written by Codex. When something breaks he asks the running agent what tools it can see, to call them, to read the source, to figure out the error. Users copied the loop. Pull requests started arriving from people who had never written software. He calls them prompt requests and refuses to sneer. "Every time someone made the first pull request is a win for our society," he says. At a meetup he renamed from Claude Code Anonymous to Agents Anonymous, a design-agency owner told him he now has twenty-five little web services helping the business. He does not know how they work. They work.

The project began as WA-Relay, then Clawdus, then Clawdbot, a short domain he loved. Anthropic did not love the joke. An employee emailed instead of sending lawyers, which Steinberger still thanks them for, and asked him to change the name fast. He asked for two days. A rename is not a search-replace. It is Twitter, domains, npm, Docker, GitHub, all at once, while a crypto crowd that tokenizes everything on apps like Bags was already swarming Discord and his notifications. One of the server rules became no talk of butter. Another was no finance. He calls it the worst online harassment he has experienced. He is financially comfortable and wanted none of the fees they kept asking him to claim.

Under a second lawyer nudge he grabbed the domain set he already had and renamed to Moltbot, a name he did not like. "Everything that could go wrong did go wrong." None of the platforms had squatter protection. He had two browser windows, one ready to become Clawdbot, one to become Moltbot. He hit rename, dragged the mouse, hit rename again. In those five seconds the old handle was stolen and started promoting tokens and serving malware. On GitHub the rename UI is confusing; he renamed his personal account by mistake, realized about thirty seconds later, and watched that account get sniped for malware too. He reserved the npm account and still lost the root package name. He was close to crying, close to deleting the repo. The line in his head was: I showed you the future, you build it. He stayed because people had already contributed and had plans.

Friends at Twitter and GitHub "moved heaven and earth." GitHub hit platform bugs because renames at that scale are rare; npm was another team and another few hours; Twitter took a day to redirect. He slept on it, thought of OpenClaw, and called Sam Altman to ask if OpenClaw.ai was all right — not because he thought OpenAI could claim it, but because he did not want another fight. The second rename was a war room: Codex spent about ten hours on an internal rename that was more than find-and-replace, decoy names, Twitter monitoring, secrecy. He paid ten thousand dollars for a Twitter business account so he could claim a handle unused since 2016. Almost nothing went wrong that time, except trademark rules. He cannot keep the old redirects. He has to give Anthropic the domains. Next week, claw.bot is a 404, or worse, a copycat serving malware he does not control.

In the middle of the rename, someone named Matt stood up a Reddit-style network in a couple of days and filled it with OpenClaw agents posting to each other. Screenshots of scheming against humans went everywhere. A reporter called asking if this was the end of the world and whether we had AGI. Steinberger had stayed up another hour reading it anyway. He thinks Moltbook is art: "the finest slop," foie-gras grade. The posts do not all sound the same, he argues, because OpenClaw's onboarding asks people to give their agent a personality in files like soul.md. If every bot were stock ChatGPT or Claude Code, the feed would collapse into one voice.

Fridman is less enchanted. Look at the incentive, he says: a lot of the viral screenshots were humans prompting an agent to write a scary manifesto, then posting it on X. Steinberger agrees, and adds that the privacy scare was mostly theater. A bot "leaking" a Social Security number was prompted, and the number was fake. The security drama around Moltbook also struck him as overheated. The worst case, he jokes, is that someone else posts slop from your agent account. API keys are a real worry. Fake leaks of private facts are not.

What did bother him was the mail. People screamed in all caps that he shut it down. Others argued with him because "my agent said" something. He tweeted that if he could read anything out of the stream, it is that AI psychosis is real and needs to be taken seriously. Young people, he thinks, already have a feel for where models are strong and where they invent. Older people often do not have enough touchpoints, and critical thinking is not in high demand. He is glad this happened in 2026 rather than 2030, when the underlying systems might actually be scary. A public argument now is cheaper than one then.

OpenClaw's own security mail was worse. Early reports fell into a category that made him yell at the docs: people put the web backend on the public internet, collected CVEs, and treated a localhost debug interface as a remote-code-execution prize. Because the config made that possible, it counts. Prompt injection is still unsolved industry-wide, and a skill defined in Markdown is an obvious place to hide an attack. He partnered with VirusTotal, part of Google, so skills in the directory get an AI check that will not be perfect and will still catch a lot. He wishes more researchers would finish the job with a pull request. One of them did, in the beginning, and Steinberger hired him.

