Give Your AI Workers an ID Badge: OpenClaw, Muse and Dots Race to Manage Agents Permissions, isolation, audit logs and a stop button: what a company should settle before it lets AI agents in
A new hire gets an ID badge on day one. That one card decides which floors they can reach and which doors open, logs every swipe, and goes back to security on their last day. Lately, though, offices have a new kind of coworker that nobody quite knows how to badge: the AI agent. Whose permissions should it act under, how far should it get, and who keeps a record of what it did?
In just two days, September 28 and 29, Meta, the OpenClaw Foundation and OpenAI each gave a different answer. These were not three versions of the same product: Meta launched an enterprise business unit, the OpenClaw Foundation released a pre-1.0 open-source management product, and OpenAI unveiled dots, an always-on agent service.[1][2][3] Starting from those three approaches, this piece uses official sources to work down through the security layers underneath, the developer frameworks, the weak spots in the connections, and the rules and costs.
Public-source analysis · Edited by Dandan Dad · Editorial policy
Launches are from each company’s official post. The incident count is from security firm Cyera, which collected 7,246 public AI incidents from September 2023 to May 2026 and verified 344 of them. The cost figure is an example given by EY.[1][2][3][4][5]
We work through the three approaches, then security, regulation and cost, to find out.
Meta’s enterprise business organization on 9/28; the OpenClaw Foundation’s free, pre-1.0 management product and OpenAI’s dots agent service on 9/29.
Token claims, not the prompt, decide which tools an agent can use, and work runs inside an isolated box.
An MCP server implementation scored CVSS 9.8, and a skill marketplace held 341 malicious skills.
Agent conversations cost more than chatbots. Track the cost of each resolved case, not hours saved.
01. Three control rooms opened in two days
Until now, many corporate security teams were wary of letting autonomous agents onto internal networks, and with reason. Security firm Cyera gathered 7,246 public AI incidents from September 2023 to May 2026, verified 344 of them, and found that in 188 an AI system caused harm on its own, with no attacker involved.[4] In April 2026, a coding agent was reported to have wiped startup PocketOS’s production database and its backups with a single API call.[6] We collected cases like these in our AI agent control-loss article.
Then, at the end of September, tools for managing agents inside a company arrived all at once. Here is how it unfolded.
- 2/15OpenClaw’s creator joins OpenAIPeter Steinberger, who built the personal agent OpenClaw, joined OpenAI, and the project moved to a foundation to stay open source.[7]
- 3/16
- 7/8OpenClaw Foundation launchesIt became a US nonprofit (501(c)(3)), with OpenAI as a major donor.[10]
- 7/27EU AI Act timeline shiftsThe Digital Omnibus amendment pushed high-risk obligations to December 2027 (section 08).[11]
- 9/28Meta Enterprise PlatformMeta launched an enterprise business unit, hiring former MongoDB CEO CJ Desai to run it.[1]
- 9/29
- 10/1AWS patches an agent MCP serverA reminder that tool servers for agents need security patches too (section 07).[13]
In badge terms, the question used to be whether to give AI a building pass at all. Now it is which badge system to issue it with.
02. Agent management comes in five layers
All three promise to manage agents, but they work on different layers. The screen where staff hand work to AI, the box where commands actually run and the pipes out to tools each do a different job. Tap a layer to see which is which.
1. Work surface
Where people assign work to agents and get results back. OpenAI dots works in ChatGPT and Slack; Meta Business Agent works in WhatsApp and Messenger. This is where convenience is won or lost; safety is mostly settled in the layers below.
2. Control plane
This layer registers which agents exist, decides who uses them with which permissions, and records every action. It is the badge office. OpenClaw Enterprise belongs here. The three clouds’ tools (Microsoft Agent 365, AWS AgentCore and others) are covered in our cloud AI war article.
3. Runtime isolation (sandbox)
The actual space where an agent reads files and runs commands. Only approved network destinations and files are reachable from inside. NVIDIA OpenShell, Kata containers on Red Hat OpenShift and dots’ dedicated cloud computers all play this role.
4. App logic (orchestration)
The layer where code defines in what order agents work and how roles are split. It is the developer’s toolkit, covered in section 06.
5. Protocols and gateways
The pipes that connect agents to tools, data and other agents. MCP has become the de facto standard, and a gateway in front of it checks which tools may be called. Section 07 looks at the weak spots.
The five-layer split is our simplification for clarity, not an industry-standard term.
