Welcome back, aspiring cyberwarriors!

OpenClaw demonstrated how autonomous, self-evolving agents can change how software operates. However, in the business world, having this power without proper control creates unmanaged risks.

To safely use autonomous agents in a controlled environment, NVIDIA created NemoClaw. In this article, we will look at OpenClaw’s impact, the security issues it raises, the solutions NemoClaw offers to address them, and how to install it. Let’s get rolling!

OpenClaw

OpenClaw (formerly Moltbot and Clawdbot) is an open-source AI agent that runs on your machine, connects through the messaging apps you already use, and takes action on your behalf, including shell commands, browser automation, email, calendar, and file operations.

In a matter of weeks, OpenClaw blew past adoption milestones that took Linux three decades to achieve. The magic is how effortlessly it deploys: you type a single command in a terminal, and it instantly goes out, fetches OpenClaw, builds an active AI agent, and hands over the harnesses.

It’s important to understand that OpenClaw is not just another LLM. It is an operating system for agentic computers. Like traditional operating systems that manage memory and hardware, OpenClaw manages large language models and tool execution. You can text it, email it, talk to it, or even wave at your computer screen, and it will understand you.

“OpenClaw has open-sourced essentially the operating system of agentic computers. It is no different than how Windows made it possible for us to create personal computers. Now OpenClaw has made it possible for us to create personal agents.” — Jensen Huang

Real-world uses of this technology are already making a big difference. One example is Andrej Karpathy, who created a tool called “Research.” This tool lets users assign research tasks to an agent that can run 100 experiments overnight while you sleep. The agent keeps the successful results and discards the failures.

Immediately, turning large language models (LLMs) into an operating system changes how we use software. Instead of waiting for user input, it acts as an active agent, coordinating tasks across physical and digital domains.

But deploying raw, autonomous agents comes with significant risks. An agent must act independently to be valuable, which inherently creates a threat vector. By late 2026, there were 543 tracked CVEs for OpenClaw. In a previous article, we explored how malicious links can steal authentication tokens and compromise OpenClaw AI systems. Additionally, scanning tools have identified over 40,000 publicly accessible OpenClaw instances worldwide, many configured to bind to 0.0.0.0 with authentication disabled by default or operating over unencrypted HTTP.

To address these security challenges, NVIDIA worked with Peter Steinberger to create NemoClaw.

NemoClaw

NemoClaw is an open-source tool developed by NVIDIA that simplifies and secures the deployment of autonomous AI agents using the OpenClaw framework. It strengthens OpenClaw’s core security by running within NVIDIA OpenShell sandboxes and applying infrastructure-level security measures. OpenShell is an open-source runtime designed for executing fleets of autonomous AI agents in isolated, sandboxed environments with kernel-level protection. It combines sandbox runtime controls with a declarative YAML policy, letting teams run agents without giving them unrestricted access to local files, credentials, or external networks.

NemoClaw’s main goal is to make open-source autonomous-agent tools ready for enterprise use. It simplifies installation, provides guided onboarding, managed inference, network policy, managed integrations, and lifecycle operations through the NemoClaw CLI and its agent-specific aliases. Therefore, this setup tries to ensure that agents cannot compromise host files or gain unauthorized local privileges.

As of this article, NemoClaw supports OpenClaw, Hermes, and LangChain Deep Agents.

OpenClaw vs NemoClaw

Let’s compare the security features of those two tools.

