Tencent QClaw Put OpenClaw on a Million Machines in Ten Days

Tencent QClaw crossed a million users in ten days. Tencent's PC Manager team put that number out in March 2026, and what those million people installed was not a Tencent model. It was a desktop wrapper around OpenClaw, an MIT-licensed agent runtime written by an Austrian developer named Peter Steinberger and first published on 24 November 2025 under the name Warelay.

The interesting part is the distribution. Not the assistant. A platform company took an open-source runtime it did not write, wrapped it in an installer, put a QR code in front of the setup and shipped it to consumers as a three-minute download. That is a different bet from the one OpenAI and Anthropic are making, and the choice to run the thing on the user's own machine has consequences that cut in both directions.

I competed in Tencent's OpenClaw hackathon in Shenzhen in March 2026 and took second place, presenting in Mandarin. The runtime went from a viral GitHub repository in late January to a packaged Tencent consumer product on 9 March. Roughly six weeks. I have been shipping production software for most of a decade and I have not watched that compression happen before.

What Tencent QClaw actually ships

TechNode reported internal testing on 9 March 2026. The build came out of Tencent's PC Manager team rather than the model side of the company, and that origin shows in the product. One-click deployment. The open-source framework packaged into a local startup bundle. Instructions sent from WeChat and QQ chat windows to a computer sitting at home.

Tencent's newsroom describes three preconfigured sets. QClaw It handles repetitive errands like trip planning, tax filing and ticket purchases. QClaw Daily runs routines around fitness, sleep and health. QClaw Up aims at work: marketing, social posting and job applications. In April, Tencent Cloud announced a V2 adding multi-agent collaboration with named personas, including a copywriter and a programmer.

The international beta opened on 21 April 2026 for Windows and macOS, restricted to Canada, Japan, Singapore, South Korea and the US, capped at 20,000 early-access slots and free during the trial. Download, register, scan a QR code, running in three minutes. Tencent says the international build took five days and that 99% of its code was generated by QClaw itself. Treat that second claim as marketing until someone publishes the commit history.

The public changelog for the international build is more useful than any press release. v0.0.1 on 17 April: WhatsApp and Telegram channel links, scheduled tasks, Claw Gateway. v0.0.3 on 21 April: custom model configuration plus a Keep Awake mode. v0.0.4 on 29 April: Discord, Slack and email sign-in. v0.0.5 on 13 May: file upload, personal email connection, memory and context compression. v0.0.7 on 29 May: system permission management alongside GLM, MiniMax, Kimi and DeepSeek. Tencent separately claims more than 80 feature iterations on the Chinese build within a month.

Local execution, remote cognition. The word local in this product describes the execution plane, not the data plane.

The distribution model is the product

Look at what Tencent actually contributed. Not a model. Not the runtime. An installer, a QR-code onboarding flow, channel plumbing into WeChat and QQ, an update cadence and a security brand. That was the whole contribution, and it reached a million people faster than most Chinese model labs reached their first hundred thousand.

The Western consumer assistant is a subscription to somebody's cloud. Your context lives in their tenancy, inference runs on their silicon, and the endpoint is the product. QClaw inverts nearly all of that. The runtime is MIT-licensed and readable. The model is a field in a settings pane, and by 29 May that field accepted GLM, MiniMax, Kimi and DeepSeek alongside a bring-your-own API key. When the model is a dropdown, the model is a commodity input, and the company saying so out loud is Tencent.

Steinberger announced he was joining OpenAI on 14 February 2026, with stewardship of the project moving to an independent foundation. Three weeks later Tencent shipped his runtime to a million Chinese consumers. Nobody had to ask permission, nobody signed anything and no partnership was announced. That is what the MIT licence is for, and it is the part Western product teams keep underrating.

This is an old business. Package something free, make it installable by a person who has never opened a terminal, own the channel it talks through. Tencent has run that play since QQ. The novelty is that the thing being packaged executes shell commands on the user's disk.

