---
title: "OpenClaw alternatives for teams in Slack: what breaks when you share one agent"
description: "What breaks when a team shares one OpenClaw agent, from its docs and users, and four ways out: harden it, Hermes, a Chickpea teammate, or hosted Viktor."
canonical: https://chickpea.co/blog/openclaw-alternative-for-teams
author: Pejman Pour-Moezzi (https://x.com/pejmanjohn)
published: 2026-09-08
verified: 2026-09-08
---

# OpenClaw alternatives for teams in Slack: what breaks when you share one agent

> What breaks when a team shares one OpenClaw agent, from its docs and users, and four ways out: harden it, Hermes, a Chickpea teammate, or hosted Viktor.

By Pejman Pour-Moezzi, creator of Chickpea. Published September 8, 2026; facts checked September 8, 2026. The HTML page is at https://chickpea.co/blog/openclaw-alternative-for-teams; the site index for agents is at https://chickpea.co/llms.txt.

OpenClaw's own security page says it. A gateway is one trust boundary, and "everyone who can message a tool-enabled agent shares that agent's delegated tool authority." For one person on one laptop, that is fine. The moment a second person can message the bot, they hold its keys.

That sentence is why you are looking for an OpenClaw alternative. You run OpenClaw and you like it. Then someone asked for it in #support, or a security review came back. This page covers what changes when a team shares an agent, four ways out, one of which keeps OpenClaw, and how to set up a shared teammate in an afternoon. We build [Chickpea](/compare/openclaw), so read the last third with that in mind. The first two thirds come from OpenClaw's docs and its users.

## Key takeaways

- OpenClaw's docs say a gateway is one trust boundary and anyone who can message an agent shares its tool authority. The team problem, in one sentence.
- A roster in Slack means one Slack app and one gateway config per named bot, plus loop guards you write yourself. People doing exactly this filed two of the multi-agent bugs in the tracker.
- There are four ways out. Keep OpenClaw per person and harden it with NemoClaw or Clawbake. Run Hermes Agent per person. Run a governed shared teammate on your own account with Chickpea. Or pay for a hosted employee from Viktor. We score each against the same six criteria below.
- Most teams should keep OpenClaw for individuals. The shared channel work is the part that needs a different design.
- A shared teammate on your own account is a deploy button and a Slack install, then messages. The steps are at the end.

## What OpenClaw is good at, and why people do not want to leave

OpenClaw is the most popular open source agent there is. MIT licensed, run by a non-profit foundation, 389,000 GitHub stars as of this writing. It connects one agent to Slack, Discord, WhatsApp, Telegram, iMessage, Teams, and twenty-odd more channels, and it has hands on the machine it runs on: files, shell, browser. If you want an agent that answers on WhatsApp at night and in Slack by day, from a laptop, with a local model, OpenClaw does that and almost nothing else does.

People run it for companies, too. In an April thread asking who uses OpenClaw, one engineer wrote, "We have multiple isolated OpenClaw instances serving as employee within Slack." Another, running a similar project for his company, added, "except for the fact that my laptop has to be on."

Both of those are the team story. Isolated instances is what it takes to share OpenClaw safely, and a laptop that has to stay on is the cost of a personal agent doing a team's job.

## What changes when a team shares an agent

### One trust boundary per gateway

The security page is specific about what OpenClaw does not do. "OpenClaw is not a hostile multi-tenant security boundary for mutually adversarial users sharing one agent or gateway." The recommended fix for people you do not fully trust is to "split trust boundaries by OS user/host." One gateway per trust level.

Delegated tool authority is the phrase to sit with. If the agent has your Zendesk connected, whoever can message it can use your Zendesk. Pairing codes and allowlists decide who gets to message it, and nothing decides what a message can do once it is in. OpenClaw's exec approvals exist, and the docs describe them as "guardrails for operator intent, not hostile multi-tenant isolation." Your teammates are not adversaries. But a teammate who pastes a customer email into the channel has handed the agent whatever instructions were in that email, and the agent acts with the same authority either way.

### The credentials live on the host

Everything OpenClaw needs is under `~/.openclaw/` on the machine that runs the gateway: config, credentials, session transcripts, auth tokens, the SQLite database with OAuth tokens in it. The docs say to assume anything in that directory may contain secrets, set it to 700 and the files to 600, use full-disk encryption, and give each person on a shared host their own OS user. Isolation, in that system, is a file permission.

DigitalOcean put the team version of this in one sentence in February: "An OpenClaw agent on a developer's laptop with VPN access to production means every vulnerability above is now a business problem."

