Microsoft Built Autopilot on OpenClaw, Once Deemed Unsafe

The Agent Microsoft Said Not to Run on Your Work PC Back in February

Reader, on September 25th, Microsoft rebuilt Copilot from the ground up. The app now bundles three features—Home, Code, and Autopilot—and Autopilot is the one that keeps working even after you step away: a personal agent. Give it a name, a role, and a goal, and it watches channels in the cloud, follows up on threads, and runs repetitive tasks on its own.

On the day of the announcement, Omar Shahine, the VP leading the team, added one line on X: they’re building Autopilot on top of OpenClaw¹, working with OpenClaw’s creator Peter Steinberger and the OpenClaw Foundation to polish it into an enterprise-grade runtime. Steinberger has been at OpenAI since February, and the OpenClaw project is now run by the foundation.

What’s odd is the timing. On February 19th of this year, Microsoft’s own security blog wrote that OpenClaw wasn’t fit to run on ordinary personal or work computers. Seven months later, the same company built its own product on top of it. Did OpenClaw get safer in the meantime—or did Microsoft fill in something itself?

As it happens, a ZDNet Korea column on the 26th covered Meta’s personal agent, Muse—written after trying it firsthand in the US over the Chuseok holiday, Korea’s harvest festival. Both companies launched a personal agent in the same month, but their designs point in almost opposite directions. Today I want to trace that difference.

What Home, Code, and Autopilot Each Do

Home is the new landing screen. Chat, where you ask and get answers right away, and Cowork, where you hand off a whole task and get back a finished result, now live in one place. With Office in Copilot, Word, Excel, and PowerPoint features are folded in, so what Copilot produces comes out as a real document your team can edit together in real time.

Code runs on the same underlying technology as GitHub Copilot. Even non-developers can build apps, dashboards, and automated workflows in natural language inside a sandbox. Copilot Managed Runtime, which runs what you build inside your company’s Microsoft 365 environment, also shipped in preview.

Autopilot is the agent that was unveiled under the name Scout at the Build event in June. Inside a company’s tenant², it has its own identity, memory, machine, and workspace. You can @-mention it in Teams and Outlook like a coworker, and permissions and audit logs follow it around.

The rollout is staggered. Home arrives within a few weeks; Code goes out first through the Frontier program³ by the end of the month; Autopilot widens its private preview by the end of the month as well. Today — a command center that pulls together email, calendar, Teams, meetings, and tasks to organize your to-dos and even draft the work — enters private preview in October, and the feature that lets a whole team share channel and meeting context by calling @Copilot in Teams goes into private preview by the end of the month. Everything else gets unveiled at Ignite, November 17–20. As of now, most of this is just an announced timeline — not something you can switch on in your tenant today.

What Came From OpenClaw, and What Microsoft Added

OpenClaw started as a personal assistant Steinberger built for his own use. You talk to it through a messenger, and it goes to work directly on your files, mail, calendar, and apps. Developers embraced it enough to give it roughly 389,500 GitHub stars, but using it meant installing it on your own server, picking a model, and handling security yourself. Even the sandbox—its isolation feature—shipped disabled by default. That’s exactly the gap Microsoft’s security team flagged in February: untrusted instructions and executable code sitting side by side, both holding real credentials.

So saying it was “built on OpenClaw” is only half the story. The other half is the layer Microsoft bolted on—giving each agent an Entra identity, managing devices through Intune, enforcing Purview policies, and wrapping everything in a sandbox.

What’s interesting is that part of that layer flowed back into OpenClaw itself. According to a post the OpenClaw Foundation published on September 25, a policy plugin built by Microsoft-side contributors lets operators write down their requirements and then checks the agent’s actual configuration against them, logging the results. It lets you verify which channels are enabled, which model provider is in use, and how secrets and authentication are wired up. A native Windows app and a sandboxed backend for containing command execution came out of the same effort.

The thing that caught my eye most, though, was a small fix. One patch from Shahine draws a line between “a command that definitely didn’t run” and “a command whose execution status is unknown.” When an agent doesn’t know the outcome of a command, simply re-running it can cause the same action to happen twice. This fix preserves that “unknown” state instead of papering over it, so the agent doesn’t automatically re-execute. Other fixes made sure user requests get handled ahead of background tasks, or stopped the same answer from being logged twice in the conversation history. The Foundation’s point is that details like these are what turn an agent from something impressive into something you can actually trust.

Muse erased the choices, Copilot relocated them

What stood out most when I used Muse in the column was what it left out. There’s no menu for picking a model, no setting for how deep to make the reasoning go. As of September 25th, when I checked, there wasn’t even a developer-tool connector like GitHub on the list. Instead, it was filled with apps you’d use on an ordinary day — Gmail, Calendar, restaurant reservations, bank account linking. The column’s judgment was this: you need to know which model is good to be able to choose one, and anyone who already knows that isn’t really an ordinary user anymore.

The new Copilot arrived with almost the opposite list. Frontier models like Astra and Fable are in, there’s now a unified registry bringing together Microsoft’s own plugins alongside partner and self-built ones, and you can build apps directly with Code. It connects Power BI’s semantic models through Fabric IQ, and links Dynamics 365 and Power Platform’s data and workflows via public preview too. Nearly everything Muse erased is here.

