By now you've probably heard: Anthropic has effectively shut down OpenClaw's ability to use Claude via OAuth tokens. Server-side blocks started January 9. Formal policy published February 20. And as of today (April 4), they've added "Extra Usage" billing that makes the integration economically unviable.
The creator of OpenClaw was hired by OpenAI in February. ClawHub — the skill registry with 13,000+ community-built skills — has been found to contain malicious packages stealing credentials. Google suspended accounts linked to OpenClaw OAuth usage around the same time.
This is a lot happening at once. And I think it raises a question that every indie founder building on AI APIs should be sitting with right now:
How much of your product depends on a model provider not changing the rules?
OpenClaw users didn't do anything wrong. They built on top of what was available. They grew a community of 13,000+ skills. And then one policy change — no warning, no refunds, accounts suspended — and the whole thing unravels.
This isn't unique to OpenClaw. It's the fundamental risk of building on top of any AI provider's API:
The thing that strikes me about the OpenClaw situation specifically: the users who got hurt most weren't the ones doing anything shady. They were the power users — the ones who built the most, automated the most, depended on it the most.
That's the cruel irony of platform risk. The more you invest in a platform, the more exposed you are when it turns.
I've been thinking about this a lot while building AllyHub (allyhub.com). Our approach has been to treat the underlying model as a commodity layer — something that can be swapped, not something you build your identity on top of. The reusable value lives in the Manuals, Playbooks, and Skills that accumulate over time — not in any specific model's API.
But I'm curious how others are thinking about this. Are you:
a) Diversifying across multiple model providers?
b) Building abstraction layers so you can swap models?
c) Accepting the platform risk as the cost of moving fast?
d) Something else entirely?
And for anyone who was using OpenClaw — what are you moving to?
Ran OpenClaw on a small Mac Mini server for about a week. CPU kept climbing past 140% even on light tasks, so I shut it down manually before anything broke. At the time I thought it was a resource issue on my end. Seeing this now — maybe it was a sign. The whole thing was held together by OAuth tokens that Anthropic never officially supported. Not exactly a stable foundation to build on. If you're shipping something on top of a third-party AI API, you're one policy update away from a bad day. Worth thinking about before you go too deep.