JMIR Publications

ABSTRACT

OpenClaw is an open-source autonomous artificial intelligence (AI) agent framework that has been rapidly adopted since its initial release in November 2025. Originally developed by Peter Steinberger under the name Clawdbot and subsequently renamed OpenClaw in January 2026, the platform surpassed 250,000 GitHub stars by March 2026, and a medical skills ecosystem of more than 800 community-curated tools has grown around it, spanning clinical documentation, bioinformatics, imaging, and drug discovery. In this Viewpoint we argue that the properties driving that adoption are the wrong optimization targets for clinical medicine. We term this the autonomy paradox: initiative, persistence, and autonomous action are valuable in productivity settings, whereas clinical systems are built around constraint, verification, and escalation. Three lines of evidence support this. First, a coordinated supply-chain campaign placed more than 1,200 malicious skills on the official ClawHub marketplace, and the ClawJacked vulnerability (CVE-2026-32025) allowed any website to take full control of a locally running agent without user interaction. Second, adversarial testing has reported average defense rates as low as 17% against sandbox-escape attacks. Third, an open-source project with no corporate entity cannot execute Business Associate Agreements under the Health Insurance Portability and Accountability Act, and the European Union AI Act classifies medical AI as high-risk, imposing conformity-assessment obligations that community-governed software is poorly positioned to meet. We conclude that near-term use should be confined to research and administrative contexts, and we set out the properties an agent framework would need before it could be considered for patient-facing deployment: causal grounding, deterministic or tightly constrained execution, action governance, audit by design, and human supervision.