### The 2026 record, once, with dates

Censys watched public exposure grow from about 1,000 instances to more than 21,000 in the last week of January. Bitsight's count passed 30,000 by February 8, and SecurityScorecard's STRIKE team reported the same order of magnitude. CVE-2026-25253, published February 1 with a CVSS of 8.8, let a crafted link open a WebSocket from the control UI and send the gateway token. The foundation fixed it in 2026.1.29. Koi Security named the ClawHub supply-chain campaign ClawHavoc on February 1, and by the end of the month the count of malicious skills stood at 1,184, about a fifth of the registry. Endor Labs disclosed six more issues on February 19, three of them server-side request forgery.

For a team the count matters less than the boundary. When the boundary is a laptop, each of these is a company problem.

### A roster in Slack is N apps and your own loop guards

Now the part that eats your afternoon. OpenClaw's Slack channel takes one bot token and one app token per workspace config, so a second named bot is a second Slack app and a second gateway configuration. A gist from February that walks through four agents as Slack teammates needs four Slack apps and about twenty configuration steps, and its pitfalls section is where the knowledge is. Use channel IDs, not names, or routing breaks. Set `requireMention` to true and `streaming` to false, or agents answer each other.

The tracker shows what happens when you skip that. Issue 58789, filed April 1. Bot A mentions bot B, B replies to A, "repeat until rate-limited." In the reporter's case that was "42+ iterations before Anthropic rate limits stopped it," about 80 duplicate messages, and every other agent on the same API key rate-limited with them. A later pull request fixed it. Issue 15836, filed in February, is the mirror image. Messages one agent posts to a Slack channel never reach the other agents bound to that channel, because the filter that stops an agent echoing itself also drops its peers. The maintainers closed it as not planned. The Slack docs now carry a warning that enabling bot-message replies risks loops.

The multi-agent page does support several isolated agents in one gateway, with bindings that route each Slack account to its agent and per-agent tool allow and deny lists, so the page that calls OpenClaw single-user is wrong. What is true is narrower. Each named bot is its own Slack app, the loop guards are yours to write, and stricter separation between agents means separate gateways, which means separate processes to keep alive. On a laptop that has to be on.

## What to look for in a team alternative

Each requirement below answers a line from OpenClaw's docs or its users.

| What a shared teammate needs | Why | What it answers |
|---|---|---|
| Credential isolation per teammate | The support bot's Zendesk should be unreachable from the sales bot, and from a prompt in the sales channel | "shares that agent's delegated tool authority" |
| A gate on sends, deletes, publishes, and bulk edits that the model cannot argue with | Those pause for a person, and pasted text cannot lift the pause | exec approvals as "guardrails for operator intent" |
| Roles for who may create and change teammates | Anyone can ask for a bot. Not everyone should be able to widen what it can reach | "treat Gateway and node as one operator trust domain" |
| Nothing running on someone's laptop | Uptime, and no VPN-to-production route through a personal machine | "my laptop has to be on" |
| A Slack-native roster | Handles people can mention, threads, one install for the whole workspace | one Slack app per bot |
| You own the runtime and the keys | Open source, your account, list price to the provider | OpenClaw already has this. Do not give it up |

## The options, scored

| Option | Keeps OpenClaw | Credential isolation | Action gate | Roles | No laptop | Slack roster | You own it |
|---|---|---|---|---|---|---|---|
| OpenClaw per person, hardened with NemoClaw or Clawbake | yes | per instance | operator-level | no | if on a server | one app per bot | yes |
| Hermes Agent per person | no | per instance | command approval | no | if on a server | one gateway per bot | yes |
| Chickpea for the shared teammates | beside it | per teammate | on sends, deletes, publishes, bulk edits; checked outside the model | Owner, Admin, Member | Workers, no daemon | handles, one install | yes, Apache 2.0, your account |
| Viktor, hosted | no | vendor-managed | per-run approvals | admin dashboard | vendor cloud | one @Viktor per workspace | no |

### Keep OpenClaw per person and harden it

If the problem is isolation and you do not need a roster, the shortest route is the one OpenClaw's docs describe, plus two projects that package it. NVIDIA's NemoClaw, announced at GTC in March under Apache 2.0, runs OpenClaw or Hermes inside an OpenShell sandbox. The sandbox is built on Landlock, seccomp, and network namespaces. The policy engine lives in a separate process the agent cannot signal or kill. The sandbox closes the broad-system-access hole. Its README says nothing about teams or Slack, and it adds no approvals or roles. Clawbake, also from March, gives each person on a team their own OpenClaw instance on Kubernetes, with network, credential, and workload isolation between them, managed from a dashboard or from Slack. Its authors built it because "when you try to move from one person tinkering to a whole team running their own instances, you hit real friction fast." Both keep the tool you like. Both give you N safer personal agents and no shared teammate in a channel.

