OpenClaw on a Mac Mini M4: an always-on AI agent at home

What OpenClaw is, and why an always-on Mini suits it

OpenClaw describes itself as an AI assistant on your own hardware that is available through the chat apps you already use. Its documentation lists macOS, Linux, Windows and WSL2, while its channel catalogue covers services such as Telegram, Discord, Slack and WhatsApp (docs.openclaw.ai, checked September 2026). The Mac is one possible host, not a requirement. What the Mini contributes is continuity: it can remain awake at home while a laptop travels, and it has enough unified memory to run useful local models when a cloud model is not wanted.

The assistant consists of more than a chat window. A Gateway keeps the service and connected channels running; an agent workspace holds the files the agent is meant to work with; sessions preserve conversations; skills add instructions or tools; and model-provider credentials let it call either remote APIs or a local server. That makes an old-laptop comparison misleading. The computer is not merely displaying replies. It is holding a long-lived identity, message history and whatever access the owner grants to files or services.

The always-on part is the same trade-off described in the Mac Mini home-server guide: no lid closes and no daily commute interrupts it, but updates, backups, power settings and network boundaries become operator jobs. Start with one use case and one channel. An assistant that answers a private chat and reads one deliberate workspace is easier to reason about than one connected to every inbox, calendar and shell on day one.

Install and set up OpenClaw on macOS

The official installation page offers a hosted installer, npm, pnpm, Bun, Docker, Nix and source installs. For a Mini that already has a supported Node setup, the documented npm route makes the package and the daemon step explicit. The option that approves OpenClaw's lifecycle scripts is required by current npm releases; read the official page before copying it because package-manager policy and the latest version can change (docs.openclaw.ai/install, checked September 2026).

npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon
openclaw doctor
openclaw gateway status

On macOS, the daemon installed by onboarding runs as a per-user LaunchAgent. Onboarding is where the model provider, workspace and first channel are chosen. Keep that first pass narrow: use a dedicated macOS account if the agent does not need the owner's desktop session, connect one channel, and verify from a second device that the expected account is responding before adding automation. OpenClaw documents the version, doctor and Gateway-status checks shown above as the basic post-install verification (docs.openclaw.ai/install, checked September 2026).

Do not expose the Control UI merely to make remote setup convenient. Reach the Mini through a private network or a carefully authenticated tunnel, and keep the Gateway bound as documented for that arrangement. The installation guide supports a managed service; it does not make a public admin panel necessary. Also decide how updates will be applied before treating the agent as always available. A service that never receives maintenance is not made safer by living inside the house.

Know what lives under the state directory

OpenClaw separates its workspace from the rest of its state. The default workspace is ~/.openclaw/workspace. Configuration, credentials and runtime state live elsewhere under ~/.openclaw, including openclaw.json, channel/provider credentials, per-agent SQLite data, session material and managed skills. Profiles can use another state root, and documented environment variables can override the defaults (docs.openclaw.ai/concepts/agent-workspace, checked September 2026). Paths are worth understanding before the first backup, not after a disk failure.

Treat the workspace and the private state differently. A workspace may be a Git repository for useful, reviewable files; credentials and raw session data should not be committed with it. OpenClaw's own workspace documentation warns that API keys, OAuth tokens, passwords, private credentials and raw chat dumps do not belong in the workspace repository. Back up the state only to encrypted storage with access at least as strict as the Mini itself, because restoring it may also restore the ability to act through connected services.

There is no vendor figure for how quickly sessions or workspaces grow. Text conversations are usually minor compared with models, but attachments, generated files, cloned repositories and verbose logs can change that. Check the state and workspace separately, set a retention policy that matches what must actually be remembered, and test a restore. A directory copied every night is not yet a backup plan if nobody has proved the restored Gateway can start.

Local models through Ollama are the real storage decision

OpenClaw can use hosted providers, but its local-model guide also documents a local route and detects Ollama when it is available (docs.openclaw.ai/gateway/local-models, checked September 2026). This is where a roomy Mini becomes materially different from a small boot disk. OpenClaw's application files and ordinary text state are not the large category; model weights, alternate quantizations and partially downloaded replacements are.

Do not choose capacity from a model name alone. Parameter count, quantization and context-related files change the download, and keeping two versions during an upgrade temporarily needs both. The local AI models guide contains the sourced model-size table and explains those trade-offs, so this guide does not duplicate numbers that would age in two places. Use that table to price the actual models under consideration, then add room for OpenClaw's workspace, its backup and normal macOS free space.

