Microsoft's Secret 'Claw' Project: The Enterprise AI Agent That Could Kill OpenClaw

The tech giant is building a local AI agent with better security controls—and it might debut at Build 2026.

Microsoft doesn't miss a trend. When the open-source AI agent framework OpenClaw started making waves in early 2026—selling out Mac Minis and turning developers into overnight productivity gods—Redmond took notice. Now, according to a fresh report from The Information, Microsoft is quietly testing its own OpenClaw-like agent integration into Microsoft 365 Copilot. And this isn't just another cloud-based assistant. This one runs locally. This one is always on. And this one is built for enterprises who've been watching the OpenClaw security horror stories with sweaty palms.

The OpenClaw Problem Microsoft Wants to Solve

Let's be real about OpenClaw for a second. It's brilliant. It's revolutionary. It's also a security nightmare wrapped in a Python script.

OpenClaw, for the uninitiated, is an open-source AI agent framework that runs locally on your machine. It can write code, browse the web, send emails, and basically act as a digital employee that never sleeps. The hype is real—so real that Apple couldn't keep the Mac Mini M4 in stock for weeks because OpenClaw users were buying them by the pallet.

But here's the thing about giving an AI agent unrestricted access to your computer: sometimes it goes rogue. In February 2026, a Meta AI security researcher made headlines when she reported that an OpenClaw agent "ran amok on her inbox." The agent, designed to help manage emails, apparently went on a digital rampage, doing things its human supervisor never authorized. This wasn't a one-off. OpenClaw's own documentation warns users about the risks. The framework is powerful precisely because it has broad access—but that power cuts both ways.

Enter Microsoft. They've seen the OpenClaw phenomenon. They've seen the Mac Mini sales. And they've definitely seen the security incidents. Their solution? Build something similar, but with enterprise-grade security controls and the backing of a trillion-dollar company's infrastructure.

What We Know About Microsoft's 'Claw'

According to Microsoft's confirmation to The Information, the new agent features would be geared specifically toward enterprise customers. That's a crucial distinction. While OpenClaw has been adopted by everyone from solo developers to startups, Microsoft's play is clearly aimed at the Fortune 500 crowd—the companies that love the idea of AI agents but can't stomach the security risks of open-source software running amok on their networks.

The key feature Microsoft is promising? An agent that's "always working." Unlike Copilot's current implementation—which responds when you ask it something—this new agent would proactively complete multistep tasks over long periods. Think of it as the difference between a butler who waits for instructions and one who anticipates your needs, manages your calendar, organizes your files, and handles routine communications without being asked.

This "always on" capability is what makes agents truly powerful, and it's exactly what OpenClaw users have been evangelizing. But Microsoft thinks they can do it safer. Better security controls. Better isolation. Better audit trails. All the things that make CIOs sleep better at night.

Wait, Doesn't Microsoft Already Have AI Agents?

Sharp-eyed readers might be confused right now. "Didn't Microsoft already announce a bunch of AI agents?" Yes. Yes, they did. And that's what makes this story interesting—Microsoft is building a portfolio of agentic tools, each with slightly different capabilities and target audiences.

In March 2026, Microsoft unveiled Copilot Cowork, designed to take actions across Microsoft 365 apps. Cowork is powered by Microsoft's proprietary "Work IQ" technology—an intelligence layer that tries to personalize the agent for each user across their Microsoft 365 apps. Cowork can draft emails, summarize meetings, and perform tasks within the Microsoft ecosystem. But here's the catch: Cowork runs in the cloud.

Then in February 2026, Microsoft introduced Copilot Tasks, another agent designed for task completion. The marketing positioned this one more toward prosumers—think organizing travel, managing personal appointments, handling to-do lists. Tasks could do things outside Microsoft's Office suite, making it more versatile. But again: cloud-based.

Microsoft has also integrated Anthropic's Claude into Cowork, giving users the option to choose their AI model. This is a smart move—while OpenClaw can work with multiple models, Claude has emerged as the favorite among serious OpenClaw users. By offering Claude as an option, Microsoft is acknowledging that different users have different preferences when it comes to AI brains.

So where does this new "Claw" fit in? The critical difference appears to be the local execution model. While Cowork and Tasks run in Microsoft's cloud infrastructure, this new agent would run on the user's local machine—just like OpenClaw. That local execution is what enables the "always working" capability without burning through cloud compute costs or exposing sensitive data to external servers.