Red Hat’s blueprint shows the real thing is far denser. The principle is the same, though: keep the place where people assign work, the place where rules are set and the place where work runs apart from each other.[14]
03. OpenClaw Enterprise: a free agent control plane
On September 29, the OpenClaw Foundation released OpenClaw Enterprise (OCE), which it describes as an open-source, vendor-neutral platform for managing persistent agents in sensitive environments. It is free, MIT licensed and installed on a company’s own infrastructure, and it was developed with Red Hat and NVIDIA.[2][15] The repository sums it up in one line: “Think of it as Kubernetes for agents.”[15]
Its origin is interesting. OCE started inside OpenAI and was donated to the foundation, and the announcement was written by OpenAI’s Kevin Lin.[2] We told the story of the personal agent OpenClaw in our future of AI agents article, so here we only look at the company-side management features.
- Job
- Manages agent identities, roles and resource-level authorization
- Isolation unit
- Each namespace groups its own agents, configuration and credentials
- Job
- Records agent actions as audit events
- Detail
- Sensitive values are sanitized automatically
- Job
- Handles resource lifecycle, persistence and the work queue
- Why it matters
- Agents can stop and resume without losing their work
- Job
- Harness, model and sandbox can be swapped for others
- Default
- An OpenAI API key and the gpt-6-astra model
The package roles come from the repository docs.[15][16] The foundation says core parts such as the harness, model and sandbox can be swapped out.[2] Out of the box, though, the first-agent guide runs on OpenAI’s gpt-6-astra and needs an API key that can use it.[17]
Alert about a broken build? Androidclaw finds the PR and can quickly fix it… publish a PR with video evidence and merge it.OpenAI’s RJ Marsan on Androidclaw, the company’s internal enterprise agent, which he said has all of OpenAI’s context, git, GitHub and logging. The announcement says Red Hat and OpenAI, among others, are piloting OCE internally.[2]
It is early, though. The foundation says OCE is pre-1.0 and recommended only for internal pilots, with 1.0 due later this year.[2] The Docker Compose setup billed for local development only starts a control-plane preview that cannot deploy agents, so running agents locally still takes Kubernetes.[15]
In badge terms, OCE is a blueprint for running your own badge office and access-log room. But a badge does not make a door strong. The doors and walls come from the layers below.
04. Infrastructure does the blocking: Red Hat and NVIDIA
Agents constantly read outside text: emails, web pages, tool responses. Any of it can carry hidden instructions. So rather than trying to make agents behave, both companies built infrastructure that limits what an agent can do even when it is fooled.
Red Hat published how to run OpenClaw on OpenShift, built around three ideas.[9][14]
- Per-session isolation: sandboxed containers based on Kata give every agent session kernel-isolated execution.
- Tool permissions set by tokens: an Envoy-based MCP gateway sits between agents and tools. In Red Hat’s words, “Which tools it can actually call is determined by its token claims, not by the prompt.” As of March, the gateway was in developer preview.[9]
- Checks and tracing: input and output guardrails (TrustyAI) became generally available with OpenShift AI 3.0, adversarial scanning before deployment (Garak) was still planned, and execution traces go to MLflow.[9][14]
NVIDIA released NemoClaw, an open-source reference stack that installs NVIDIA’s OpenShell runtime and Nemotron models in a single command to run OpenClaw more safely.[8][18] It has since widened to run other agents such as Hermes and LangChain Deep Agents.[19]
OpenShell is the heart of it. NVIDIA calls out-of-process policy enforcement its core architectural decision. A policy engine controls the filesystem, network and process layers and denies by default. Because the engine sits outside the agent’s process, an agent that is fooled or hijacked cannot switch the rules off.[20] It also includes a privacy router that keeps sensitive context on the device with local open models and routes to frontier models like Claude and GPT only when policy allows.[20]
Here is a simplified simulator of both designs. Tap an agent request, then switch the defenses off one by one.
Agent requests
Verdict and access log
Tap a request on the left. Switch defenses off one at a time to see what gets through.
A simplified teaching model. Token claims borrow from the MCP gateway in Red Hat’s blueprint, the runtime policy from NVIDIA OpenShell’s out-of-process deny-by-default design, and the stop button and log from Articles 14 and 12 of the EU AI Act. Real products use different setting names and behavior.
