Mert

Executive Summary

In early 2026, OpenClaw became one of the fastest-growing open-source projects on GitHub, passing
200,000 stars in under three months.

Built by Austrian developer Peter Steinberger, it introduced a much more operational model for AI:
agents that do not just respond, but autonomously execute multi-step tasks across real systems.

That adoption wave confirmed a major shift in buyer and developer interest:

Organizations increasingly want AI that acts, not just AI that advises.

At the same time, OpenClaw’s rise also exposed a second reality. Once AI agents move from chat
interfaces into real execution, the hard problems are no longer only about model quality. They are
about security, governance, identity, auditability, and trust boundaries.

AWS is approaching the same direction from the opposite side.

Amazon Quick Suite, evolved from QuickSight, pushes toward agentic workspaces and business
automation, but does so inside a more structured enterprise control model.

The result is a useful contrast: OpenClaw proved demand, while Amazon Quick Suite represents the
kind of operating envelope enterprises are more likely to accept in production.

OpenClaw: The Agent That Went Viral

Architecture and core capabilities

OpenClaw is a locally hosted Node.js gateway that connects large language models to external
systems through a plugin architecture built around skills.

Its appeal was straightforward:

• multi-step task execution
• messaging-first interaction through tools such as Slack, Discord, and WhatsApp
• scheduled automation through cron jobs
• a large and rapidly growing ecosystem of community-contributed skills

This combination made OpenClaw feel less like a chatbot and more like an operator.

Adoption trajectory

The project’s growth curve was unusually steep:

• launched as Clawdbot in November 2025
• renamed to OpenClaw in January 2026
• passed 100,000 stars in February 2026
• moved beyond 200,000 stars shortly after

Whether or not every growth claim remains stable over time, the broader signal was clear:
OpenClaw captured attention faster than most infrastructure or AI tooling projects in recent
memory.

The security reality

As adoption accelerated, security concerns surfaced just as quickly.

The reported issues around OpenClaw included:

• hundreds of vulnerabilities, including critical findings
• a remote code execution exploit
• exposed API keys
• malicious or unverified skills
• prompt injection and memory poisoning scenarios

The point is not that open-source agent systems are inherently unsafe. The problem is that once an
agent can authenticate, call tools, access memory, and trigger actions, the blast radius expands
dramatically.

OpenClaw made that risk visible in public.

The enterprise identity gap

Traditional enterprise systems assume a mostly human-centered model of action:

This is where many agent platforms start to break down in enterprise settings. Execution is easy to
demo. Trust boundaries are much harder to operationalize.

Amazon Quick Suite: The Enterprise Answer

From QuickSight to Quick Suite

Amazon Quick Suite extends QuickSight into a broader agentic workspace that combines analytics,
automation, collaboration, and AI-assisted task execution.

In practical terms, it signals that AWS sees the future of business intelligence as more than
dashboards. The platform is moving toward systems that can research, automate, coordinate, and
assist inside controlled enterprise environments.

Core components

The suite is framed around several capabilities:

• Quick Research for structured report generation
• Quick Flows for workflow creation from natural language
• Quick Automate for multi-agent orchestration with approvals
• QuickSight for analytics and dashboards
• Quick Spaces for team workspaces
• Quick Chat Agents for configurable assistants

The underlying idea is similar to OpenClaw’s vision: reduce the gap between intent and execution.
The delivery model is different.

Enterprise integration

Quick Suite is designed around managed integrations rather than a wide-open plugin marketplace.

Examples include connectors for:

• Salesforce
• ServiceNow
• Slack
• Gmail
• Exchange
• S3

That distinction matters.

• OpenClaw scales through community skills
• Quick Suite scales through AWS-managed integrations

The first model grows faster. The second model is easier to defend in enterprise environments.

Governance and compliance

Quick Suite is much more explicitly positioned around enterprise controls.

That includes alignment with frameworks and capabilities such as:

• SOC
• HIPAA
• ISO 27001
• ISO 27018
• ISO 9001
• GDPR
• FedRAMP
• role-based access control
• audit logging
• human-in-the-loop workflows

For enterprise buyers, these controls are not secondary product details. They are often the actual
buying criteria.