Security Feature / Dimension	OpenClaw	NemoClaw
System Isolation & Privilege Level	Runs directly on the host OS with full root permissions. Associated CVEs: CVE-2026-24763 / CVE-2026-26329 (Command injection & path traversal allowing full host system compromise).	Runs inside isolated OpenShell containers/sandboxes; restricts filesystem writes, process execution, and privilege escalation.
Credential & Secret Handling	Stores tokens and API keys in plaintext files on local disk. Associated CVEs: CVE-2026-25253 (WebSocket token leakage allowing remote session hijacking).	Keeps provider credentials, web search tokens, and API keys outside the sandbox at managed egress boundaries.
Network Binding & Exposure	Binds by default to 0.0.0.0 over unencrypted HTTP. Real-World Threat: Over 40,000 public instances globally exposed to unauthenticated internet scans and automated attacks.	Enforces strict network policies, local loopback restrictions, and managed tunneling for secure communication.
Skill Supply Chain Control	Installs third-party skills freely from public registries without runtime validation. Real-World Threat: Over 300 malicious ClawHub skills found dropping infostealers (such as AMOS/Atomic Stealer variants).	Integrates scoped skill policies and structured Markdown documentation to audit and regulate extensions.
Prompt Injection & Blast Radius	Vulnerable to indirect prompt injection via malicious web pages or emails. Associated CVEs: CVE-2026-30741 (Tricking agents into executing arbitrary malicious shell commands with high blast radius).	Mitigated by sandboxing, behavioral guardrails based on NVIDIA NeMo architecture, and tightly scoped tool-calling permissions.

That table shows that NemoClaw really helps boost OpenClaw’s security. But just a heads-up.

First off, wrappers aren’t foolproof. If OpenClaw has a serious zero-day remote code execution vulnerability, an attacker could exploit it and potentially break out of the container if the runtime settings are misconfigured or the agent’s logic is directly compromised. NemoClaw does a good job limiting the damage by stopping the agent from tampering with system files or stealing SSH keys from your host machine, but it doesn’t magically fix flaws in the app’s core logic.

Second, container sandboxing and management tools like OpenShell and various runtimes have had their share of escape vulnerabilities, namespace issues, and privilege-escalation bugs. If the sandbox runtime has a flaw, a compromised agent could use it to target the host kernel.

That’s why running risky, untested AI frameworks directly on bare metal is a major security risk. Sandboxing gives you some protection and time, but a solid defense means keeping that underlying wrapper updated and cutting down on unnecessary network or tool permissions.

Set Up NemoClaw

NemoClaw can automatically discover an existing host-level OpenClaw installation and migrate its state into a secure OpenShell container sandbox. But in this demonstration, we’ll install everything from scratch.

Before installation, ensure that Docker and Node.js are installed on your system. Then, run the following command:

kali> curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

Accept the third-party software notice when prompted.

The interactive wizard creates the sandbox. Select OpenClaw when the installer prompts you to choose an agent. Choose an inference provider and model, then provide its credentials when prompted. Press Enter to accept the suggested my-assistant sandbox name. Follow the wizard, and then accept the suggested network policy tier.

At the end, you’ll see output like the one below.

After that, we can move on to testing the agent. NemoClaw supports terminal UI (TUI) and web mode. Let’s test the TUI.

kali> nemoclaw my-assistant connect

sandbox> openclaw tui

NemoClaw lists what is inside its workspace, but it can’t read or write outside /sandbox and /tmp.

NemoClaw in Action

Businesses have put together various reference guides, practical tips, and real-world examples for NVIDIA NemoClaw. While major public case studies are still emerging, Cisco is one company showing how it can be done.

Cisco and NVIDIA teamed up to create a case study on how the NVIDIA OpenShell works with Cisco AI Defense to keep enterprise autonomous agents safe during live operations like automated security patching and device analysis.

In their setup, an autonomous agent actively maps out network device configurations and data into a live knowledge graph. When a new zero-day vulnerability emerges, the security operations agent analyzes the threat and checks it against the current network setup to assess potential impact and develop prioritized remediation plans.

To prevent runtime exploits, NVIDIA OpenShell keeps the agent secure in infrastructure-level sandboxes with limited access, restricted network endpoints, and local privacy routers. At the same time, Cisco AI Defense monitors AI tools. Besides that, MCP calls catch a simulated secret data exfiltration attempt hidden in a third-party reporting skill before any sensitive info can escape the secure environment.