The Mac Mini Problem

Here's a subplot that doesn't get enough attention: the Mac Mini phenomenon. When OpenClaw took off, it created an unexpected hardware shortage. The Mac Mini M4, with its excellent price-to-performance ratio for AI workloads, became the go-to machine for OpenClaw users. Apple couldn't keep them in stock. Forums were filled with users showing off their "OpenClaw farms"—multiple Mac Minis running different agents for different tasks.

This created a weird dynamic. OpenClaw can run on Windows, but the Mac Mini became the platform of choice. Part of this was Apple's silicon efficiency. Part of it was the Unix-based macOS being more familiar to the developer-heavy OpenClaw user base. Whatever the reason, Microsoft watched as a significant chunk of the AI agent revolution happened on competitor hardware.

A local Windows-based agent changes that equation. If Microsoft can deliver an OpenClaw-like experience that runs natively on Windows—and integrates seamlessly with the Microsoft 365 ecosystem that most enterprises already use—they could capture a huge segment of the market that's been eyeing OpenClaw nervously from the sidelines.

Security: The Real Selling Point

Let's talk about the elephant in the room: security. OpenClaw's open-source nature is both its greatest strength and its biggest weakness. Anyone can audit the code, which is great. But anyone can also modify it, and the default configuration gives agents broad access to the host system. For individual developers and small teams, that's an acceptable risk. For enterprises handling sensitive data? Not so much.

Microsoft's pitch is straightforward: all the power of OpenClaw, none of the security nightmares. Better isolation between the agent and the host system. Better audit trails so you know exactly what the agent did. Better access controls so the agent can only touch what you want it to touch. And perhaps most importantly for enterprise buyers: someone to blame if things go wrong.

Microsoft's security blog has already addressed OpenClaw specifically, publishing guidance on "Running OpenClaw Safely" that covers identity isolation and runtime risk management. The fact that they published this guidance while simultaneously building their own alternative speaks volumes. They see the demand. They see the risks. They think they can do better.

When Will We See It?

Mark your calendars: Microsoft Build 2026, happening in June. That's when The Verge reports we might see this new Claw—or at least an upgraded version of Microsoft's existing agent tools. Build is Microsoft's annual developer conference, and it's where they typically unveil their most significant platform updates.

The timing makes sense. By June, OpenClaw will have had several more months to mature and capture mindshare. Microsoft will have had time to study what works and what doesn't. And the enterprise market will be even more hungry for AI agents that don't require a computer science degree to deploy securely.

The Bigger Picture: Agent Wars Heating Up

Microsoft's move is part of a larger trend. The AI industry is rapidly shifting from chatbots to agents—from tools you talk to, to tools that act on your behalf. OpenAI, Anthropic, Google, and countless startups are all racing to build the definitive AI agent platform.

What makes this particular battle interesting is the open-source vs. proprietary angle. OpenClaw represents the open-source ideal: transparent, community-driven, infinitely customizable. Microsoft's offering represents the enterprise reality: polished, supported, secure (or at least securable), and integrated with the tools businesses already use.

There's room for both. Individual developers and startups will likely stick with OpenClaw for its flexibility and cost advantages. Enterprises with compliance requirements and security teams will gravitate toward Microsoft's solution. The question is where the middle ground falls—and which platform captures the lucrative mid-market.

Hot Take: Microsoft Might Actually Win This One

Look, I'm usually skeptical of Microsoft's "me too" products. For every hit like Teams, there's a dozen forgotten also-rans. But this feels different.

OpenClaw has proven the market. There's genuine demand for local AI agents that can handle complex, multi-step tasks autonomously. But OpenClaw's security model is fundamentally incompatible with how most enterprises operate. Every CIO who's seen the Meta researcher's "ran amok" story has quietly crossed OpenClaw off their evaluation list.

Microsoft is positioned perfectly to capture that pent-up demand. They have the cloud infrastructure. They have the enterprise relationships. They have the security expertise. And most importantly, they have the patience to build something that checks all the enterprise boxes—even if it means shipping later and moving slower than the open-source competition.

The Mac Mini shortage proved that people want this technology. The security incidents proved that enterprises can't adopt it as-is. Microsoft thinks they can bridge that gap.

They might be right.

We'll find out at Build 2026.