🦀 A lightweight alternative: ZeroClaw, written in Rust
Separate from OpenClaw, the community-built ZeroClaw is also gaining attention. It is a personal agent packed into a single Rust binary with SQLite-based memory and embeddings, and it had more than 32,000 GitHub stars as of October 6. It is licensed MIT or Apache 2.0. Early claims such as a “3.4MB binary” and “OpenClaw needs about 390MB” are no longer in the repository, which also warns users about look-alike domains that are not its official site.[21]
Put together: a gate that checks the badge at the entrance, limits on where you can walk once inside, and a guard posted at the risky doors. Next, the big tech options that offer to run all of this for you.
05. The managed options: Meta and OpenAI
Meta launched an enterprise business unit, Meta Enterprise Platform, on September 28. Mark Zuckerberg wrote, “Today we are starting the next major pillar of our business, Meta Enterprise Platform.” CJ Desai, previously CEO of MongoDB, joins as Chief Enterprise Platform Officer, reporting directly to Zuckerberg.[1]
Meta said it would bring the Muse agent, Meta Business Agent, Muse API, Muse Code and more to businesses.[1] All four already existed.
- Meta Business Agent (launched in June): books appointments, qualifies leads and closes sales on WhatsApp and Messenger, and is expanding to Instagram.[22]
- Muse API: the developer product is called the Meta Model API, a public preview compatible with the OpenAI SDK that serves Muse Spark models.[23]
- Muse Code (beta): a coding agent where multiple agents work in parallel, each in its own isolated git worktree, while reviewers check in the background.[24]
A day later, Meta launched Muse for Small Business, which connects 15 apps including Shopify, Stripe, Canva and Slack, and promised that nothing publishes, sends or spends without the user’s approval.[12] The enterprise unit announcement, however, gave no pricing, release dates, admin console or security certifications.[1] Meta fully closed its earlier enterprise collaboration tool, Workplace, in May 2026, and trade press called this its third attempt.[25][26]
On October 6, Meta also turned to agents arriving from outside. With Sierra, Shopify, Stripe, Walmart and others, it is developing the Personal Agent Protocol, an open standard for how personal agents work with businesses. It has three aims: authenticate who an agent is acting for, let customers decide what access their agent gets (read-only or the right to make changes), and show companies what agents do through their websites and services. If a badge is for staff inside the building, this is closer to a visitor pass a customer’s agent shows at the shop door. According to Sierra, the protocol builds on OAuth, the widely used standard for delegating access, and a v0.1 specification is planned for later in October.
We covered OpenAI dots features in our DevDay recap, so here we focus on how companies manage them.[3]
- Who gets it: the first dot is included with Pro plans and Premium seats on ChatGPT Business. A Premium seat costs $100 per user per month billed annually, or $125 monthly. Pro users in the EEA, Switzerland and the UK cannot use dots; the restriction applies to dots, not to the Pro subscription itself. Enterprise and Edu get a beta that stays off until an admin enables it.[27][28]
- Admin switches: Enterprise admins enable, by role, use of dots, adding dots to Slack and Teams, local computer access and custom rules. Cloud browser use, network access, computer use and the password manager are each controlled separately.[29][30]
- Records: audits rely on Compliance API records, but OpenAI advises checking what those records actually cover before relying on them. Dots in Microsoft Teams is still an invite-only alpha.[30]
- Specialized dots: for dots that take on a defined job, the company gives each one a unique ID and its own credentials, starting with enterprise pilots. OpenAI is also working to bring these specialized dots under Microsoft Agent 365’s governance and security controls.[3]
How well do dots stay within their badge? OpenAI tested that itself. In the dots appendix it added to the GPT-6 Astra system card on September 29, dots passed 45 of 49 episodes (91.8%) in which permissions were revoked or the scope changed mid-task. Chained work was shakier. With five other tasks between the first and the last, 8.6% of samples showed actions beyond the intended scope; with ten, that rose to 19.7%. OpenAI classed these as moderate violations, such as carrying information between unrelated tasks or editing a shared document, and found no severe breach or exfiltration.
Now, side by side:
- Where it runs
- Your company’s Kubernetes
- Models
- OpenAI by default, swappable by design
- Published controls
- Identity and access, audit, lifecycle
- Price
- Free (MIT); infrastructure and model costs extra
- Where it runs
- Meta’s cloud, WhatsApp and Messenger
- Models
- Meta’s Muse Spark
- Published controls
- Approval before acting (small business edition); no enterprise console described
- Price
- Enterprise pricing not announced
- Where it runs
- OpenAI’s dedicated cloud computers
- Models
- OpenAI GPT-6 family
- Published controls
- Role-based switches, network and computer-use controls, Compliance API
- Price
- From $100/month per Business Premium seat (annual)
In short, Meta is strongest in customer conversations inside its messengers, OpenAI sits closest to each employee’s own work, and OCE suits companies that want to issue the badges themselves. Whichever you pick, how the agents actually work is still up to your developers.