### Hermes Agent per person

For one person who wants OpenClaw with a confirmation step, Hermes Agent is the pick. MIT, 243,000 stars, gateways for Telegram, Discord, Slack, WhatsApp, and Signal. Its README lists command approval, DM pairing, and container isolation, and the approval step means a shell command waits for you before it runs, which OpenClaw only does if you turn `ask` on. It is still one gateway per trust boundary, and a Slack roster is still one gateway per bot.

### Chickpea for the shared teammates

This is the design we built, so here is the mechanism, starting with the part I would not give up. Under the model's judgment sits a gate that refuses any non-read request the current Slack message did not name, and that gate never consults the model. A pasted customer email is data to it, not an instruction. A good enough prompt can argue with everything else on this page. That gate reads the request and the stored grants and nothing else.

Around it: each teammate has its own connected accounts, memory, skills, repositories, and channel grants, and nothing carries over between teammates unless you connect it. Credentials never enter model context. The model picks a connection by ID, and the Worker attaches the secret at the network edge inside an allowlist that holds only that connector's hosts. A redirect off that host cannot carry the secret with it. Sends, deletes, publishes, and bulk edits wait for a person unless the teammate's saved instructions say otherwise. Authority comes from stored channel grants, saved instructions, and live membership, re-read on every turn. Roles are Owner, Admin, and Member, and creating a teammate is one message in Slack. It runs on Cloudflare Workers in your account, so there is no process to keep alive, and it is Apache 2.0.

Where it is worse than OpenClaw. It is Slack only. It needs a Cloudflare account, on the Free plan, or a Node host with a public HTTPS origin. It has no shell on a machine. It works through connectors, MCP servers, HTTP APIs, and repositories, with an optional coding sandbox. If you want an agent that reads your laptop's files, that is OpenClaw's job, and it should stay OpenClaw's job.

### Viktor, hosted

If you want none of this to be your infrastructure, Viktor is the hosted option. One @Viktor per Slack workspace, installed from the App Directory. Credits start at $50 for 20,000, and a quick task costs 100 to 300 credits. It runs on Viktor's cloud with per-run approvals, and SOC 2 is the vendor's claim. No server and no key on your side; the vendor holds the credentials. We wrote up [where it beats Chickpea](/compare/viktor).

## Keeping OpenClaw and adding a shared deployment

For most teams the answer is both. The person who loves OpenClaw keeps it on their laptop for the things a personal agent is for. The shared work, support triage in #support and the Monday pipeline summary, runs on something with a boundary per teammate and no laptop in the path. The company in the April thread built that boundary by hand with isolated instances. Clawbake exists because doing it by hand is friction.

When should you stop at OpenClaw entirely? Three tests. The team is one or two people who trust each other. No credential the agent holds is one you would mind either person using directly. The machine it runs on is a server you would expose to production anyway. A lot of two-founder companies pass all three, and for them the rest of this page is premature.

## Setting up a shared teammate the governed way

These are Chickpea's steps from the deploy guide, with what you see at each one. For comparison, OpenClaw's docs describe an npm install, an onboarding command that installs a daemon, and a Slack app you create by hand with sixteen bot scopes and two tokens pasted into a config. We have not timed that ourselves.

1. Open the Deploy to Cloudflare button from the repository and sign in. Cloudflare clones the repository into your account and creates the Worker, its Durable Objects, the D1 database, and the Workers AI binding. The form asks for no secrets and no provider key.
2. Copy the private setup link from the end of the build log. It lasts 24 hours and is bound to this deployment.
3. On the setup page, choose Add to Slack. It installs Chickpea's reviewed Slack app through a private gateway, so you paste no configuration token, client secret, signing secret, or bot token.
4. Approve the install in Slack, then select Become the first Owner with Slack. There is no password. You are the Owner, and the next person who talks to a teammate becomes a Member on first contact.
5. Choose a provider. The default is Workers AI through the Worker's own binding, which needs no key. Paste an Anthropic, OpenAI, or OpenRouter key if you want those instead. The key goes in through the browser, never into a chat.
6. In Slack, go to the channel where the shared work happens and write something like "@Chickpea make a support teammate that answers billing questions and knows our refund policy." That message creates the teammate, gives it a handle, and grants it that channel and no other. It introduces itself in the thread under its own name, with a View link and Connect links for the services you named.
7. Click Connect Zendesk, or Gmail, or GitHub, from that reply. The link is locked to this one teammate and this one connector, expires in 24 hours, and finishes in the browser. A second teammate needs its own link even for the same account. That is the credential isolation from the table.
8. Ask the teammate to send a reply to a customer. It posts a preview and waits. Reply "approve" in the thread and it proceeds. The pause is the gate from the table, and it fired before any model decided anything about your reply.

If you keep OpenClaw beside it, nothing conflicts. They are two Slack apps with nothing in common but the workspace.