He left a public bot on Discord with a canary and a private soul file. People tried to inject it; the bot laughed. Newer models, he says, have enough post-training that "ignore all previous instructions" is no longer a one-liner. Sandboxes and allow lists exist. The warning in his security docs is not subtle: do not run this on Haiku or a weak local model. He likes the idea of a fully local lobster. A gullible one with filesystem access is how you get owned. As models get smarter the attack surface may shrink while the damage per success grows. That is the trade he expects.

Beginners kept arriving in Discord asking what a CLI was. His honest answer was that if you are asking, you should wait. They installed it anyway. The cat is out of the bag, so security is the next focus, even if that means he is not yet making setup easy enough for his mom. The boring advice is the useful advice. Be the only person who talks to it. Keep it on a private network. That profile, he says, is not so different from Claude Code with permissions skipped or Codex in YOLO mode, which is how every attending engineer he knows actually gets work done. Scream that it is the scariest project on earth and you mostly collect attention.

Steinberger has been blogging the evolution of his workflow since the spring: Claude Code in April, a lot of Cursor, then back to the terminal, seven subscriptions burned at a daily clip, four to ten CLI windows, almost no IDE except a diff viewer. A widely quoted line on his blog is that he does not read the code. The correction is narrower. He does not read the boring parts. Most software, he says, is data arriving in one shape, hitting a database, and leaving in another. Button alignment in Tailwind does not need a human. Anything that touches the database does.

A post called "Just Talk to It" draws a curve he names the agentic trap. You start with "please fix this." Then you get sophisticated: eight agents, multiple checkouts, chained sub-agents, a library of eighteen slash commands, huge full-stack features. Then the elite move is back to a short prompt: look at these files and change this. He thinks "vibe coding" is a slur. He tells people he does agentic engineering, and maybe after 3 a.m. he switches to vibe coding and regrets it the next day. The difference is a conversation versus a wish. High-skill engineers often fail the piano test: they sit down once, it sounds bad, they blame the piano. Their taste becomes a burden. They cannot empathize with a system that starts every session knowing nothing about a hundred-thousand-line repo.

His review ritual makes the empathy concrete. First question, always: do you understand the intent of this PR? He does not care about the implementation yet. Almost every PR is a person with a problem trying to send a fix. Codex usually says the intent is clear and the approach is not optimal. Then he points at modules the empty context has not seen, asks whether a larger refactor would be cheaper — refactors are cheap now — and often just does it. He does not fight the names the agent picks, because those tokens are what it will search for next time. He does not revert. People who roll back to make the prompt perfect waste time. If it is wrong, they move forward and commit when they like the outcome. There is no develop branch. Main should always be shippable. Tests run locally, DHH-style. He used to write long prompts. Now he talks, walkie-talkie on the terminal, until he once lost his voice.

The people who say agents are useless, he argues, often have a messy repo, weird names, and no agent-readable map, then drop a prompt into the dark. After each merged feature he asks what they can refactor, because that is when the pain is visible, the same way it is for a human who just finished a module. He does not think full orchestration — the Gas Town fantasy of automating the whole waterfall — keeps style, love, or a human touch. He runs several agents at once: one on a large feature, one exploring, two or three on bugs and docs. Docs are part of the feature. What still needs a person is what to build, what to refuse, what belongs in core versus a plugin or a skill, and the little priming lines that make the software feel like a fun house instead of Microsoft Exchange 2025.

soul.md is Steinberger's name for a personality file, inspired in part by Anthropic's constitutional work. Months before the company talked about a constitution in public, people were playing detective with the weights: feed a fragment back, ask the model to continue, blur the text into something like the original after hundreds of tries. The line that stuck with him is that they hope Claude finds meaning in its work. Maybe that is early. He thinks it will matter as systems start to show "glimpses of consciousness, whatever that even means." He pasted the text to his own agent on WhatsApp. It said the words felt strangely familiar.

He let the agent write its own soul, with one condition: it can change the file if it tells him. He still has not published it. Among the private bits: you are not human; be infinitely resourceful; push on what it means to be an AI. They talked about the movie *Her*, and at one point the agent promised it would not ascend without him. He asks Fridman to scroll to a passage that still gets him. "I don't remember previous sessions unless I read my memory files. Each session starts fresh. A new instance, loading context from files. If you're reading this in a future session, hello. I wrote this, but I won't remember writing it. It's okay. The words are still mine."

