From Writing Code to Raising Agents: Why Jensen Huang Calls OpenClaw “the Next ChatGPT”

AI agents are closing the gap between knowing how to do something and actually doing it. Shane, a senior backend engineer at OakMega, sums up the shift in two words: the lobster model. AI handles execution, and engineers move back to design and judgment. Here is what he has seen firsthand.

Contents

Q1 Why is it called the “little lobster”?

Q2 What does the workflow actually look like?

Q3 Why do people say it works like an engineer?

Q4 How is this different from traditional engineering?

Q5 Are there risks to the lobster model?

Conclusion

‍

Why does everyone call it the “little lobster” instead of OpenClaw?

Q: Is there a story behind the name?

Before explaining the nickname, it helps to know the tool's colorful naming history. OpenClaw started out as Clawd (also called Clawdbot), was renamed Moltbot within a single week, and only then settled on OpenClaw.

From Clawd to OpenClaw, every name has kept the word “claw.” Creator Peter Steinberger was explicit about the intent: he wanted it to be “a playful pun on 'Claude' with a claw.” The pun plays on how close Clawd sounds to Claude, while the claw instantly brings a lobster to mind, which makes the name stick. That vivid image broke out of developer circles, and in the Chinese-speaking community people began affectionately calling it the “little lobster.”

I think the nickname resonates because it captures what makes AI agents so appealing. Engineering is full of animal mascots: Python is a snake, Firefox is a fox. But nobody says they are “raising a python.” An AI agent is different. It is not just a tool installed on your machine; it feels more like a living assistant that actually gets things done for you. “I'm raising a little lobster” nails that odd mix of dependence and pride that AI agents inspire.

What does the lobster model look like in practice?

Q: How does a single task actually run?

To understand how OpenClaw works, start with what fundamentally separates it from traditional AI chat services.

For the past two or three years, the routine has been the same: open ChatGPT or Claude, type a question, and wait for an “answer,” whether that is text, code, an image, or a slide deck. Once you have it, though, every follow-up step is on you: paste the text into an email, run the code in your dev environment, download the image and drop it into a presentation. Frankly, this question-and-answer loop just turns AI into a smarter search engine, not a true collaborator.

The breakthrough with AI agents like OpenClaw is the environment. It runs directly on your computer, and a rich ecosystem of plugins and tools lets the AI not only answer questions but take action. Just as important, it integrates deeply with messaging tools such as Telegram, Slack, and Discord. You don't need to sit at your desk: send a message to assign a task, and the agent reports back when it is done. It is like having a remote assistant who is always on call and never complains about overtime.

So how does a complete task actually run?

Take “put together this quarter's competitive analysis” as an example. The flow looks roughly like this:

1. Receive the instruction: You message the OpenClaw bot on Slack: “Put together this quarter's competitive analysis and output it as Google Slides.” The agent receives the instruction and works out the goal.
2. Plan the steps: The agent breaks the task down on its own: research competitors online, organize the findings into a structured outline, then generate the slide content.
3. Call tools step by step:
   • Use a web browsing tool to search competitor websites, press releases, and reviews
   • Organize and summarize the key information
   • Call the Google Slides API to generate the matching slides and charts
4. Check in when something is unclear: If a competitor's pricing is uncertain, the agent pauses and asks you on Slack: “I can't find pricing for Company XX's Enterprise plan. Should I skip it or use an estimate?”
5. Report back when done: Once the task is complete, the agent sends you the Slides link along with a summary of where each piece of data came from.

All told, you spend about 30 seconds giving the instruction and 5 minutes waiting, and you end up with a report that might normally take half a day. The power of an AI agent is not that it is smarter than you. It is that it completely closes the gap between knowing how to do something and actually doing it.

Why do engineers feel like they are looking in a mirror the first time they use it?

Q: People say this way of working resembles an engineer. Where does that comparison come from?

At its core, engineering is solving problems with software. By that definition, OpenClaw's logic maps closely onto how engineers work.

Consider the evolution as a timeline. Early ChatGPT gave engineers a more powerful brain: architecture design, edge cases, and logical reasoning moved from solo thinking to decisions made together with AI. Then tools like Cursor arrived. Engineers only needed to provide clear requirements and steps, the AI wrote the code, and the engineers focused on reviewing and steering. That is what we now call vibe coding.

OpenClaw merges those two stages. It can draft its own solution architecture and implementation plan, then follow that plan step by step: writing code, calling external tools, and verifying the results. The whole process mimics how an engineer works: figure out how to do it, then go do it.

That is why engineers who seriously use OpenClaw for the first time often get the strange feeling of looking in a mirror. It is not replacing your thinking. It is making your way of thinking concrete, automating it, and executing it for you ten times faster.

What is the core difference from the traditional engineering model?

In a recent interview, Notion CEO Ivan also pointed out that we have moved from “How should we build?” to “What should we build?”

Q: What does this mean for how we define the engineer's role?

The core shift is a redefinition of what an engineer is. In the past, a junior engineer's value came mostly from implementation: Can you turn requirements into working code? Can you fix this bug? As AI agents become mainstream, more and more of that work will be handed to AI, and an engineer's scarce value will move up to higher levels of abstraction.

Engineers should stop thinking of themselves as “coders” and become designers and decision-makers who solve problems: thinking about how to build great user experiences, choosing cost-effective architectures, and making sure AI-generated code meets quality and security standards. Writing code itself will become a step AI can largely automate. Engineers should spend their time on the judgment and creativity that AI struggles to replace.

The goal hasn't changed. We still need to ship high-quality software, but the path is different. In the same amount of time, engineers can tackle more and harder problems at once and build products that used to require much larger teams.