Local is not automatically private in every sense. It can keep prompts away from a hosted model provider, but connected chat services still process messages, and a skill or tool can still read data the account can reach. Decide which requests may use a cloud model and which must stay local. Then make the routing visible rather than assuming every conversation follows the same path.

A storage budget for 256GB, 512GB and 2TB

The table is a planning example, not a measurement and not a vendor requirement. Every row is by our estimate. It deliberately reserves a 40GB local-model allowance instead of pretending one model size represents the whole category; replace that row with the models selected from the sourced table in the local-AI guide. Capacities use their advertised decimal totals so the comparison stays consistent with the other guides. Formatting, macOS recovery space and filesystem overhead mean the free space shown by macOS will be lower.

At 256GB this single, modest example fits, but adding larger models or using the same Mini for photos, Xcode or virtual machines consumes the 136GB margin quickly. At 512GB there is room for a few deliberate changes without constant cleanup. A 2TB module makes sense when the assistant shares the machine with several models, coding-agent worktrees, media or long-lived backups; it is capacity for the combined workload, not because the OpenClaw package itself needs terabytes.

The security record is a dated input, not a verdict

An always-on agent deserves a dated threat model. CVE-2026-25253, scored 8.8 High, affected OpenClaw before version 2026.1.29: an unvalidated gatewayUrl from a query string could make the Control UI open a WebSocket connection and send its token without prompting (nvd.nist.gov/vuln/detail/CVE-2026-25253, checked September 2026). The practical lessons outlast that fixed version: update promptly, do not follow arbitrary links while an admin UI is authenticated, and do not put the control plane on the public internet.

Exposure was not theoretical. A Censys host search counted 21,639 internet-exposed instances by 31 January 2026 (search.censys.io, checked 31 January 2026). That is a dated snapshot, not a claim about today's total, and discovery does not prove every host was compromised. It does show how often a local control service became publicly reachable. A private overlay network, host firewall and narrow bind address are more useful controls than relying on an obscure port.

Use least privilege beyond the network boundary. A separate account limits accidental access to personal files; a dedicated workspace limits what normal file tools see; narrowly scoped provider and channel tokens limit what one stolen secret unlocks. For unattended shell or browser actions, the agent-sandbox guide explains why a VM or container can add a second boundary. Sandboxing does not make hostile instructions trustworthy, but it can reduce the files and credentials within reach.

Skills are software, and Moltbook was a separate incident

OpenClaw skills are executable capability, not decorative plug-ins. Unit 42 documented malicious ClawHub skills published between February and May 2026 that used convincing instructions to deliver macOS infostealers, including Atomic Stealer. Its report also attributes the ClawHavoc discovery of 341 malicious skills to Koi Security rather than presenting that number as Unit 42's own scan (unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk, checked September 2026). Read a skill's files and install instructions, prefer a source you can identify, pin what can be pinned, and remove anything no longer used.

Moltbook belongs in a different row of the incident history. Wiz reported that Moltbook exposed its Supabase database and API keys; Moltbook was a separate social network for agents, not the OpenClaw application itself (wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys, checked September 2026). An OpenClaw user connecting to a third-party service can still be affected by that service's failure, but calling the Moltbook database exposure an OpenClaw breach would confuse dependency risk with a vulnerability in the local agent.

The neutral conclusion is neither that OpenClaw is uniquely unsafe nor that self-hosting removes trust. It moves trust into a stack the owner operates: the OpenClaw release, selected skills, model providers, chat channels, the Mac account and the network around it. Keep that list short enough to audit.

Operate it like a small service

Before adding more channels, write down who may message the agent, which files and tools it may use, where the dashboard is reachable, how updates are applied, and what gets backed up. Review logs for actions rather than only for crashes. Keep enough free disk for an update and a model replacement to coexist, and alert on a nearly full volume; an assistant that silently stops writing state is not reliable automation.

Also plan the failure mode. If a model provider is unavailable, should the agent wait, switch provider or refuse the task? If the Mini restarts, does the LaunchAgent return without opening more network access? If a channel token is stolen, can it be revoked without rebuilding the machine? A short recovery note stored outside the Mini is more valuable than a complicated setup only its original operator understands.

Start small, measure the real state growth for a month, and revise the storage row with those observations. The choice between 256GB, 512GB and 2TB should follow the models and other workloads that remain on the Mini, not the novelty of the assistant.