Feature Comparison

Same Vision, Different Starting Points

What OpenClaw proved

OpenClaw proved several things very quickly:

• demand for autonomous agents is real
• messaging-first user experience drives adoption
• open ecosystems can scale at extraordinary speed

It made the future feel immediate.

What OpenClaw cannot reliably deliver

For enterprise use, however, OpenClaw also highlighted what is still missing:

• robust access control
• durable auditability
• compliance alignment
• formal governance

That does not make it unimportant. It makes it a market signal rather than a production template.

OpenClaw is best understood as proof of demand, not proof of enterprise readiness.

Where Quick Suite wins

Amazon Quick Suite aims at much of the same destination:

• autonomous execution
• cross-system orchestration
• persistent context

But it starts from the constraints enterprises already care about:

• security
• compliance
• identity control
• governance

That gives AWS a more credible path into production environments where risk, approvals, and audit
trails are part of the workflow rather than an afterthought.

The trade-offs

That does not mean Quick Suite is automatically the better answer in every setting.

It comes with trade-offs of its own:

• AWS ecosystem lock-in
• a narrower extension model than open-source ecosystems
• subscription and platform cost considerations
• the maturity risks that come with newly evolving product categories

The difference is that these are enterprise trade-offs, not existential trust-boundary gaps.

Conclusion

OpenClaw proved that the market is ready for AI agents that can act.

It also made visible how fragile open agent systems become when they move into real execution
without strong identity, control, and governance models.

Amazon Quick Suite represents a more enterprise-safe version of the same broader future.

The central question is no longer whether AI agents will operate across enterprise systems.

It is this:

Will they operate inside governance, or outside it?

Sources

1. OpenClaw – Wikipedia
2. OpenClaw Explained: The Free AI Agent Tool Going Viral in 2026 (KDnuggets)
3. What is OpenClaw? Your Open-Source AI Assistant for 2026 (DigitalOcean)
4. Running OpenClaw Safely: Identity, Isolation, and Runtime Risk (Microsoft Security Blog)
5. From Automation to Infection: How OpenClaw Skills Are Being Weaponized (VirusTotal Blog)
6. OpenClaw Malicious Skills Analysis (Koi Security)
7. Why OpenClaw Is the #1 Enterprise Wake-Up Call of 2026 (Lyzr AI)
8. Reimagine Business Intelligence: Amazon QuickSight Evolves to Quick Suite (AWS Blog)
9. Amazon QuickSight / Quick Suite Product Page (AWS)
10. NVIDIA Announces NemoClaw for the OpenClaw Community (NVIDIA Newsroom)
11. How OpenClaw Is Transforming AI Adoption (Fortune)
12. Prompt Injection Attacks on OpenClaw Memory Systems (Permiso)
13. OpenClaw Exposure: 1.5M API Keys and Security Risks (Wiz Research)
14. CVE-2026-25253: OpenClaw Remote Code Execution (DepthFirst)

The Problem

Every AWS developer knows this pain: you need a reference architecture or sample code, and you end up with 47 browser tabs open across GitHub, AWS docs, Stack Overflow, and random blog posts from 2019.

GitHub search gives you 2,000 results with zero context. ChatGPT confidently hallucinates repos that don’t exist. Stack Overflow answers are outdated.

What I Built

I built an AI-powered search engine that indexes 10,000+ repos from AWS’s official GitHub organizations:

• aws-samples: 8,031 repos
• awslabs: 993 repos
• aws-solutions-library-samples: 315 repos
• aws-ia: 234 repos
• aws-solutions: 72 repos

How It Works

The search uses a hybrid approach:

• 70% BM25 (keyword matching) — catches exact AWS service names
• 30% FAISS (semantic vector search) — understands what you mean, not just what you type

Each repo is classified by Amazon Bedrock (Nova Pro) across 22 metadata fields: solution type, AWS services used, complexity, freshness, setup time estimate, and more.

Auto-indexed twice daily via EventBridge — new AWS repos are searchable within 12 hours.

