TL;DR: OpenClaw has the best multi-agent orchestration but 512 security vulnerabilities. ZeroClaw has paranoid defaults and 23 messaging channels but no team coordination. IronClaw has the only correct security architecture but lacks multi-agent support. No single project gives you everything today. Pick your poison based on whether you value working teams or sleeping at night.

IronClaw vs ZeroClaw vs OpenClaw: Head-to-Head Comparison

At a Glance

	OpenClaw	ZeroClaw	IronClaw
Language	TypeScript/Node.js	Rust	Rust
Codebase	430,000+ LOC	~150,000 LOC	~42,000 LOC
Binary	~28MB + Node	8.8MB standalone	3.4MB standalone
Startup	>5s	<10ms	<10ms
RAM (idle)	~394MB	~7MB	~7.8MB
RAM (active)	~1.5GB	~8MB	~20MB
Stars	216,598	16,518	2,798
Age	~3 months	9 days	19 days
License	MIT	MIT + Apache 2.0	MIT + Apache 2.0
Who	Peter Steinberger (now OpenAI)	Harvard/MIT/Sundai.Club	Illia Polosukhin (Transformer co-author, NEAR)
Funding	OpenAI foundation	None apparent	NEAR Foundation ($540M+)

Security Comparison

Credential Protection

Attack	OpenClaw	ZeroClaw	IronClaw
Credential theft	Trivial (plaintext on disk)	Hard (ChaCha20 encrypted)	Architecturally impossible (host-boundary injection)
Tool access to secrets	Full (env vars, config)	In-process (encrypted at rest)	Never (WASM sandbox boundary)
Encryption algorithm	None	ChaCha20-Poly1305	AES-256-GCM

Execution Safety

Attack	OpenClaw	ZeroClaw	IronClaw
Exec bypass	Trivial (substring matching)	Hard (allowlist + workspace-only)	Hard (WASM capability model)
Prompt injection -> code exec	Easy (in-process tools)	Moderate (supervised mode blocks)	Hard (WASM sandbox + leak scan)
Malicious skills	Proven attack vector (ClawHavoc)	SkillForge (new, unproven)	WASM sandbox limits blast radius

Network Security

Attack	OpenClaw	ZeroClaw	IronClaw
SSRF	No protection	Gateway localhost-only	Blocks private IPs, cloud metadata, no redirects
Secret in logs	Possible (incomplete redaction)	Moderate (encrypted at rest)	Leak scanner on all I/O paths
Session hijacking	Easy (shared sessions)	N/A (single-user)	N/A (single-user)

Architecture Comparison

OpenClaw:
  LLM <-> Tools (in-process, shared memory, plaintext creds)
  Result: 512 vulnerabilities, 6 CVEs

ZeroClaw:
  LLM <-> Tools (in-process but constrained)
       +-- 3 autonomy levels
       +-- 14 blocked directories
       +-- ChaCha20 encrypted creds
       +-- Optional Docker sandbox
  Result: Paranoid defaults, tools still share process

IronClaw:
  LLM <-> Host Runtime
       +-- Tools in WASM sandbox (wasmtime)
       |   +-- Capability-based (declared in capabilities.json)
       |   +-- Credentials injected at host boundary
       |   +-- Leak detection on all I/O
       +-- Heavy jobs in Docker (per-job tokens)
  Result: Architectural isolation, not just configuration

Feature Comparison

Multi-Agent & Orchestration

Capability	OpenClaw	ZeroClaw	IronClaw
Subagent spawning	Yes (run + session modes)	No	No
Team orchestration	Yes (spawn, steer, kill, cascade)	No	No
Agent-to-agent messaging	Yes (announce flow with backoff)	No	No
Task queuing / delegation	Partial (via plugins)	Cron only	Cron only
Parallel jobs	Yes	No	Yes (up to 5)
Plan approval workflow	No (needs plugin)	Per-command (supervised)	Per-command (approval overlay)
Agent delegation/handoff	Yes	No	No

