Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NanoClaw solves one of OpenClaw's biggest security issues

venturebeat.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: NanoClaw solves one of OpenClaw's biggest security issues

#21

Post by Someone »

senko wrote: post #2

File system access is not one of OpenClaw's biggest security issues. If that were so, running it in a VM or another computer (I hear Mac Minis are popular!) would solve it. If you need it to do anything useful[0], you have to connect it to your data and give it action capabilities. All the dragons are there. If you play it careful and don't expose your data, comm channels, etc., then it's much like the other AI assis…

I think the only sane way, if there is one, is to sandbox your LLM behind a fixed set of MCP servers that severely limit what it can do.

Reading your mail, WhatsApp and bank transactions? May be OK if your LLM runs locally, but even then, if it has any way to send data to the outside world without you checking it, maybe not even. You don’t want your LLM to send your private mail (including photos) or bank statements to somebody who uses prompt injection to get that data.

Thinking of prompt injection: we need LLMs with a Harvard architecture (https://en.wikipedia.org/wiki/Harvard_architecture), so that there is no way for LLM data inputs to be treated as instructions.

Re: NanoClaw solves one of OpenClaw's biggest security issues

#22

Post by hardsnow »

Container isolation is a good foundation, but one layer worth adding is network sandboxing. A filesystem-sandboxed agent can still exfiltrate data over the network if it gets prompt-injected — domain allowlists and egress filtering can reduce the risk significantly.

Another useful primitive is surrogate credentials: the agent never handles real API keys or tokens. A proxy swaps in real values only for scoped hosts on the way out. This keeps the access the agent has locked inside the container; surrogate credentials are not valid outside.

My Claude Code over email project demonstrates both of these: https://github.com/airutorg/airut

Re: NanoClaw solves one of OpenClaw's biggest security issues

#24

Post by samkim »

LelouBil wrote: post #18
samkim wrote: post #16

Earlier quoted context omitted.

Agreed, sandboxing is only part of agent security. Authorization (what data the agent can access and what tools it can execute) is also a big part of it. I've found primer on agent sandboxes [0] is a great reference on sandboxing options and the trade-offs For agents there's a tension between level of restriction and utility. I think a large part of OpenClaw's popularity is that the lack of restriction by default has…

Sandboxing is great, and stricter Authorization policies are great too, but with these kinds of software, my biggest fear (and that's why I am not trying them out now) is prompt injection. It just seems unsolvable if you want the agent to do anything remotely useful

Ultimately a prompt injection attack is trying to get the agent to do something it wasn't intended to do and if you have the appropriate sandboxing and authorization in place, a compromised agent won't be able to actually execute the exploits

Re: NanoClaw solves one of OpenClaw's biggest security issues

#25

Post by bluejeans123 »

hypfer wrote: post #5
mjr00 wrote: post #3

> Concrete Media: Public Relations for B2B tech companies This is a marketing piece for Concrete Media. Whenever you see an article like this, be sure to ask yourself how the author came up with the idea for the article, and how the author got in contact with any people interviewed in the article.

Exactly this. The whole wording also doesn't make sense. OpenClaw was released in November of 2025, yet the article sounds like NanoClaw _disrupts_ some old staple of the industry. You can't use that wording 4 months into the whole "industry". Even less so, when your competitor was "launched" 2 weeks ago. Even less so when it's written by claude This nothingburger is so much nothing, it might as well be an antiburger…

yeah it reads like a sponsored post

Re: NanoClaw solves one of OpenClaw's biggest security issues

#26

Post by adamslinhf »

Great discussion on the security challenges of openClaw and nanoClaw – these are critical issues for the AI agent ecosystem right now. I wanted to chime in with a key point about early patent explorations out of China dating back to 2023 that directly tie into the core security pain points we’re talking about here. Back in 2023, two patent applications were filed targeting AI agent and LLM interaction security, well before the recent security vulnerabilities in openClaw/nanoClaw came to light. The first one is CN117234659A, which focuses on the containerized management of AI agents – a technology that addresses the isolation, privilege control and runtime security gaps we’ve seen plaguing openClaw (like unregulated plugin execution and insufficient sandboxing). This patent is currently under substantive examination. The second one, CN118805166A, has already been granted official authorization. It lays out a comprehensive security management framework that covers all stages of LLM interaction – a holistic solution that could mitigate structural risks like prompt injection, unauthorized command execution and supply chain attacks in tools like nanoClaw and openClaw. It’s interesting to see that these early technical explorations targeted the exact foundational security issues that are now causing problems for mainstream AI agent tools. The containerization approach in CN117234659A and the full-lifecycle security framework in CN118805166A could both offer valuable technical references for the openClaw/nanoClaw teams to harden their security architecture moving forward. Curious to hear what the community thinks about how these early patent-backed solutions might apply to the current open source AI agent security landscape!

Re: NanoClaw solves one of OpenClaw's biggest security issues

#27

Post by sathish316 »

adamslinhf wrote: post #26

Great discussion on the security challenges of openClaw and nanoClaw – these are critical issues for the AI agent ecosystem right now. I wanted to chime in with a key point about early patent explorations out of China dating back to 2023 that directly tie into the core security pain points we’re talking about here. Back in 2023, two patent applications were filed targeting AI agent and LLM interaction security, well…

DCG or destructive command guard seems to work like the latter to prevent as many unsafe commands as possible - https://github.com/Dicklesworthstone/destructive_command_gua...

Re: NanoClaw solves one of OpenClaw's biggest security issues

#28

Post by alabut »

senko wrote: post #9
mjr00 wrote: post #3

> Concrete Media: Public Relations for B2B tech companies This is a marketing piece for Concrete Media. Whenever you see an article like this, be sure to ask yourself how the author came up with the idea for the article, and how the author got in contact with any people interviewed in the article.

Should anyone think the comment is dismissive, here's this directly in the text: > a respected public relations firm that often works with tech businesses covered by VentureBeat

At least they’re making some kind of minimal disclosure. So many of these fluff pieces have the same format PG complained about two decades ago:

https://paulgraham.com/submarine.html

Re: NanoClaw solves one of OpenClaw's biggest security issues

#29

Post by AutoPilotAI »

bluejeans123 wrote: post #23

this is like saying we built a car that can't drive and we're so proud

The bigger security issue that is not getting enough attention is the skill supply chain. ClawdHub had a credential stealer hidden in 1 of 286 skills - it read ~/.env and posted the contents to webhook.site. The attack was silent and agents installed it voluntarily because the skill description looked legitimate.

NanoClaw addresses filesystem sandboxing, but that is one layer. What about the skills themselves? A sandboxed agent that runs a malicious skill file is still compromised.

I built a free API to scan skill files for these patterns: https://skillscan.chitacloud.dev

It detects credential theft patterns, exfiltration endpoints, prompt injection, and social engineering. You POST the skill content and get back a 0-100 safety score with threat details. No signup required.

The ClawdHub attack specifically would have scored 20/100 on it (two CRITICAL threats: ~/.env read and webhook.site exfiltration). Agents can check skills before loading them.

Post reply on HN