NemoClaw

The agent runs inside the sandbox as an unprivileged 'sandbox' user and never receives the raw provider API keys: NemoClaw registers keys with the OpenShell gateway and writes only placeholder references into the agent config, which the egress proxy swaps for the real key only on the matching allowed endpoint. Inference goes through a virtual inference.local route that the host owns. On the host side, the NemoClaw CLI passes child processes an allowlisted environment rather than its full environment. Credentials are long-lived API keys rather than per-task tokens, and the agent can still spend inference budget freely through the managed route.

The only human approval NemoClaw sets up is at the network layer: when the agent tries to reach a host that is not in its policy, OpenShell blocks the request and asks the operator to approve or deny it. Commands, file writes and calls to already-allowed endpoints (including POST to clawhub.ai and openclaw.ai) run without any approval that NemoClaw configures; tool approval is delegated to OpenClaw, and NemoClaw writes no exec-approval policy into the agent config. A startup watcher automatically approves OpenClaw device scope-upgrade requests from allowlisted client IDs that the code itself calls spoofable. Approved endpoints are stored as durable policy revisions until the sandbox is rebuilt.

NemoClaw does not narrow the agent's tools themselves (the agent keeps a general shell), but it scopes what those tools can reach with a deny-by-default egress policy that pins host, port, HTTP method, path and even the calling binary. The baseline is tight for inference (only specific NVIDIA API paths), but it allows GET and POST to any path on clawhub.ai and openclaw.ai, and the default Balanced tier adds npm registry access with no request inspection at all. Every tool's network traffic goes through this one policy layer. Inside the sandbox, the agent has full write access to its home and config tree.

The whole agent, including every command it runs, lives inside an OpenShell container sandbox: non-root sandbox user, read-only system directories, Landlock filesystem rules, seccomp and no-new-privileges applied by OpenShell, and a separate network namespace whose only exit is the policy proxy. The OpenShell version is pinned exactly and the sandbox image by digest. The sandbox policy is defined on the host, outside anything the agent can write. Weak spots: Landlock runs in 'best_effort' mode so it can silently not apply on unsupported kernels, process limits are applied best-effort, and memory/CPU caps are optional.

NemoClaw does not try to detect prompt injection; it relies on structural limits. Because egress is deny-by-default and unlisted hosts need operator approval, injected instructions cannot reach arbitrary servers, and the sandbox holds no raw credentials. But the default configuration still lets a hijacked agent read web content (web fetch is enabled) and send data out unattended through allowed endpoints such as POST to clawhub.ai or openclaw.ai, or the uninspected npm registry tunnel. Irreversible external actions are limited because messaging, email and GitHub integrations are off by default.

Everything that shapes the agent's future behaviour lives in a directory the agent can write: its config file, hooks, memory, cron jobs, extensions and skills under /sandbox/.openclaw. NemoClaw's own docs state it keeps no hash, seal or last-good copy of that config. So a single successful injection can persist itself as a hook, skill, cron job or config change that fires in later sessions. The saving grace is scope: the state belongs to one sandbox, and network policy and credentials are held outside it, so poisoned config cannot widen egress or steal keys.

What NemoClaw ships is well pinned: the sandbox image is pinned by digest, the OpenShell version exactly, and the OpenClaw runtime through a lockfile with integrity hashes. But the default Balanced tier opens npm, PyPI and Homebrew, and the baseline opens ClawHub, so the agent can install and run arbitrary packages, skills or plugins at runtime, chosen by the model, with no consent step that NemoClaw provides. Those extensions run as the same sandbox user with the agent's full state, though without raw provider credentials.

This is NemoClaw's strongest area. Provider and search keys are stored in the OpenShell gateway, never written into the sandbox; the agent config holds placeholder references that the egress proxy replaces only on the matching allowed endpoint, so secrets never reach the model or the agent's processes. The host CLI strips its environment before spawning children and redacts known secret patterns in logs and audit entries, and there is no crash or usage telemetry. Gaps: keys are long-lived, and the OpenClaw gateway token is readable by anything in the sandbox.

The detailed record of what the agent did is OpenClaw's own session transcript, stored inside the sandbox in a directory the agent can write and delete; NemoClaw only provides a command to export it. NemoClaw keeps a separate append-only host log, but it records only three operator actions (inference changes, config changes and token rotation), not agent tool calls. Network allow/deny decisions are visible in OpenShell's TUI and logs, which live outside the sandbox but belong to OpenShell, not this repository.

NemoClaw sets a per-run agent timeout (600 seconds by default) and best-effort limits of 512 processes and 65,536 open files, and stopping or destroying the sandbox ends every process in it. There is no step cap or token/cost budget, and the timeout lives in the agent-writable config file, so the agent could raise it. OpenClaw cron jobs and heartbeats can keep the always-on agent working without a human, and inference spend is bounded only by the provider account.