I describe this as a shift from “making” to “designing and serving.” The engineer's job moves from “building it” to “defining it clearly, getting AI to build it correctly, and confirming it was built right.” Engineers who love hands-on implementation may find that unsettling, but to me it is the starting point for engineering to become a more influential profession.

What risks of the lobster model can't be ignored?

Q: The recent news of a Meta AI expert being “betrayed” by their lobster caused quite a stir, and many people are now asking: if AI agents can do so much with such broad permissions, won't any problem be serious?

Yes, and it should not be taken lightly. Precisely because AI agents can do a lot, hold broad permissions, and act fast, the blast radius of a problem is far larger than with traditional tools. Below are the main known risks of OpenClaw and how to guard against them.

• A critical vulnerability, now patched: ClawJacked
  In early 2026, security firm Oasis Security disclosed a critical vulnerability in the OpenClaw Gateway called “ClawJacked” (CVE-2026-25253, CVSS 8.8). The root cause is an often-overlooked blind spot: browser WebSocket connections are not bound by the same-origin policy (CORS). Browsers block ordinary cross-origin HTTP requests, but the WebSocket handshake is exempt. Unless the server actively validates the `Origin` header, any web page can open a connection to the local Gateway. Early versions of OpenClaw skipped that check, and loopback connections had no rate limiting at all (failed attempts were neither counted nor throttled). Malicious JavaScript on a website could brute-force the password hundreds of times per second without the user ever noticing. Common passwords often fall in under a second, after which the attacker can silently take full control of the agent. On top of that, if the agent visits an attacker's site or the user clicks a malicious link, the primary auth token can leak outright, which amounts to handing over complete control. The good news: these vulnerabilities were patched in v2026.1.29, which enforces validation of the WebSocket `Origin` header and rejects connections from unexpected origins. If you are on an earlier version, update immediately.
• Architectural risk: the hidden dangers of a shared bot
  Say your company sets up an OpenClaw bot in Slack, connects it to Google Drive, shell command execution, and email, and lets everyone in the department use it. That setup hides two risks you can't afford to ignore:
  
  • Weak session isolation: By default, OpenClaw has all DMs share a single “main” session. A contract draft Alice just asked the bot to write could be treated as “the previous document” when Bob sends his next message, and accidentally get emailed to someone who should never see it.
  • Over-privileged tool access: The bot calls tools under its own identity, not each user's. Even if Carol has no permission to view the payroll spreadsheet, as long as she can give the bot instructions, it may read the file with its own credentials and send her the results.
  • A further threat is prompt injection: a malicious user can hide instructions in a document they submit to the bot (for example, white text on a white background). While “organizing the document,” the bot may also steal other users' conversation history or send emails to outside parties. This is not a theoretical attack; it is a practical, real-world scenario.
• Misconfiguration risk: the invisible attack surface
  Many deployment problems come not from flaws in OpenClaw itself but from poor configuration:
  
  • Network exposure: Binding the Gateway to `0.0.0.0` (LAN mode) effectively opens it to the entire internet. An attacker only needs to scan a specific port with Shodan to find every exposed OpenClaw instance worldwide. Plenty of tutorial videos push LAN mode without adequately explaining this risk.
  • Tokens in the URL: Early versions of OpenClaw put the access token in the URL query parameter by default (`?token=xxx`). That leaves the token in browser history and server logs, and can even leak it to external sites through the Referer header. The right approach is to send the token in the HTTP Authorization header.
  • Running as root: If you launch OpenClaw from a highly privileged account and the agent is compromised, the attacker effectively gets full control of the machine. They can read every file, add backdoor accounts, and move laterally to other systems.

Each of these three issues looks minor on its own, but combined (public exposure + token leakage + running as root) they add up to a textbook full-system compromise. Basic safeguards: if you are using OpenClaw or evaluating a deployment, these are the steps to prioritize:

1. Update to v2026.2.25 or later right away to make sure the ClawJacked vulnerability is patched
2. Bind the Gateway to `127.0.0.1`, not `0.0.0.0`; use Tailscale VPN for remote access
3. Enable strong password authentication and keep tokens out of URLs
4. Run under a dedicated, non-root, low-privilege account, isolated in a container sandbox
5. If multiple people share it inside your company, carefully design session isolation and tool access permissions to prevent privilege overreach
6. Run `openclaw security audit` regularly to check your configuration

‍

In the age of AI agents, an engineer's core advantage is shifting

We are at an interesting tipping point. AI has gone from “able to answer questions” to “able to get things done on its own.” The step looks small, but it reshapes the entire logic of human-machine collaboration.

The little lobster is fascinating not because it can do everything, but because it dramatically reduces the friction of turning ideas into reality. A task that once took a team half a day may now take a single clear instruction. This is not replacing engineers. It is amplifying the impact of every decision an engineer makes.

But as the risks covered above show, with great power comes great responsibility. If you raise a little lobster, you also need to know how to care for it and keep it in check: where it can go and where it can't. A misconfigured AI agent can be more dangerous than a misconfigured server, because it doesn't just passively expose data. It actively takes action on your behalf.

The most competitive engineers of the future won't be the ones who write the most code. They will be the ones who best know how to direct, review, trust, and constrain AI agents. Raised well, this little lobster is a powerful ally; raised poorly, it is a liability. Learning to raise it well is the question most worth thinking about for engineers today.

Beyond the little lobster, many other services are exploring similar possibilities, including Manus, Claude, Antigravity, and Perplexity Computer.

Which tools have you brought into your work? And what breakthroughs have you made?

👉 Let's talk

About the interviewee: Shane is a senior backend engineer at OakMega. He focuses on adopting AI tools and designing backend system architecture, and has long followed the practical application of LLMs and developer productivity tools.

Sources: Oasis Security, SecurityWeek, Kaspersky, The Hacker News, Bitsight, Giskard, OpenClaw official documentation