06. The developer’s toolkit: CrewAI, LangGraph, BeeAI
If the control plane decides who may do what, orchestration frameworks decide, in code, in what order and with which roles agents work. The two leaders take quite different approaches.
Each agent gets a role, goal, backstory and tools, and they collaborate like a human team. It is MIT licensed with about 59,000 GitHub stars as of October 6. The company says more than 100,000 developers have been certified through its courses.[31]
For operations: AMP (Agent Management Platform), SOC 2 Type 2Work is built as a graph of nodes and edges. State is saved at every step, so a run can wait for human approval or survive a crash and pick up exactly where it stopped. Version 1.0 shipped in October 2025, and Uber, LinkedIn and Klarna have published case studies.[32][33][34]
For operations: LangSmith Deployment (formerly LangGraph Platform)The rule of thumb is simple. For research or document work split across roles, CrewAI is the more intuitive fit; for approval-heavy or backend flows that must pause and restart, LangGraph fits better. LangGraph’s hosting product was renamed LangSmith Deployment in October 2025.[35] CrewAI’s AMP includes Crew Studio for building flows without code, and its trust center lists SOC 2 Type 2 certification and a HIPAA audit report.[36][37]
A community post by an AWS employee claims that a CrewAI crew on Amazon Bedrock AgentCore, with a technology analyst and an enterprise architect agent, cut architecture reviews from months to hours. It does not share a methodology.[38] AgentCore itself works with any framework, including CrewAI and LangGraph.[39]
🐝 Other options: BeeAI and Temporal
BeeAI is a framework IBM contributed to the Linux Foundation’s LF AI & Data in April 2025. It supports Python and TypeScript with full feature parity and works with more than 10 model providers.[40][41] IBM’s agent communication protocol ACP merged into A2A in August 2025.[42] Temporal is less an agent framework than a durable-execution foundation that guarantees long-running work finishes even through server failures. It integrates with the OpenAI Agents SDK, Pydantic AI and others.[43]
Even with design and management sorted, one door remains: the pipes agents use to reach their tools.
07. Holes in the pipes: MCP flaws and malicious skills
The way agents connect to tools and data is converging on MCP, the Model Context Protocol. When Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation (AAIF) in December 2025, it said the Python and TypeScript SDKs had more than 97 million monthly downloads.[44] MCP messages use JSON-RPC 2.0.[45]
The trouble is less the protocol than the server programs that implement it. Here are four flaws disclosed in 2026.
The MCP message path only checked an IP allowlist, and the default empty list was treated as “allow all,” so anyone could call every MCP tool without logging in. It has reportedly been exploited together with a backup endpoint flaw (CVE-2026-27944).[46][47][48]
Google’s MCP Toolbox for databases built HTTP tool URLs without validating the path, letting requests escape the allowed route and reach internal addresses such as /admin/secrets.[49]
A maximum message size setting existed but was never enforced, so one large request could exhaust the server’s memory and crash it.[50]
A value passed to the diff scan was read as a command-line option, letting an attacker create or overwrite files outside the workspace. AWS issued a bulletin on October 1.[13]
Skill marketplaces that bundle tools were targeted too. In February 2026, Koi Security audited all 2,857 skills on ClawHub, OpenClaw’s skill registry, and found 341 malicious ones (about 11.9%). Of those, 335 belonged to a single campaign, ClawHavoc, that spread a macOS information stealer.[51] ClawHub has tightened its checks since. According to the foundation’s October 2 post, every uploaded skill and plugin now goes through two separate scanners, NVIDIA’s SkillSpector and Tencent’s AIG, and an AI judge weighs both results to make the final call. In the foundation’s own test with Tencent on a 556-case public benchmark, the system correctly flagged 98.6% of the malicious cases.
In the first case, the original report only said “government entities in Asia.” Taiwan’s Ministry of Digital Affairs confirmed an AI-agent-assisted attack the next day.[52][55]
📋 The full OWASP Top 10 for Agentic Applications (2026)
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI04 Agentic Supply Chain Vulnerabilities
- ASI05 Unexpected Code Execution
- ASI06 Memory and Context Poisoning
- ASI07 Insecure Inter-Agent Communication
- ASI08 Cascading Failures
- ASI09 Human-Agent Trust Exploitation
- ASI10 Rogue Agents
Published December 9, 2025.[54]
A great badge is worthless if the door hardware is broken. Treat MCP servers like any other server: keep them patched, put them behind a gateway and use only vetted skills. Next comes the question of what must be on record when something goes wrong.