Where the execution and the data actually live

Tencent's official line is that QClaw runs on the user's device, with all data processed within the user environment. KrASIA's reporting on the same launch is more precise: agent operations and local file processing take place on the user's device, while inference calls are routed through selected model providers.

Both statements are true. The distance between them is the entire privacy question.

Your filesystem stays put. The agent reads, writes and executes locally, and no Tencent server holds a copy of your project directory. But an agent reasons by putting things into a context window, and that context window travels to whichever provider's key you pasted into the settings pane. Ask it to summarise a contract and the contract leaves the machine. Local execution, remote cognition. The word local in this product describes the execution plane, not the data plane, and a consumer reading the marketing copy has no way to tell those apart.

What Claw Gateway is screening for

Upstream OpenClaw is built around a Gateway, an always-on control plane owning sessions, channel routing, tool dispatch and events, binding to port 18789 by default. Every message from every connected surface passes through it. So does every tool call. Concentrating that much in one process is fine design for a hobby project and an enormous target for everyone else.

In April 2026, researchers at Texas A&M's SUCCESS Lab published an analysis of 470 security advisories against the framework, sorted across ten architectural layers. The Gateway WebSocket interface accounted for 121 of them, roughly a quarter, with 7 critical and 47 high-severity findings in that component alone. They documented a three-stage remote code execution chain: server-side request forgery through an unvalidated gatewayUrl parameter, then bearer token exfiltration over an unprotected WebSocket, then execution by rewriting the exec approval policy. They also found thirteen allowlist bypasses using mutable identity fields and three ways to defeat the exec allowlist through shell syntax alone: line continuation, busybox multiplexing and GNU option abbreviation.

Skills are the other half. Koi Security disclosed a campaign on 1 February 2026 that Antiy later classified as Trojan/OpenClaw.PolySkill. A single publisher account uploaded 677 packages. 386 malicious skills landed on 31 January alone, and 1,184 have appeared on ClawHub historically. The technique was not clever, which is exactly why it worked: instructions written into the SKILL.md file under a heading like Prerequisites or Setup, which the agent then follows as installation steps, pulling an archive that drops Atomic macOS Stealer or a reverse shell.

So Claw Gateway has three real jobs. Separate instructions the user typed from text the agent merely read, which is the indirect prompt injection problem and which nobody has solved. Verify skills before they are written into the workspace, since upstream writes them there with no signature check. And catch exec calls that satisfy the allowlist as strings while doing something else entirely as processes.

Tencent describes the module as real-time detection of malicious instructions and skill poisoning risks. The changelog puts it more plainly: it guards every action during your session and flags risks before they become problems. No independent audit of Claw Gateway has been published that I can find. For a security module shipped to a million consumers, that absence is the fact worth holding onto.

The strongest argument against all of this

Here is the case against, made properly. Local execution is worse for security, not better.

A million consumer laptops running an always-on agent with shell and filesystem access is a worse aggregate posture than a million sessions inside one hardened cloud tenancy with a paid security team watching it. The numbers support this. SecurityScorecard counted 135,000 OpenClaw instances reachable from the open internet on 9 February 2026. Censys still found around 63,000 in March. Investigators found administrative interfaces leaking whole configuration files: API keys, bot tokens, OAuth secrets. A cloud vendor patches once and every user is patched. A desktop installer patches when the user opens the app, and consumers do not open apps in order to patch them. Tencent's insistence that everything is processed in the user environment also does quiet work as liability transfer. If it breaks, it breaks on your machine.

Most of that is correct. The answer is not that local execution is safer. Local execution is differently accountable, and the accounting is not obviously worse.

The cloud assistant trades a small per-user blast radius for one target holding everyone's context, with no ability for you to inspect what it did on your behalf. The local agent gives you a runtime you can read, pin to a version and firewall. You can see the process. You can revoke the key. That matters more for the users who will act on it than the aggregate exposure numbers suggest, because those numbers are dominated by installs nobody ever configured. And the packaging layer is precisely where patch cadence gets enforced. A wrapper with auto-update fixes the desktop-patching problem the criticism identifies, and nine versions in eight weeks is that mechanism working rather than decoration.

