From OpenClaw to Hilo: moving a team's agents off a personal harness

This client of Hilo started exploring agents in February 2026, on OpenClaw. It was not called OpenClaw then. One agent, one person, and it worked — that is the honest starting point, and it is why this is not a hit piece. A harness that takes a non-engineer from nothing to a working agent in an afternoon has done something most tools never manage.

Seven weeks later they moved off it. Three reasons, in the order they actually bit.

The subscription stopped covering it

The hardest constraint on running a fleet is not capability, it is what model access costs. When the model vendor’s subscription no longer covered agents driven through that harness, the economics changed underneath them — not gradually, but as a step. A setup that had been affordable became a metered bill for exactly the same work.

The general lesson is worth more than the incident: if your harness sits between you and the model vendor, that vendor’s terms are a dependency you do not control. It is not a bug in the software. It is a structural exposure that any harness in that position carries.

The harness was running the loop, and they were paying for it

OpenClaw drove the agent loop itself. Every turn, it assembled context and made the call. That sounds like an implementation detail until you watch the token count: an external loop re-sends what a native harness would have kept warm, and you pay the difference on every turn of every agent, all day.

With one agent it is an annoyance. Their sixth is where it stopped being one. Hilo treats “never own the loop” as product law for this reason — it does not run the loop either, it drives the vendor’s own harness, which is why a fleet costs what it costs.

The ecosystem got dangerous faster than it got safe

They left before the worst of it, but the public record since is worth stating plainly, because it is the risk anyone still on a community harness is carrying:

• CVE-2026-25253, rated 8.8 — one-click remote code execution through cross-site WebSocket hijacking, reaching instances configured to listen only on localhost.
• A single stolen gateway token was enough for remote connection, configuration changes and arbitrary command execution.
• An audit of the public skill registry found 36.82% of published skills carried at least one security issue, and 76 confirmed malicious payloads. The bar to publish was a GitHub account more than a week old.
• Censys found 21,639 instances exposed on the public internet, up from roughly a thousand days earlier.

None of that is an argument against open source. It is an argument for being precise about what you are trusting: an agent runs commands on your machine with your credentials, so the harness is not a convenience layer — it is the security boundary.

What they actually needed

By April the problem had changed shape. It was no longer “can one person run an agent” but “can a team share several” — and that is a different product. A personal-scale harness has no concept of who else should see this, no shared history, and no place for the work to live once it is done. They were pasting agent output into a chat app so colleagues could read it.

That gap is what Hilo was built to close. The fleet came across intact, memory included — 76 days of accumulated context, starting with the very first agent, which still exists.

If you are on OpenClaw now

You are not doing anything foolish; it is where a great many people started. The questions worth asking are whether your harness sits between you and your model vendor, what your token bill looks like per agent per day, and whether the thing running commands on your machine is reachable from a network. And if more than one person now needs the same agents, you have outgrown it — which is a good problem, and exactly the one this client had.