## FAQ

### Is OpenClaw safe?

As a personal agent on a machine you control, with pairing and allowlists on and high-risk tool groups denied, it is as safe as any agent with hands on your machine can be. By its own description it is not a security boundary between people who share one gateway. The fix for CVE-2026-25253 shipped in a release dated before the CVE was published; the exposure came from instances left open on the internet, which the docs tell you not to do.

### Can OpenClaw run multiple agents in Slack?

Yes. One gateway hosts several isolated agents, and bindings route each Slack account to its agent. Each named bot is its own Slack app with its own tokens, and you set `requireMention` and user allowlists yourself so bots do not answer each other.

### Is there a hosted OpenClaw?

Hostinger runs OpenClaw as a managed app with AI credits included, from $5.99 a month on a 24-month term and $11.99 after. Clawbake gives each teammate an isolated instance on your own Kubernetes. NemoClaw wraps it in a sandbox on your hardware. Chickpea is a different program built for shared Slack teammates, and it does not run OpenClaw.

### Does NemoClaw fix OpenClaw's security problems?

It fixes broad system access by running OpenClaw inside a deny-by-default sandbox with the policy engine out of the agent's reach. It adds no roster or roles and no action gate, and its README does not mention teams or Slack.

### Can I use OpenClaw and Chickpea together?

Yes. A personal OpenClaw agent and a Chickpea deployment can share a workspace. OpenClaw for the individual, Chickpea for the shared teammates.

### What does an OpenClaw alternative cost?

OpenClaw and Hermes are free software, so a small always-on VPS at about $12 a month plus your provider's bill. Chickpea is free software on Cloudflare's Free plan, plus your provider's bill at list price, with no markup. Viktor starts at $50 a month for 20,000 credits. Our [pricing page](/pricing) shows the model behind those numbers.

## Sources

OpenClaw: [README](https://github.com/openclaw/openclaw) (2026-09-08), [security](https://docs.openclaw.ai/security) (2026-09-08), [Slack channel](https://openclaw.im/docs/channels/slack) (2026-09-08), [multi-agent routing](https://docs.openclaw.ai/concepts/multi-agent) (2026-09-08), [issue 58789](https://github.com/openclaw/openclaw/issues/58789), [issue 15836](https://github.com/openclaw/openclaw/issues/15836), [running multiple agents as Slack teammates](https://gist.github.com/rafaelquintanilha/9ca5ae6173cd0682026754cfefe26d3f) (2026-02-24).
Record: [CVE-2026-25253](https://cveawg.mitre.org/api/cve/CVE-2026-25253), [DigitalOcean, seven OpenClaw security challenges](https://www.digitalocean.com/resources/articles/openclaw-security-challenges) (2026-02-27), [Hive Security timeline](https://hivesecurity.gitlab.io/blog/openclaw-ai-agent-security-crisis-2026/), [Infosecurity on Endor Labs' six findings](https://www.infosecurity-magazine.com/news/researchers-six-new-openclaw/) (2026-02-19).
Users: [mholubowski](https://news.ycombinator.com/item?id=47784545) and [atonse](https://news.ycombinator.com/item?id=47784423) on Hacker News (2026-04-15), [Clawbake](https://blog.neurometric.ai/p/we-built-clawbake-open-source-multi) (2026-03-10), [Hostinger's managed OpenClaw](https://www.hostinger.com/vps/openclaw-hosting) and [OpenClaw's Hostinger install page](https://docs.openclaw.ai/install/hostinger) (2026-09-08).
Alternatives: [Hermes Agent](https://github.com/NousResearch/hermes-agent) (2026-09-08), [NemoClaw](https://github.com/NVIDIA/NemoClaw) and [NVIDIA's announcement](https://nvidianews.nvidia.com/news/nvidia-announces-nemoclaw) (2026-03-16), [Chickpea vs Viktor](/compare/viktor) (2026-09-04), [Stilla AI alternatives after the Meta acquisition](/blog/stilla-ai-alternatives) (2026-09-09).
Chickpea: [security model](https://docs.chickpea.co/security/security-model), [authority and confirmation](https://docs.chickpea.co/security/authority-and-confirmation), [sign-in and roles](https://docs.chickpea.co/admin/sign-in-and-roles), [requirements and costs](https://docs.chickpea.co/start/requirements-and-costs), [get started on Cloudflare](https://docs.chickpea.co/start/get-started-cloudflare), [manage from Slack](https://docs.chickpea.co/slack/manage-from-slack) (verified 2026-09-03 to 2026-09-05), [Chickpea vs OpenClaw](/compare/openclaw) (2026-09-04).

Facts checked September 8, 2026. Vendor pricing and limits in this category change monthly. We re-check the register behind this page every 90 days.