Channels

Channel	OpenClaw	ZeroClaw	IronClaw
Telegram	Yes	Yes	Yes (WASM)
Discord	Yes	Yes	Source exists
Slack	Yes	Yes (buggy)	Yes (WASM)
WhatsApp	Yes	Yes (dual mode)	Source exists
Signal	Yes	Yes (basic)	No
Matrix	Yes	Yes (E2EE)	No
iMessage	Yes	Yes (macOS)	No
Email	No	Yes	No
Lark/Feishu	No	Yes	No
DingTalk	No	Yes	No
QQ	No	Yes	No
IRC	No	Yes	No
Nostr	No	Yes	No
Web UI	Yes (dashboard)	No	Yes (chat/memory/logs)
CLI	Yes	Yes	Yes
Total	~15	23	~5

LLM Providers

Provider	OpenClaw	ZeroClaw	IronClaw
Anthropic	Yes	Yes	Yes
OpenAI	Yes	Yes	Yes
Ollama	Yes	Yes (buggy)	Yes
Google Gemini	Yes	Yes	No
AWS Bedrock	No	Yes	No
OpenRouter	No	Yes	No
Groq	No	Yes	No
NEAR AI	No	No	Yes (default)
Tinfoil (zero-knowledge)	No	No	Yes
Total	~8	30+	~8

Memory

Feature	OpenClaw	ZeroClaw	IronClaw
Backend	JSONL/JSON5 on disk	SQLite/Postgres/Markdown/Lucid	PostgreSQL+pgvector/libSQL
Vector search	No	Yes (embeddings+cosine)	Yes (pgvector, RRF)
Full-text search	No	Yes (FTS5)	Yes (tsvector)
Hybrid search	No	Yes (weighted)	Yes (Reciprocal Rank Fusion)
Encryption at rest	No	Secrets only	Secrets only
Memory hygiene	No	Yes (dedup, PII scrub)	Yes (retention, cleanup)
Response cache	No	Yes (TTL)	No
Identity files	No	Yes	Yes

Strengths & Weaknesses Summary

OpenClaw

Strengths: Multi-agent orchestration, 15 channels, most mature, largest community, always-on gateway, proactive agents Weaknesses: 24 security issues, 6 CVEs, 512 audit findings, plaintext creds, exec bypass, 430K LOC attack surface, creator left

ZeroClaw

Strengths: 23 channels, 30+ providers, paranoid defaults, encrypted creds, edge hardware ($10), trait-driven architecture, OpenClaw migration tool, fastest community growth (16.5K stars in 9 days) Weaknesses: No multi-agent, 261 .unwrap() crashes, 9 days old, no web dashboard, no funding, impersonation scams

IronClaw

Strengths: Best security model (WASM + host-boundary injection + leak detection), smallest binary (3.4MB), funded ($540M+ NEAR), credible team (Transformer co-author), MCP first-class, Tinfoil zero-knowledge inference Weaknesses: No multi-agent, fewest channels (5), fewest providers (~8), 19 days old, bus factor of 1-2, no encryption at rest for data

For Interactive Agent Teams (Research -> Scrape -> Deploy)

Requirement	OpenClaw	ZeroClaw	IronClaw
Chat with it	Yes	Yes	Yes
Watch agents work	Yes	CLI only	Web gateway
Agents pitch projects	Yes (proactive)	Cron only	Heartbeat only
Team orchestration	Yes	No	No
Self-improvement	Build it	Build it	Build it
Security	Terrible	Good	Best

No single project gives you everything today.

Recommended Path

Now: Hardened OpenClaw (SaferClaw + container isolation + trust-tiered agents) for the orchestration UX
Watch: IronClaw's FEATURE_PARITY.md for multi-agent support
When ready: Migrate to IronClaw (the security architecture is the correct foundation; multi-agent is ~2,200 lines of Rust on top of existing primitives)