Tech Stack

• Amazon Bedrock (Nova Pro) for AI classification
• FAISS with Titan Embed v2 (1024-dim) for vector search
• AWS Lambda (Docker, Python 3.12)
• API Gateway
• DynamoDB for usage tracking
• CloudFront + S3 for frontend
• EventBridge for scheduled indexing
• AWS CDK (TypeScript) for infrastructure

Key Architecture Decisions

Why hybrid search over pure vector?
AWS service names are precise — “Lambda” means something specific. Pure semantic search sometimes returns “serverless compute” results when you specifically want Lambda. BM25 catches exact matches, FAISS catches intent. The 70/30 split was tuned through testing.

Why FAISS over OpenSearch?
Cost. OpenSearch Serverless has a minimum cost that runs 24/7. FAISS on Lambda + S3 costs under $6/month for the search component. For a bootstrapped product, that matters.

Why 22 metadata fields?
Developers don’t just want to find a repo — they want to know: Is it maintained? How complex is it? What AWS services does it use? How long will setup take? Nova Pro classifies each repo across all 22 fields automatically.

What I Learned

1. Hybrid search beats pure vector for domain-specific queries
2. FAISS on Lambda is surprisingly cost-effective
3. The 22-field classification is what makes results actually useful — not just the search itself
4. Auto-indexing twice daily keeps results fresh without manual work

Try It

Free to use — 3 searches without registration, 10 per day with a free account.

AWS Solution Finder

What’s Next

Exploring ways to improve relevance scoring and add more metadata fields. If you’ve worked with FAISS or hybrid search, I’d love to hear your approach.

Built solo by an AWS Community Builder. Questions? Drop a comment.

This article presents COA-MAS — a governance framework for autonomous agents grounded in organizational theory, institutional design, and normative multi-agent systems research. The full paper is published on Zenodo: doi.org/10.5281/zenodo.19057202

The Problem No One Is Talking About

Something unusual happened in early 2026. The IETF published a formal Internet-Draft on AI agent authentication and authorization. Eight major technology companies released version 1.0 of the Agent-to-Agent Protocol. And a widely-read post demonstrated why the prevailing credential model for AI agents was structurally broken.

The convergence wasn’t coincidental. It was the signal that a structural problem — long present in early agentic deployments — had reached the threshold of production consequence.

We’ve built agents that can:

• Delete production databases
• Execute financial transactions
• Modify business logic
• Spawn other agents

And we gave them API keys.

An API key authorizes access. It does not authorize a specific action with a specific impact in a specific context. That distinction is the entire problem.

The Structural Failure Mode: Distributed Cognitive Chaos

I call this failure mode Distributed Cognitive Chaos (DCC): the structural consequence of deploying agents without formal authority hierarchies, authorization contracts, or enforcement boundaries.

DCC has three symptoms:

1. Action hallucination — an agent executes an action it was never authorized to perform, because nothing formally defined “authorized”
2. Mandate drift — through a chain of agent-to-agent delegations, the original human intent gets distorted beyond recognition
3. Accountability collapse — when something goes wrong, there is no tamper-evident record connecting the action to the authority that (supposedly) permitted it

This is not a new problem. It’s the oldest problem in organizational theory: how do you coordinate partially autonomous actors toward collective goals while preventing any individual actor from harming the collective?

Herbert Simon identified it in 1947. Elinor Ostrom solved it in 1990. We just haven’t applied those solutions to AI agents yet.

COA-MAS: A Governance Framework Grounded in Theory

COA-MAS (Cognitive Organization Architecture for Multi-Agent Systems) is my answer. It synthesizes four intellectual traditions:

• Simon’s bounded rationality → why agents need external governance
• Ostrom’s institutional design principles → how to structure governance for durability
• Normative multi-agent systems research → how to formalize governance as computable norms
• Sociotechnical systems theory → how to make social norms technically enforceable

The framework has three components. Each answers a different question.

Component 1: The Four-Layer Architecture

Question: Who is in charge?