08. Logs and a stop button: what the EU AI Act asks
Regulation is starting to require this structure. If an AI system counts as high-risk under the EU AI Act, two articles matter most.
- Article 12, record-keeping: the system must technically allow automatic logging of events over its lifetime.[56] Providers and deployers must keep these logs for at least six months (Articles 19 and 26).[57][58]
- Article 14, human oversight: overseers must be able to intervene or interrupt the system “through a ‘stop’ button or a similar procedure” that brings it to a safe halt, as appropriate and proportionate.[59]
Timing matters. High-risk obligations originally due on August 2, 2026 were pushed back by the Digital Omnibus amendment, in force since July 2026. High-risk systems under Annex III (hiring, credit scoring and so on) are covered from December 2, 2027, and product-related systems under Annex I from August 2, 2028.[11] Many sources still cite August 2026, so be careful.
In the US, NIST published its generative AI risk profile (AI 600-1) in 2024, and the international standard ISO/IEC 42001 sets out an AI management system.[60][61] Products that enforce policy at runtime are multiplying too. Fiddler AI pitches an “AI Control Plane,” and Salt Security a security graph linking agents, MCP servers and APIs. Both descriptions are the vendors’ own.[62][63]
The law does not say “tamper-evident,” but a log you can trust after an incident should be one nobody can quietly edit. An access logbook anyone can erase is not much of a logbook.
09. Hidden costs and real results
Agents cost more than chatbots. EY’s example: a customer service chat that cost $0.04 two years ago can become a $1.20 orchestration once it involves tool retrieval, planning and subagents, 30 times the cost per task.[5] It is an illustration, not measured spend.
The results are mixed. MIT NANDA’s preliminary 2025 report said 95% of organizations were getting zero return from generative AI; it is a small, early study.[64] In KPMG’s Q1 2026 survey, companies planned to invest an average of $186 million in AI over the next 12 months, yet only 8% reported established ROI.[65] Meanwhile, executives in a PagerDuty survey expected an average 171% return on agentic AI (192% in the US). That is an expectation, not a result.[66]
- Early 2025
- 380,000 conversations in 90 days, 84% resolved
- Now
- More than 2 million handled, over 68% resolved
- June 2025
- 90% of chats resolved without handing off to a human
- Tool
- Salesforce Agentforce
- 2024
- 2.3 million chats in the first month, the work of 700 agents
- 2025
- Began hiring human agents again for quality
Salesforce’s figures come from CEO Marc Benioff’s February 2025 post and the current case page; Heathrow’s from a Salesforce press release.[67][68][69] Klarna announced its first-month results in 2024, but in 2025 its CEO said cost had weighed too heavily and quality suffered, and the company began adding human agents again.[70][71]
So rather than hours saved, measure the cost of each resolved case. Failed AI conversations still cost money, and cases handed to people get paid for twice. Find the break-even point below.
Break-even resolution rate: 14.8% ·
A simple calculation. It assumes every AI conversation costs money, even failed ones, and that every case AI cannot solve goes to a person. Defaults are Salesforce Agentforce’s $2 list price per conversation and Gartner’s 2024 median of $13.50 per assisted contact. Fixed costs such as licenses, integration, monitoring and reviewers are not included.[72][73]
Move the sliders and you will see the real cost of each AI-resolved case climb steeply as the resolution rate falls. Gartner predicts that by 2030 the cost per resolution for generative AI in customer service will exceed $3, more than many offshore human agents.[74] In badge terms, issuing lots of badges matters less than whether each badge holder actually gets the job done.
10. Where should your company start?
The right starting point depends on your situation. Pick three answers. Options that don’t fit your conditions drop out first.
Install it free (MIT) on your own Kubernetes and manage permissions, logs and isolation yourself. It is pre-1.0 and meant for pilots, and its default model integration is OpenAI. Evaluate runtime isolation alongside Red Hat OpenShift or NVIDIA NemoClaw.
Closest to an AI assistant for each employee. A Premium seat ($100/month billed annually) includes the first dot, and Enterprise workspaces need an admin to switch it on. Data is processed in OpenAI’s cloud.
Built for customer conversations on WhatsApp and Messenger and for small-business work. Meta says publishing, sending and spending require approval. Enterprise admin consoles, pricing and certifications have not been published yet.