That doesn’t mean a single employee has to shoulder all these choices, though. Which models can be used, and up to what spending limit, is set by policy by administrators through something like Agent 365. Users can see for themselves exactly where their credits went. According to reports, for enterprise customers, usage-based features stay switched off until an administrator sets a spending policy — and there’s no billing before that.

Both companies, in effect, cleared the choice away from the user’s view. Meta chose to eliminate the choice itself; Microsoft chose to move the choice onto the desks of IT and finance teams.

Agents Are Sold by the Meter, Not by the Seat

This distinction shows up most clearly in the billing structure. Routine AI tasks stay under the fixed-cost User Subscription License (USL), while Cowork, Code, Autopilot, and other agentic work that draws on frontier models gets split off into usage-based billing (UBB). On top of that sits FinOps for AI, which lets administrators set spending policy and define the scope of model usage.

Microsoft hasn’t gone into much detail on why it split things this way, but you can guess from the shape of the resources agents consume. A chatbot answers one question and stops there, but Autopilot runs on its own machine and keeps working days later. Muse, too, runs on a dedicated virtual machine in the cloud for each user. As I discussed in Issue 217, “Agents Think in GPUs and Work in CPUs,” agents spend as much on opening browsers, calling apps, and organizing results as they do on inference itself. Price by headcount, and the cost of your heaviest-delegating employee stays hidden inside the seat price. Installing a separate meter is a choice to make that cost visible.

But a visible meter also makes people hesitate to use it. Unlike Muse, which has reduced payment authentication to a single Stripe Link confirmation, Copilot’s agent features only switch on once someone has built a spending policy. Whether that one extra step makes companies bring agents in cautiously, or simply keeps the switch off altogether, remains to be seen.

Oswarld’s Lens

My column read Muse as the first product to herald a general-purpose AI agent. But I noted that “general-purpose” carries two meanings here: intelligence capable of any task, and a tool anyone can use. What Muse demonstrated was the second meaning.

The new Copilot seems to be adding a third meaning to the mix: that organizations can verify and delegate to it. Letting ordinary users run an agent means stripping away configuration; letting an organization bring an agent on board means being able to verify that configuration. The policy plugins built into OpenClaw, along with the rule that “a command whose outcome is unknown doesn’t get rerun,” are exactly the kind of work that doesn’t show up when you’re just comparing model performance.

My column pointed out that Kakao (South Korea’s leading messaging-app operator) and Naver (Korea’s largest search engine company) still lack a design that unifies a single user’s agent across services, instead bolting an agent onto each service separately. Microsoft, by contrast, lets you give Autopilot a name, a role, and a goal, with one agent moving across Teams, Outlook, and documents. That direction—binding everything to the user—is the same path Muse is taking.

When Korean companies bring agents in-house, there’s now something to decide even before picking which model to use: what identity to give the agent, how much spending to allow it, and whether to make it stop when it hits a task whose outcome it can’t predict. Switch on an agent without answering these questions, and you’re inviting into your own company the exact scenario Microsoft’s security team warned about back in February.

Closing

Two personal agents launched in the same month answered the same question differently: where should the choices that used to belong to the user go? Meta erased them. Microsoft passed them up to administrators. OpenClo sits in between — the floor where enterprises pick things up, rework them, and hand them back. We’ll get a clearer look at how Autopilot is actually being used in its private preview around Ignite in November.

---

💬 If you could give one agent at your company a name and a role, what would you put it in charge of first? Let me know in the comments.

📨 If you have a colleague handling AI adoption or budget at work, please share this piece with them.

References & Further Reading

• Microsoft, Introducing the new Copilot with Home, Code and Autopilot (2026-09-25)
• OpenClaw Blog, Microsoft Autopilot is built on OpenClaw. The contributions go both ways. (2026-09-25)
• ZDNet Korea, [Kwangseob Ahn’s AI Synthesis] What Meta’s “Muse” means for Korean companies (2026-09-26)
• TechRadar, Microsoft says OpenClaw is not appropriate to run on a standard personal or enterprise workstation
• INLEVEL9 Letter Issue No. 217, Agents Think in GPU, Work in CPU

The author is Oswarld (Kwangseob Ahn). Current roles: Adjunct Professor at Sejong University, Strategy Consultant at INLEVEL9. Career, research, books, and recent work are kept current on the About page. Latest · July 2026: HEMA-2: A Consolidation-Aware Tri-Memory Architecture with Multi-Channel Scheduling for Lifelong Conversational AI.

📝 Glossary

Footnotes

1. OpenClaw: An open-source personal AI agent released by Peter Steinberger in November 2025. It was first called Clawdbot, then Moltbot, before settling on its current name. It takes instructions through messaging apps like Telegram and Discord and carries out real-world tasks. ↩

2. Tenant: In Microsoft 365, a tenant is the isolated environment a single organization operates in. User accounts, data, and security policies are all bundled at this level. ↩

3. Frontier program: Microsoft’s early-access program that lets select users try new Copilot features before general release. ↩