A chatbot answers. An agent can take an action: search a folder, inspect a website, run a calculation or prepare a draft for review. The difference is access to tools, not a claim that the model has become an employee.
Open-weight models can run locally, but an agent’s permissions matter more than its marketing. A research agent that reads public websites does not need permission to delete files or send mail.
OpenClaw demonstrated both the appeal and the risks of broad autonomy. Security researchers have reported malicious skills in its ecosystem. Two published investigations have been mixed up in some accounts: an early ClawHavoc investigation reported 341 malicious skills among 2,857 examined, with 335 linked to one campaign; a later, broader audit reported 1,103 among 14,706. These are different datasets, not 1,100 skills in one campaign. The figures need their original research citations before publication.
We tried OpenClaw ourselves and subsequently decommissioned that setup. That is not a claim that we suffered an attack. It reflects a practical question: how much complexity and access should an assistant have for the work it actually performs?
For a consultancy, start with a limited task. Let an agent gather public notices and prepare a review table. Keep client archives read-only and require a person to approve publication. A local model, a modest computer and carefully chosen tools can be more useful than an expensive frontier model with unrestricted access.