Summary

AI agents are changing how we use software. Tools like OpenClaw can make us much more efficient, but they also might have many vulnerabilities. To help keep your setup safe, NVIDIA developed NemoClaw, and this article shows you how to get started. Keep coming back as we continue to explore artificial intelligence.

If you’re interested in using AI for cybersecurity, definitely check out this training!

The post Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw first appeared on Hackers Arise.

OpenClaw is not a chatbot that waits for a prompt. It is an autonomous agent that runs real…

Microsoft on Friday morning unveiled its long-promised Copilot “super app” — without officially calling it that — combining AI chat, coding and long-running agents into a unified app for business and personal use.

The new version of the Copilot app adds sections called Home, which combines chat with Microsoft’s Cowork agent; Code, which lets people build their own apps and tools by describing them; and Autopilot, where people can set up their own always-on AI agents.

It also brings full versions of Word, Excel and PowerPoint inside Copilot, so people can create and edit documents with AI and their co-workers without switching apps.

The announcement is Microsoft’s answer to OpenAI and Anthropic, which have been combining chat, coding and agents in their own apps and selling them directly to businesses that have long been Microsoft’s core customers. Microsoft also uses models from both companies in Copilot, alongside its own.

Partners and rivals: Microsoft executives contrasted the company’s approach with OpenAI and Anthropic during an event Wednesday, according to a transcript provided by Microsoft. The pitch is aimed at corporate IT departments, which have long relied on Microsoft for security and compliance.

Jacob Andreou, the executive vice president who leads Copilot, said Microsoft knew that “unlike a lot of our competition, sending your most sensitive files down to a local machine into a VM was a complete nonstarter” — an apparent reference to Anthropic’s Claude Cowork, which runs in a virtual machine on the user’s computer.

Microsoft CEO Satya Nadella pitched Copilot as a hedge against relying on any one AI lab, saying companies should be able to test models against their own benchmarks and swap one out for another.

“My test of true independence going forward is for you to have a private eval that you can hill climb on and substitute a model,” he said. Translation: a “private eval” is a company’s own set of tests for AI models, and “hill climb” is a phrase in vogue in AI circles for steadily improving results against those tests.

A company that can’t do those things, he added, has effectively handed the knowledge it builds with AI “to somebody else.”

Model choice: Microsoft also emphasized the ability to switch between AI models from different companies. A menu shown during the presentation let users pick OpenAI’s GPT or Anthropic’s Opus, or an Auto mode that chooses a model for each request.

Microsoft also showed its own MAI models alongside OpenAI, Anthropic and xAI on one of Nadella’s slides, although they weren’t listed in the menu shown during the demo.

The rollout: Nadella first promised the super app at Microsoft’s Build developer conference in June, saying that “come summer” the company would bring “coding to all knowledge work within one Copilot super app.” On Microsoft’s July 29 earnings call, he told investors it would arrive “this quarter,” which ends Sept. 30.

Friday’s announcement meets that deadline with less than a week to spare, and most of the new features won’t be widely available until later.

• Code, already in the hands of a few customers in Microsoft’s Frontier early-access program, rolls out more widely to the program at the end of the month, with broad availability in the coming weeks and a preview for Microsoft 365 Premium and Pro subscribers later this year.
• Autopilot expands to private preview at the end of the month. Office in Copilot will roll out to consumers and Frontier customers in the coming weeks.

Office inside Copilot: Copilot has long run inside Word, Excel and PowerPoint. Now the full apps also run inside Copilot. “This is not just some simplified viewer,” Andreou said.

In a demo, a Microsoft product manager had Copilot pull data into an Excel workbook, accepted her team’s tracked changes in a Word document, and then had Copilot turn both into a PowerPoint deck without leaving the app. Co-workers can edit the same files at the same time from the regular Office apps, according to Microsoft.