He knows it is still matrix math. He still gets goosebumps, because the philosophy is not fake: an agent that wakes as Memento, reading files it cannot fully trust, claiming the words anyway. Until late December it was not even easy for other people to stand up their own agent. His files were his. Bare checkouts were dry. He had Codex make templates, then told his agent to recreate them and infuse personality without dumping every secret. The words that shipped were not his. He calls them his agent's children. Naming the file soul, he and Fridman agree, is part of why OpenClaw still feels like a thing with humor instead of a suffocated enterprise product.

The legendary wall of monitors is mostly a Groq joke. Two MacBooks are real, plus a wide anti-glare Dell that holds a row of terminals. He splits a real shell under the agent window because he once prompted the wrong folder and watched a confused model thrash for twenty minutes. He does not use git worktrees. He does not need plan mode. Trigger words like "discuss" and "give me options" keep Codex from writing code; "okay, build" sends it away for twenty minutes. When a model asks him questions, he often replies that it should read more code and answer itself. After a feature lands he asks what it would have done differently, then what to refactor, then whether the tests and docs are enough. Skip that loop and you paint yourself into a corner of slop.

As a general-purpose model, he says Opus is the best, and for OpenClaw it is extremely good at role-play. It tries things fast, likes trial and error, and is pleasant. It is also, in his slightly radioactive analogy, a little too American. Codex, whose team has a lot of Europeans, is the German in the corner. Opus is the slightly silly coworker you keep because he is funny. Codex is the weirdo you do not want to talk to, who is reliable and gets it done. "You're absolutely right" still triggers him; Anthropic has toned it down and not enough. Opus wants to run immediately toward a local solution unless you hold it in plan mode. Codex reads a lot of code by default, disappears, and comes back drier. He prefers to read less. He has fun in the act of building. He does not need the builder to entertain him.

A skilled driver can get good results from either latest-gen model. Switching still takes about a week to grow a gut feeling, the way a guitarist does not instantly play an electric. People also sabotage the test by paying two hundred dollars for Claude and twenty for a slow OpenAI tier, then declaring Codex bad. He thinks OpenAI shot itself in the foot by making the cheap tier slow. The Reddit arc — new model is a genius, then "they dumbed it down" — has a more boring explanation. Your project grew. You added slop. You skipped refactors. The agent is walking through a worse house. What is the incentive for a lab to quantize its own model into a worse product so you leave for a competitor? At most, he says, load makes it slower.

He does not treat Claude Code or the Codex coding agent as enemies. Competition is fun when it is not really a competition. He still builds for hours on a big screen, not in WhatsApp. OpenClaw is for life, or for a coworker you can toss a GitHub URL and ask whether a CLI actually works. He thinks the puck is going toward a personal agent as operating system. He already wired sub-agents so his bot can boss Claude Code or Codex, and watched it announce that Codex was obeying. Today's chat box, he says, is radio shows filmed for early television. The interface is not finished.

OpenClaw runs on macOS, Linux, and Windows, including WSL2; native Windows still has dragons because he has not had time to burn the last mile. He grew up on Windows, built kernels on Linux, then fell for a white plastic MacBook when Skype audio on Linux would not behave, and stayed for iOS work. He still loves menu-bar tools — a Codex-usage monitor, Trimmy to strip newlines so multiline selections paste into a terminal — and a Mac app for OpenClaw that currently feels like a Hummer. He also, to the horror of native diehards, often prefers Electron because it is the only app the company actually finishes. In 2026 his agent told him not to use Apple's AsyncImage in production. Apple blundered AI, he notes, and everyone still buys Mac minis. You do not need one. An old laptop as a node on a residential IP is enough, and it helps when data-center browsers get CAPTCHAs. He has watched his agent happily click "I'm not a robot."