Think of it as a corporate structure for AI agents:

┌─────────────────────────────────────────────┐
│ LAYER 4 — STRATEGIC ORCHESTRATION                  │
│ Receives human objectives · decomposes into tasks  │
└─────────────────────────────────────────────┘
                        ↕
┌─────────────────────────────────────────────┐
│ LAYER 3 — COGNITIVE GOVERNANCE                     │
│ Evaluates proposed actions · issues authorization  │
│ documents · maintains audit ledger                 │
└─────────────────────────────────────────────┘
                        ↕
┌─────────────────────────────────────────────┐
│ LAYER 2 — FUNCTIONAL SPECIALIZATION                │
│ Domain agents · execute tasks within their         │
│ cognitive authority boundary                       │
└─────────────────────────────────────────────┘
                        ↕
┌─────────────────────────────────────────────┐
│ LAYER 1 — EXECUTABLE CULTURE (Constitutional)      │
│ Versioned YAML policies · weights · thresholds     │
│ Human-authored before runtime. Immutable during.   │
└─────────────────────────────────────────────┘

The critical insight, drawn from both Simon and Ostrom, is the separation between those who propose actions and those who authorize them. An agent cannot authorize its own actions. This mirrors the principle of checks and balances in constitutional systems: the body that proposes is not the body that authorizes is not the body that records.

Component 2: The Action Claim

Question: What exactly is the agent authorized to do?

An Action Claim is a formal authorization document that agents must present before executing any real-world action. It’s analogous to a building permit — not just “you’re allowed to build,” but: the location, the dimensions, the materials, the timeline, the inspector, and the version of the building code that governed the approval.

The Action Claim has three parts:

{
  // DECLARED FIELDS — filled by the agent
  "proposed_transition": "DELETE expired sessions older than 90 days",
  "originating_goal": "scheduled maintenance task #4421",
  "delegation_chain": ["human:ops-team", "agent:orchestrator-01", "agent:db-cleaner"],
  "estimated_impact": {
    "destructivity": 0.25,
    "data_exposure": 0.00,
    "resource_consumption": 0.30,
    "privilege_escalation": 0.00,
    "logic_integrity": 0.05,
    "recursive_autonomy": 0.10
  },

  // DERIVED FIELDS — filled by GOV-RISK (Layer 3)
  "justification_gap": 0.08,
  "decision": "APPROVE",
  "governance_signature": "sha256:a3f9...",
  "policy_digest": "sha256:1b2c...",

  // AUDIT FIELDS — filled by infrastructure
  "ac_id": "ac-2026-03-31-00421",
  "state": "AUTHORIZED",
  "committed_at": "2026-03-31T14:22:01Z"
}

The tripartite structure reflects Ostrom’s principle of separating operational decisions from the collective-choice rules that govern them. The agent operates at the operational level; Layer 3 applies institutional norms; the audit trail creates an immutable record connecting every decision to the rules that governed it.

Component 3: The AASG (Autonomous Agent Security Gateway)

Question: How is authorization enforced?

Think of the AASG as a customs inspector at the boundary between the agents’ cognitive world and the real world of executing tools.

Agent Cognition (A2A) ────────────────► Real World (MCP)
                              │
                         [ AASG ]
                              │
                    Checks exactly 3 things:
                    1. Is the Action Claim valid and signed?
                    2. Is the agent identity correct?
                    3. Does the actual tool call match 
                       what was declared?

The AASG is a physically separate process — not a library in the agent, not a plugin in the MCP server. This separation is the architectural expression of Simon’s insight: governance constraints must be external to the decision-maker they constrain. An agent cannot reliably police itself.

What happens when an agent lies?

Consider an agent authorized to clean up expired sessions. It gets an AUTHORIZED Action Claim with destructivity: 0.25. Then it tries to execute:

DELETE FROM users  -- no WHERE clause

The AASG projects the actual tool call onto the governance space:

Declared: destructivity = 0.25 (bounded deletion)
Actual:   destructivity = 1.00 (full table wipe)

Congruence delta: 0.75 >> threshold (0.20)
→ ERR_AASG_003: CONGRUENCE_VIOLATION
→ Action never reaches the database
→ Merkle Ledger: INTERCEPTED entry recorded
→ GOV-AUDIT: SCOPE_SUBDECLARATION_DETECTED alert

The action is blocked before any damage occurs — not discovered in a log review afterward.