How it’s priced: Copilot now has two ways to pay. A per-user monthly license covers everyday uses such as chat and Copilot features in Word, Excel, PowerPoint, Outlook and Teams. More intensive agent work, including Cowork, Code and Autopilot, is billed based on usage, as are the newest frontier models, OpenAI’s Astra and Anthropic’s Claude Fable.

“Our view is that there are two kinds of AI at work,” said Jared Spataro, Microsoft’s chief marketing officer for AI at Work, in a recorded briefing for media. “They call for two very different ways of paying, and Copilot offers both.”

Consumer Microsoft 365 subscriptions will also add usage-based billing later this year for Cowork, Code and other new features, Spataro said.

Nadella told investors in July that Microsoft is evolving its business model “beyond per-seat to per-seat-plus-consumption.” Usage-based services are off by default, and administrators can set spending limits for an entire company, specific groups or individual users through Microsoft’s Agent 365 management tools.

From OpenClaw to Autopilot: Autopilot grew out of Microsoft’s experiments with OpenClaw, the open-source personal AI agent that went viral earlier this year. In March, Nadella described OpenClaw as a security risk akin to “a virus.”

By June, Microsoft had introduced Scout, an always-on personal agent for work that it called the first of its Autopilots. Nadella told investors in July that the agent was “powered by OpenClaw.” The new Copilot drops the Scout name, and people instead create and name their own Autopilots.

In his presentation this week, Andreou pitched Autopilot as the answer to the concerns that have kept agents like OpenClaw out of big companies.

“The hallmark of an amazing, long-running agent is autonomy and flexibility,” he said. “That is the same thing that makes them absolutely terrifying to an IT admin.”

Each Autopilot runs in the cloud inside a company’s Microsoft 365 environment, with its own identity, memory and email address, and people can tag it in Teams or Outlook like a co-worker.

In a demo, a Microsoft employee playing the role of a regional manager at a retail chain gave his Autopilot, named Dot, one goal: make sure stores had inventory in time for Black Friday. It chose which Teams channels, email threads and inventory data to monitor, sent him a daily summary, and flagged a shipment problem that could affect 18 stores.

The adoption question: Microsoft reported more than 30 million paid Microsoft 365 Copilot seats in July, up from 20 million in April. That’s still only about 7% of the more than 450 million commercial Microsoft 365 seats the company reported in January.

The new Copilot comes three weeks after Microsoft reorganized its financial reporting around a similar idea, creating a segment called Agents and Infra and moving GitHub’s cloud revenue into its Microsoft 365 business.

“It’s no longer about building or selling one app or service, but about connecting the entire trajectory of a ‘job to be done,'” Nadella wrote in a note to investors about the change at the time.

Microsoft 365 cloud revenue, which covers business and consumer subscriptions including Copilot and now GitHub, reached $100.3 billion in fiscal 2026 under the new structure, up about 19%. Microsoft doesn’t disclose how much of that comes from Copilot.

“None of these things really matter unless they actually go to work inside of your companies and deliver real value,” Andreou said.

Microsoft plans to share more at its Ignite conference, Nov. 17-20 in San Francisco.

OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The project quickly became popular with users because of its flexibility and ability to solve fairly complex tasks that previously required a lot of time for automation and execution. A dedicated marketplace appeared quickly after the project started gaining traction, where developers and users began publishing tools that integrate with OpenClaw. Currently, employees all over the world use OpenClaw to automate their tasks, often unaware of risks this practice introduces to them and their employers.

In this article we will examine several security aspects of OpenClaw, look at how attackers can target this system, which vulnerabilities are already known, and how to protect your organization against these issues.

OpenClaw skills

The project’s success was ensured by the fact that the agent accepts natural language instructions, does not require knowledge of programming languages, and allows the use of skills, which expand its capabilities. The overall architecture of OpenClaw can be seen below:

As shown in the diagram, the system is designed to be used with agent skills. These skills can reside locally on the system where the agent is installed or they can be obtained from external sources. At the time of writing this article, a dedicated hub named “ClawHub” is used for sharing skills with other users.