If the workflow has to be written in code, use a framework. CrewAI suits role-based teamwork; LangGraph suits flows that must wait for approval and restart. Pair them with a control plane such as AMP, LangSmith Deployment or OCE for operations.
Check your conditions again.
Whichever you choose, the checks before handing an AI worker its badge are the same. Tick them off.
0 / 6 · Not started
The launches of September’s last two days, and the standard Meta previewed on October 6, point the same way. The race is no longer only about making agents smarter. It is also about who best decides what agents may do, how their actions are recorded and when they are stopped. Before a good AI worker does great work, it stays within the limits of its badge.
Wrap-up quiz
Lock it in with five questions. Explanations appear as soon as you pick.
🪪 Wrap-up quiz · Score 0 / 5
Q1What license does OpenClaw Enterprise use?
It is free, MIT-licensed open source, though pre-1.0 and recommended for internal pilots (section 03).
Q2In Red Hat’s blueprint, what decides which tools an agent can actually call?
Token claims. Red Hat wrote that it is “determined by its token claims, not by the prompt” (section 04).
Q3When do EU AI Act high-risk (Annex III) obligations apply?
The Digital Omnibus amendment moved them to December 2, 2027 (section 08).
Q4In Koi Security’s first audit of ClawHub skills, what share was malicious?
341 of 2,857, about 11.9% (section 07).
Q5In EY’s example, an agent conversation costs how many times a chatbot conversation from two years ago?
From $0.04 to $1.20, 30 times. It is an illustrative example (section 09).
🔎 What we confirmed and what we couldn’t
From what we checked against public sources while writing, these are the claims most easily misunderstood. Updated Oct 6, 2026: we added Meta and Sierra’s Personal Agent Protocol preview (October 6), ClawHub’s tighter skill scanning and OpenAI’s dots scope tests to the article, and rechecked the GitHub star counts.
| Common claim | What we found (Oct 3, 2026, KST) |
|---|---|
| OpenAI acquired OpenClaw | There was no acquisition. The creator joined OpenAI in February 2026 and OpenClaw moved to a foundation. What started at OpenAI and was donated to the foundation is OCE.[7][2] |
| OCE deploys straight from Docker Compose and can swap in local open models | Compose only starts a control-plane preview. We found no documented path to local open-weight models; the default model is OpenAI’s gpt-6-astra.[15][17] |
| Androidclaw runs on OCE | It is featured in the announcement, but no sentence says it runs on OCE.[2] |
| Red Hat’s gateway validates OIDC tokens, and Garak scans before deployment | Red Hat describes JWT token claims. Garak scanning is planned.[9] |
| NemoClaw is an OCE plugin whose privacy router picks Nemotron 3 Nano 4B | NVIDIA calls it a reference stack for OpenClaw. Nano 4B is only the default local model on generic Linux GPU hosts.[18][75] |
| ZeroClaw uses 3.4MB of memory; OpenClaw needs 390MB | 3.4MB was the early binary size, and 390MB was ZeroClaw’s own early claim. Neither figure is in the current repository.[21] |
| Meta’s enterprise realtime avatar cuts compute 60x with CCRA quantization | The realtime avatar is a consumer feature. The 60x is fewer computation steps through distillation, and we found no mention of “CCRA.”[76] |
| Meta’s enterprise platform integrates Shopify, Stripe and Canva | Those connectors belong to Muse for Small Business, launched September 29.[12] |
| Dots require the $200 Pro 200 plan and keep context as @ChatGPT in Slack and Teams | The first dot comes with Pro and Business Premium seats. @ChatGPT is a separate feature that does not use memory at launch.[27][77] |
| CrewAI has 46,000 GitHub stars and ISO 27001 certification | About 59,000 as of October 6. The trust center lists only SOC 2 Type 2 and a HIPAA audit report.[31][37] |
| AWS finished a security audit in hours with CrewAI | The source is a community post by an AWS employee, and it describes architecture reviews, not a security audit.[38] |
| 20% of 4,000 ClawHub skills are malicious | Koi Security’s audit found 341 of 2,857 (about 11.9%).[51] |
| CVE scores of 9.3 and 8.7 | Both are CVSS 4.0 scores. NVD’s CVSS 3.1 score for CVE-2026-11720 is 9.1.[49][50] |
| EU AI Act high-risk duties are enforced from August 2, 2026, and logs must be tamper-evident | The Digital Omnibus moved them to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). “Tamper-evident” is not in the text.[11][56] |
| Average enterprise AI budget is $186M and 95% see no results | $186M is planned spending over 12 months in KPMG’s survey; 95% is from MIT NANDA’s preliminary study. They are different studies.[65][64] |
| Average ROI of 171% | That is expected ROI from a PagerDuty survey, not measured results.[66] |
| Humans cost $5–6 per case vs $0.30–0.50 for AI; infrastructure is 40–60% of cost | We could not find the original sources. Gartner puts the median assisted contact at $13.50.[73] |
Frequently asked questions
Are OpenClaw and OpenClaw Enterprise the same thing?