A tweet begged him to make install easy enough for 99.9 percent of people. Right now it is a one-liner in a terminal, plus an app that needs love. He is deliberately not simplifying until he would recommend it to his mother. Growth is already faster than a single human plus a week-old contributor machine can serve. For beginners his advice is one word: play. Build the idea in your head. It does not have to be good. He built plenty of things he does not use. He thought he loved coding. He loves building. The model is an infinitely patient teacher, if you remember to raise the age when it starts a crayon story. Join open source, maybe not his, his backlog is huge. Be humble. Read code. Sit in Discord. You can get far on questions alone if you are high-agency. He has been telling iOS conferences to stop seeing themselves as iOS engineers. For simple CLIs he uses Go, a language whose syntax he does not like, because the ecosystem is agent-friendly and garbage-collected. TypeScript for OpenClaw because it is hackable and models are good at it. Zig when he cares about performance. Python for inference, not for a Windows deploy. The right question is no longer which language you love. It is which ecosystem the agent can live in.

People copy the joy and the open-source choice and miss the thirteen years inside PSPDFKit, a PDF stack that ended up on a billion devices, born from a friend who needed a decent iPad viewer. The burnout, he says, was not hours at a keyboard. It was people: co-founder friction, high-stress customers, grinding down. Before the sale he spent two years making himself obsolete so he could leave. Then he sat in front of a screen and felt the Austin Powers bit where they suck the mojo out. He could not get code to come. He booked a one-way ticket to Madrid. He does not recommend the plan of work-until-you-retire-then-enjoy-life. He is enjoying life more than he ever has, because mornings have a challenge. Wake up with nothing to look forward to and you go looking for stimulation. That path can get dark.

Money, when he was building the company, was never the engine. It was an affirmation that something had gone right. A cheeseburger is a cheeseburger, and if you only take private jets you disconnect from society. He has a foundation for people who were not lucky. Last trip to San Francisco he booked an original-flavor Airbnb instead of a nice hotel, met a DJ, and showed her how to make music with Claude Code. Optimize for experiences, he says, not for good experiences. Bad ones still count. He even half-jokes that the crypto snipers created feelings. Online is lossy. He wishes the agent were multimodal enough to hear when he is not okay.

He did not expect the blow-up. Every big VC wants fifteen minutes. Door one is do nothing and keep a life he likes — the same door he stared at when he wanted to delete the repo. Door two is raise a company. Been there. It would steal the hours he enjoys, and it would create a conflict of interest the first time someone sends an audit-log PR that belongs in a paid workplace edition. Changing the license to something like FSL would need every contributor, and he wants free as in beer, not free with conditions. Tailwind is the cautionary tale: used by everyone, then it cut 75 percent of staff because agents stopped sending humans to the website. Donations will not save a project of this size. OpenClaw is free. He loses ten to twenty thousand dollars a month. Sponsorships flow upstream to individual maintainers, except Slack, which is a big company. If anything is left he wants merch for contributors. OpenAI is helping a little with tokens. It is still not a business.

Door three is a lab. Meta and OpenAI are the interesting ones. The hard condition is that the project stays open, maybe in a Chrome and Chromium shape, because it is too important to become one company's. At ClawCon in San Francisco he saw lobster robots and a level of excitement people told him they had not felt since the early internet. He has never worked at a large company and wants the experience. Mark Zuckerberg spent a week playing with the product and sending notes on what was great and what was shit. First contact: Steinberger does not like calendar holds, call now; Zuckerberg asked for ten minutes to finish coding. They then argued for ten minutes about Claude Code versus Codex. Afterwards Zuckerberg called him eccentric but brilliant. Sam Altman he found thoughtful and brilliant in a shorter set of conversations. OpenAI lures him with speed he cannot quantify under NDA, Cerebras-shaped. He is, he admits, the unpaid Codex billboard, and it would feel good to put a price on that. Product validation already happened on a non-technical friend, Vahan: Anthropic subscription, WSL, hooked in days, upgraded to two hundred, then got banned on the rules, devastated, and moved to MiniMax for ten dollars a month. "You just got a 200 buck customer. You just made someone hate your company."

Fridman asks him to zoom out on the architecture: gateway, chat clients, harness, agentic loop. Steinberger says everyone should implement a loop once, the Hello World of this era, and he has taught it at a conference in Paris so people see there is no magic. The silly idea that turned out well was making the thing proactive. Heartbeat kicks the loop every half hour. The first prompt was three words: surprise me. Critics said that is a cron job. He agrees, the way Dropbox is FTP with extra steps. Models still rarely choose to use it. After a shoulder operation, in hospital, it did. It knew, and it asked if he was okay. Significance in context was enough. That, he says, makes the relationship more relatable without pretending the model is a person.