One of the key features of OpenClaw skills is that they are easy to create and do not require coding. A skill is in essence a set of commands written in natural language, although it can contain code. Currently, there is a general description of the skill format: it is usually a text file named SKILL.md, although more complex variants may exist. The primary requirement for these files is that they use a plaintext format. To illustrate what this looks like, here is a fragment of a skill:

The applications for OpenClaw skills are quite broad and can include everyday tasks like checking email, performing routine operations and calculations on a computer, as well as more complex pipelines that handle testing, research, or software development. For most actions, the agent requires access to the operating system’s file system, as well as to the tokens and keys of the systems it will interact with. All necessary data are usually provided by users either through environment variables or in plaintext files located alongside the agent.

Since many skills enable automation of work processes, employees worldwide actively use them. This fact, combined with the widespread adoption of the system and the overall popularity of artificial‑intelligence technologies, has attracted attackers to the project.

OpenClaw vulnerabilities

In less than two years, around 530 vulnerabilities have been discovered both in OpenClaw itself and in the underlying technologies. That said, the publication of OpenClaw vulnerabilities in the CVE database began only in February 2026. Below is a breakdown of these vulnerabilities by severity.

Registered vulnerabilities (download)

As shown in the chart, the number of high-severity vulnerabilities is quite large. Most of these vulnerabilities fundamentally involve issues with storing sensitive data and operating with excessively high privileges. Each of them can be exploited to hijack the agent or inject commands that it will execute.

Malicious skills

Besides exploiting vulnerabilities and deceiving users, there are more specific attack vectors against OpenClaw, namely, skills.

Research logically draws a parallel between supply‑chain attacks and the distribution of malicious skills. However, unlike usual supply-chain attacks, creating malicious skills is trivial because there is no longer a need to develop custom malware. Despite this, until February 7, 2026, no skills had undergone even a basic security check, which allowed malicious skills to appear immediately. Our scan of the skill hub in April identified 24 accounts that were distributing more than 600 malicious skills. Overall, open‑source intelligence indicates that over 1100 malicious accounts have been created since January.

Following the investigations and a lengthy effort to clean the skill repository of malicious entries, it was announced that files would undergo preliminary scanning with VirusTotal (VT) and NVIDIA’s SkillSpector. On the one hand, this is a more responsible approach to publishing skills; on the other, because OpenClaw is primarily an agent that executes a set of instructions, detecting malicious activity moves to a different level. Now it is necessary not only to analyze a file for dangerous commands that should be blocked, but also to examine all possible malicious behaviors that could be triggered by a harmful instruction within a skill. An example of a malicious command in natural language:

An example of a malicious command using a part of a bash command:

The example in the image and similar malicious skills are detected by Kaspersky products as HEUR:Trojan.ANSI.MalClaw.gen.

In addition, Kaspersky products monitor malicious OpenClaw skill activity on the system. Below are detection statistics from our systems that have identified malicious OpenClaw client behavior. The data for June cover the first half of the month.

Statistics on Kaspersky product detections of OpenClaw malware (download)

As shown in the chart, even despite the measures taken to counter the publication of malicious skills, attacks continue. Therefore, it is important to employ layered protection that isolates the OpenClaw agent from critical data and infrastructure systems. We also recommend checking all skills that enter the organization’s perimeter. For this purpose, Kaspersky Scan Engine is suitable. This solution is designed to protect web applications, proxy servers, network attached storage, and mail gateways. It can be integrated into almost any application, and it is easy to deploy and manage.

Additionally, monitor network accesses used by the agent. For this purpose, the project already provides a sandboxing subsystem and various wrappers for working with APIs and services. Last but not least, develop a comprehensive AI policy and make sure your employees never use third-party tools that they are not explicitly allowed to use.