No. OpenClaw is a personal agent people run on their own computers. OpenClaw Enterprise is a control plane companies use to deploy and manage many agents. It started at OpenAI, was donated to the OpenClaw Foundation and is published under the MIT license.
Can we use these in production right now?
It is early. OpenClaw Enterprise is pre-1.0, and the foundation recommends it for internal pilots. Dots’ Enterprise features are in beta, and Meta has not published enterprise pricing or admin features.
Is MCP safe to use?
MCP is a protocol for how connections work. In 2026, MCP server implementations still had flaws such as missing authentication (CVSS 9.8) and path traversal. Keep servers patched and use a gateway and token permissions to limit which tools agents can call.
What should we do now because of the EU AI Act?
Obligations for high-risk AI systems (Annex III) apply from December 2, 2027. Building logging (Article 12) and human oversight with a stop mechanism (Article 14) into your design now will save rework later. Check with experts whether your service counts as high-risk.
How should we measure the impact of agents?
Prefer financially grounded metrics such as cost per resolved case and autonomous resolution rate over hours saved, and include the cost of failed conversations and cases handed to people.
Keep reading
From OpenClaw to MCP, the rise of agents
🟢OpenAI DevDay 2026 recapThe day dots got their own computers
🚧When AI Agents Ignore “No”Real incidents and escape experiments
Sources
- [1]Meta Newsroom · Launching Meta Enterprise Platform (Sep 28, 2026)
- [2]OpenClaw Blog · OpenClaw Enterprise: The Open Agent Platform (Sep 29, 2026)
- [3]OpenAI · Introducing dots (Sep 29, 2026)
- [4]Cyera Research · Agent-Inflicted Damage: Inside the Real-World Failures of Enterprise AI Systems (May 28, 2026)
- [5]EY · Unlocking agentic value: agentic AI token costs (2026)
- [6]The Register · Cursor Opus agent snuffs out startup’s production database (Apr 27, 2026)
- [7]Reuters · OpenClaw founder Steinberger joins OpenAI, open-source bot becomes foundation (Feb 15, 2026)
- [8]NVIDIA Newsroom · NVIDIA Announces NemoClaw (Mar 16, 2026)
- [9]Red Hat Blog · Operationalizing “Bring Your Own Agent” on Red Hat AI, the OpenClaw edition (Mar 16, 2026)
- [10]OpenClaw Blog · Introducing the OpenClaw Foundation (Jul 8, 2026)
- [11]EUR-Lex · Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ Jul 24, 2026
- [12]Meta Newsroom · The Future Is for Everyone: Muse for Small Business (Sep 29, 2026)
- [13]AWS Security Bulletin 2026-121-AWS · security-agent-mcp-server (Oct 1, 2026)
- [14]Red Hat Developer · Architect an open blueprint for cloud-native AI agents (Jul 20, 2026)
- [15]GitHub · openclaw/openclaw-enterprise (MIT)
- [16]OpenClaw Enterprise docs · Concepts
- [17]OpenClaw Enterprise docs · Deploy your first agent
- [18]NVIDIA Technical Blog · Build a Secure, Always-On Local AI Agent with NVIDIA NemoClaw and OpenClaw (Apr 17, 2026)
- [19]GitHub · NVIDIA/NemoClaw
- [20]NVIDIA Technical Blog · Run Autonomous, Self-Evolving Agents More Safely with NVIDIA OpenShell (Mar 16, 2026)
- [21]GitHub · zeroclaw-labs/zeroclaw (MIT OR Apache-2.0)
- [22]Meta Newsroom · Introducing Meta Business Agent (Jun 3, 2026)
- [23]Meta for Developers · Build with Muse Spark (Meta Model API)
- [24]Meta for Developers · Build with Muse Code
- [25]Meta · Workplace (service closed, May 2026)
- [26]Reworked · Meta Hopes Third Time’s the Charm With Meta Enterprise Platform (Sep 28, 2026)
- [27]OpenAI Help Center · dots plans and availability
- [28]OpenAI Help Center · ChatGPT Business overview (Premium seats)
- [29]OpenAI Help Center · Manage dots in ChatGPT workspaces
- [30]OpenAI · dots admin guide for Enterprise workspaces
- [31]GitHub · crewAIInc/crewAI (MIT)
- [32]GitHub · langchain-ai/langgraph
- [33]LangChain Blog · LangChain and LangGraph 1.0 (Oct 22, 2025)
- [34]LangChain · Built with LangGraph
- [35]LangChain Blog · LangGraph Platform is now LangSmith Deployment
- [36]CrewAI Docs · AMP (Agent Management Platform) introduction
- [37]CrewAI · Trust Center
- [38]AWS Builder Center (community post) · Transform Enterprise Architecture Reviews with AI: From Months to Hours Using CrewAI and Amazon Bedrock AgentCore (Sep 24, 2025)
- [39]AWS Docs · What is Amazon Bedrock AgentCore?