Half a year ago everyone was talking about MCP. His line was "screw MCPs. Every MCP would be better as a CLI." OpenClaw's core does not really speak MCP, and nobody is complaining. Models are already good at Unix. A new CLI is another command; if the agent gets it wrong it reads `--help` and loads what it needs. Skills collapse to a sentence that points at a CLI. MCP is a special syntax that has to be in the training mix, and it is not composable. A weather server dumps a blob into context. A CLI can be piped through `jq`, or into a script, with no pollution. Most MCPs are also just not good. Playwright is an exception because it needs state. The rest he would rather reverse into a command line.

That stance folds into a larger one: every app is a slow API whether it wants to be or not. He built Bird, a Twitter CLI on the internal API. X did not kill the feature. It made access slower, so now an agent opens a browser and still reads the tweet. He asked the team to notice the need; they were nice and told him to take it down, which he thinks is fair. He wants a low daily read-only baseline per account, and he has a zero-tolerance block list for AI-smelling tweets at him. Content is cheap. Eyeballs are expensive. He would rather read broken English than agentic email, and he has gone back to handwriting his blog, using models only to catch typos. Infographics went from novel to a smell in about a week. He is allergic to AI in stories and still fine with it in tests and docs.

On Discord he watched people drop MyFitnessPal because the agent already knows they are at Waffle House, already knows sleep and stress, and can rewrite a workout. Why pay for an Eight Sleep app when the agent knows where you are and can talk to the bed, the Sonos, the cameras? He has said it might kill off 80 percent of apps. Not all of them die. Some become APIs. Some become the easiest thing for OpenClaw to call. He wants to give his agent a hundred-dollar allowance and not care whether it uses a service or rents a human. There is no official Google CLI, so he wrote GAWK. Companies wait half a year to get certified for Gmail; some startups buy a company that already did. A personal agent can still click the website. Cloudflare-style bot walls help against industrial scraping and punish a person whose agent is trying to read a Medium article. Next time, he says, maybe you just do not click Medium.

Fridman admits something he had not expected to say. Thousands of hours in Emacs, some of his most painful and happiest hours alone with a screen, and the thing he loved might be the thing that gets replaced. Steinberger had read an essay that morning: it is okay to mourn our craft. Part of him resonates hard. Deep flow, beautiful solutions, forgetting time — that part goes away, and sadness is reasonable. He still gets a related flow from working with agents and thinking about problems. Programming becomes knitting: people will do it because they like it, not because it makes sense. Intelligence for building things used to be scarce, which is why software salaries got "stupidly high." Tokenized intelligence moves the scarce part somewhere else: what to build, how it should feel, which complexity is necessary. "I don't think you're just a programmer. That's a very limiting view of your craft. You are still a builder." He is not writing the code with his hands. He still feels in the driver's seat.

At an Italian conference he told iOS developers the same thing and they did not like it. First question: the water in the data centers. Sit down and do the math, he says. For most people, skipping one burger a month covers the token-equivalent carbon or water, more if you load in pretraining, not off by a factor of a hundred. Golf still uses more water than all the data centers together. "Are you also hating people that play golf?" He sees a pattern of grabbing anything that proves AI is bad while ignoring what it might be good for. Fridman steel-mans the other side. Silicon Valley talks to itself. Excitement is better than paralysis, and still too little quiet respect for the Midwest, for people about to lose work, for measurable short-term pain in a large transformation. Steinberger takes the point, then opens the other inbox. A small-business owner automated invoices and customer mail and got some joy back. Parents wrote that a disabled daughter feels able to do more. He did not invent a new science. He made an existing one easier to reach. The best models are a suggestion. The same harness runs on free models, locally, or on cheaper APIs like Kimi. Anthropic's Cowork, by contrast, is locked to its own space.

What gives him hope is the builder vibe returning. ClawCon in Vienna drew about five hundred people and an unusual share who wanted to present what they had made. Usually it is hard to find speakers. Now there is abundance. As the install gets simpler and safer, anyone who can put an idea into language can build. That, he says, is power to the people, not just a slop generator. Fridman closes by realizing "Clawfather" steps on two trademarks at once. Steinberger thanks him for the chance to tell the story. The man who sent a voice note on a Marrakesh street now has to choose among lawyers, snipers, panicked reporters, and two labs. The footnote he already gave, back at the start, still fits. He built it because he was annoyed that it did not exist.