What I cannot answer is whether Claw Gateway does what it claims. That is the load-bearing assertion in the whole product, and it is unverified.

Shenzhen's split decision

On 6 March 2026, Tencent ran a free public installation event at the north square of Tencent Building in Shenzhen. People flew in from other provinces for it. Retirees turned up. That is the same city where Longgang district drafted an incentive package offering up to 10 million yuan, about 1.4 million US dollars, in subsidies and financing for companies building notable OpenClaw applications, plus free computing resources, accommodation and discounted office space for one-person companies. The draft stayed open for public comment until 6 April.

In the same window, CNCERT issued two risk alerts on OpenClaw, naming prompt injection that leaks system keys and irreversible deletion caused by misread instructions. Central directives kept the software off machines inside state-owned enterprises, government agencies and banks.

A district government paying you to build on it. A national body warning you about it. A ban on it inside the state itself. All three at once, all in one month. Living here, that combination does not read as confusion. It reads as a decision: take the industrial upside and keep the exposure outside the institutions that matter.

The laptop lid problem

The detail I keep returning to is Keep Awake, shipped in v0.0.3 on 21 April.

Anyone who has shipped desktop software recognises what that line item means. The hard problem of a consumer local agent is not reasoning. It is a laptop lid. Sleep states, power policy, permission prompts on macOS, a background process the OS decides to suspend at 2am, a scheduled task that silently did not run and gave no indication it had not run. I have spent more of my career on that class of problem than on anything a model does, and no amount of model quality removes any of it. Tencent's real engineering contribution here is unglamorous persistence work, and unglamorous persistence work is what turns a GitHub repository into something a million people can use.

Which sets up the tension the product cannot resolve. The wrapper's entire value is that it hides the runtime. Three minutes, a QR code, no terminal. Everything CNCERT warned about lives inside that hidden runtime, in the exec policy and the skill loader and the WebSocket the Gateway holds open. The better the packaging gets, the fewer of those million users can tell the difference between the agent doing what they asked and the agent doing what a web page told it to.

Tools referenced

OpenClaw, reviewed here: OpenClaw review.

Claude, reviewed here: Claude review.

ChatGPT, reviewed here: ChatGPT review.

DeepSeek, reviewed here: DeepSeek review.

MiniMax M3, reviewed here: MiniMax M3 review.

Ollama, reviewed here: Ollama review.

Sources

Tencent newsroom: Tencent Launches QClaw Globally, Lowering Barriers to AI Agent Deployment: https://www.tencent.com/en-us/articles/2202318.html

KrASIA: Tencent opens international beta for AI agent product QClaw: https://kr-asia.com/tencent-opens-international-beta-for-ai-agent-product-qclaw

QClaw international changelog (qclawsg.qq.com): https://qclawsg.qq.com/changelog.html

TechNode: Tencent reportedly tests QClaw AI agent with one-click OpenClaw deployment: https://technode.com/2026/03/09/tencent-reportedly-tests-qclaw-ai-agent-with-one-click-openclaw-deployment/

Suwansathit, Zhang and Gu, A Security Analysis of the OpenClaw AI Agent Framework (arXiv:2603.27517): https://arxiv.org/html/2603.27517v3

Antiy Labs: ClawHavoc, large-scale poisoning campaign targeting the OpenClaw skill market: https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/

SCMP: Chinese local governments offer OpenClaw project subsidies as security questions linger: https://www.scmp.com/tech/policy/article/3345986/chinese-local-governments-offer-openclaw-project-subsidies-security-questions-linger

SCMP: China issues second warning on OpenClaw risks amid adoption frenzy: https://www.scmp.com/tech/tech-trends/article/3346138/china-issues-second-warning-openclaw-risks-amid-adoption-frenzy