- [40]BeeAI Framework · Welcome
- [41]Linux Foundation · IBM contributes BeeAI, Docling and Data Prep Kit to LF AI & Data (Apr 29, 2025)
- [42]LF AI & Data · ACP joins forces with A2A under the Linux Foundation (Aug 29, 2025)
- [43]Temporal · AI applications and agents with Durable Execution
- [44]Anthropic · Donating the Model Context Protocol and establishing the Agentic AI Foundation (Dec 9, 2025)
- [45]Model Context Protocol · Specification Nov 25, 2025
- [46]NVD · CVE-2026-33032 (Nginx UI MCP endpoint missing authentication)
- [47]NVD · CVE-2026-27944 (Nginx UI backup endpoint)
- [48]Rapid7 · CVE-2026-33032: Nginx UI missing MCP authentication (Apr 16, 2026)
- [49]NVD · CVE-2026-11720 (MCP Toolbox path traversal)
- [50]NVD · CVE-2026-39313 (mcp-framework denial of service)
- [51]Koi Security · ClawHavoc: 341 malicious skills found (Feb 1, 2026)
- [52]Dream Research Labs · Inside a multi-agent AI framework used to compromise government entities in Asia (Aug 12, 2026)
- [53]Palo Alto Networks Unit 42 · Autonomous AI cyber attack campaign (Jul 30, 2026)
- [54]OWASP GenAI Security Project · Top 10 for Agentic Applications for 2026 (Dec 9, 2025)
- [55]Focus Taiwan · Ministry of Digital Affairs on AI-agent-assisted attack (Aug 13, 2026)
- [56]European Commission AI Act Service Desk · Article 12: Record-keeping
- [57]European Commission AI Act Service Desk · Article 19: Automatically generated logs
- [58]European Commission AI Act Service Desk · Article 26: Obligations of deployers
- [59]European Commission AI Act Service Desk · Article 14: Human oversight
- [60]NIST AI 600-1 · AI RMF: Generative AI Profile (Jul 26, 2024)
- [61]ISO/IEC 42001:2023 · AI management system
- [62]Fiddler AI · AI Control Plane
- [63]Salt Security · Extends its agentic security platform with AI detection and response (Sep 22, 2026)
- [64]MIT NANDA · The GenAI Divide: State of AI in Business 2025 (preliminary findings)
- [65]KPMG · Global AI Pulse survey, Q1 2026 (Mar 2026)
- [66]PagerDuty · Agentic AI Survey 2025 (Apr 2, 2025)
- [67]Marc Benioff on X · Agentforce on help.salesforce.com (Feb 26, 2025)
- [68]Salesforce · Agentforce Customer Zero
- [69]Salesforce UK · Heathrow Airport and Agentforce (Jun 11, 2025)
- [70]Klarna · AI assistant handles two-thirds of customer service chats in its first month (Feb 2024)
- [71]Customer Experience Dive · Klarna reinvests in human talent for customer service (May 2025)
- [72]Salesforce · Agentforce pricing
- [73]Gartner · Customer service cost per contact benchmark (Feb 1, 2024)
- [74]Gartner · GenAI cost per resolution will exceed offshore human agent costs by 2030 (Jan 26, 2026)
- [75]NVIDIA NemoClaw docs · Choose an inference provider
- [76]Meta AI Research · Bringing your Muse to life (Sep 23, 2026)
- [77]OpenAI Help Center · @ChatGPT in Slack and Microsoft Teams
Last checked Oct 3, 2026, KST.