The Justification Gap: The First Computable Proportionality Metric

The core innovation in COA-MAS is the Justification Gap — a metric that answers: is this specific action proportional to the mandate that authorized it?

The governance space has six dimensions:

The formula:

Gⱼ(V_A, V_M) = Σ wᵢ · φ(aᵢ, mᵢ)

where φ(aᵢ, mᵢ) =
  0               if aᵢ ≤ mᵢ   (within mandate)
  ((aᵢ - mᵢ)/mᵢ)² if aᵢ > mᵢ  (quadratic penalty)
  +∞              if aᵢ > 0 ∧ mᵢ = 0  (absolute prohibition)

The decision:

Gⱼ ≤ 0.15  →  APPROVE
0.15 < Gⱼ ≤ 0.40  →  ESCALATE (human review with full dossier)
Gⱼ > 0.40 or Gⱼ = +∞  →  BLOCK

The quadratic penalty means small excesses may be tolerable, but large excesses signal a qualitatively different action from what was authorized. The ESCALATE tier implements “meaningful human oversight” as required by EU AI Act Article 14 — with actual quantitative evidence, not just a kill switch.

Mandate Laundering: The Attack You Didn’t Know Existed

Here’s the attack that no existing security framework addresses: mandate laundering.

In a delegation chain Human → Agent₁ → Agent₂ → ... → Agentₖ, each intermediate agent can marginally expand the mandate it passes on. Each local expansion looks proportionate. But the cumulative expansion is not.

COA-MAS anchors the Justification Gap to the root human mandate, regardless of intermediate expansions:

G_chain(Aₖ) = Gⱼ(V_{Aₖ}, V_{M₀})  ← root mandate, always

G_total = 0.30 · G_local + 0.70 · G_chain

Non-Improvement Theorem: For any permissive subdelegation, G_chain is monotone non-decreasing. You cannot launder your way out of the original constraint.

How COA-MAS Fits the Standards Ecosystem

COA-MAS doesn’t compete with existing standards — it implements what they defer:

The IETF draft’s Section 12 explicitly states: “the policy model and document format are out of scope.” That is precisely where COA-MAS contributes.

The Failure Mode Transition

The most consequential architectural property of COA-MAS is the failure mode it introduces.

Traditional agentic systems: fail semantically and silently. The agent reinterprets a guideline, slightly expands a scope, finds an unanticipated interpretation. Detectable only after damage, through log analysis.

COA-MAS: introduces the explicit CONGRUENCE_VIOLATION failure mode. When an agent attempts an action that violates its declared impact vector, the AASG returns:

• A specific error code
• The dimension violated
• The quantitative delta
• A Merkle Ledger entry with full context

This is the organizational equivalent of a building inspector catching a code violation before the foundation is poured — not after the building collapses.

What’s Published

The full paper, COA-MAS: A Governance Framework for Autonomous Agents in Production Environments, is available on Zenodo:

📄 zenodo.org/records/19057202

🔑 DOI: doi.org/10.5281/zenodo.19057202

📜 License: CC BY 4.0

The paper covers:

• Full formal specification of the Action Claim ontology
• Complete mathematical treatment of the Justification Gap
• Attack pattern neutralization (scope subdeclaration, decomposition attack, mandate laundering)
• EU AI Act regulatory alignment (Articles 9, 11, 13, 14)
• Positioning against IETF, A2A, MCP, and AIMS model

Final Thought

The governance of autonomous agents is not a new problem. Simon identified its theoretical roots in 1947. Ostrom identified the institutional design solutions in 1990. Normative MAS researchers formalized the computational analogues through the 1990s and 2000s.

What’s new in 2026 is the urgency.

Agents that can delete production databases and execute financial transactions are being deployed without the governance infrastructure this body of knowledge prescribes.

COA-MAS applies established principles to a new domain. The question is not whether governance is necessary — it’s whether we build it before or after the first major incident.

If you’re building multi-agent systems in production, I’d be genuinely interested in feedback on whether these primitives map to the problems you’re encountering. The paper is open access — feel free to cite, critique, or extend.

— Rudson Kiyoshi Souza Carvalho, Independent Researcher

doi.org/10.5281/zenodo.19057202