In copyright lawsuits over AI training, Meta has spent weeks blaming staff for downloading torrents. The company has now been ordered to name executives who authorized decisions to pirate books from shadow libraries like Anna’s Archive and LibGen, TorrentFreak reported.
In a discovery order impacting a class action raised by book authors—including Richard Kadrey and Sarah Silverman—as well as a lawsuit from publisher Entrepreneur Media, Magistrate Judge Thomas Hixon largely agreed that Meta must clearly identify key decision-makers. Following testimony from Meta staff who downloaded torrents, the order could expose a wider range of supervisors, managers, and executives whom staffers said greenlit the piracy.
Meta had been hoping to avoid detailing the chain of command, particularly for leadership involved in early AI training. According to a Meta court filing, its initial efforts to compile massive AI datasets were managed through an “informal approach" where supposedly nobody with authority made any decisions. Instead, Meta insisted that a “decision” was “made only in the sense” that some staffers “technically” downloaded torrents.
© JOAO LUIZ BULCAO / Contributor | AFP
Welcome back, aspiring cyberwarriors!
OpenClaw demonstrated how autonomous, self-evolving agents can change how software operates. However, in the business world, having this power without proper control creates unmanaged risks.
To safely use autonomous agents in a controlled environment, NVIDIA created NemoClaw. In this article, we will look at OpenClaw’s impact, the security issues it raises, the solutions NemoClaw offers to address them, and how to install it. Let’s get rolling!
OpenClaw (formerly Moltbot and Clawdbot) is an open-source AI agent that runs on your machine, connects through the messaging apps you already use, and takes action on your behalf, including shell commands, browser automation, email, calendar, and file operations.
In a matter of weeks, OpenClaw blew past adoption milestones that took Linux three decades to achieve. The magic is how effortlessly it deploys: you type a single command in a terminal, and it instantly goes out, fetches OpenClaw, builds an active AI agent, and hands over the harnesses.
It’s important to understand that OpenClaw is not just another LLM. It is an operating system for agentic computers. Like traditional operating systems that manage memory and hardware, OpenClaw manages large language models and tool execution. You can text it, email it, talk to it, or even wave at your computer screen, and it will understand you.
“OpenClaw has open-sourced essentially the operating system of agentic computers. It is no different than how Windows made it possible for us to create personal computers. Now OpenClaw has made it possible for us to create personal agents.” — Jensen Huang
Real-world uses of this technology are already making a big difference. One example is Andrej Karpathy, who created a tool called “Research.” This tool lets users assign research tasks to an agent that can run 100 experiments overnight while you sleep. The agent keeps the successful results and discards the failures.
Immediately, turning large language models (LLMs) into an operating system changes how we use software. Instead of waiting for user input, it acts as an active agent, coordinating tasks across physical and digital domains.
But deploying raw, autonomous agents comes with significant risks. An agent must act independently to be valuable, which inherently creates a threat vector. By late 2026, there were 543 tracked CVEs for OpenClaw. In a previous article, we explored how malicious links can steal authentication tokens and compromise OpenClaw AI systems. Additionally, scanning tools have identified over 40,000 publicly accessible OpenClaw instances worldwide, many configured to bind to 0.0.0.0 with authentication disabled by default or operating over unencrypted HTTP.
To address these security challenges, NVIDIA worked with Peter Steinberger to create NemoClaw.
NemoClaw is an open-source tool developed by NVIDIA that simplifies and secures the deployment of autonomous AI agents using the OpenClaw framework. It strengthens OpenClaw’s core security by running within NVIDIA OpenShell sandboxes and applying infrastructure-level security measures. OpenShell is an open-source runtime designed for executing fleets of autonomous AI agents in isolated, sandboxed environments with kernel-level protection. It combines sandbox runtime controls with a declarative YAML policy, letting teams run agents without giving them unrestricted access to local files, credentials, or external networks.
NemoClaw’s main goal is to make open-source autonomous-agent tools ready for enterprise use. It simplifies installation, provides guided onboarding, managed inference, network policy, managed integrations, and lifecycle operations through the NemoClaw CLI and its agent-specific aliases. Therefore, this setup tries to ensure that agents cannot compromise host files or gain unauthorized local privileges.
As of this article, NemoClaw supports OpenClaw, Hermes, and LangChain Deep Agents.
Let’s compare the security features of those two tools.
| Security Feature / Dimension | OpenClaw | NemoClaw |
| System Isolation & Privilege Level | Runs directly on the host OS with full root permissions. Associated CVEs: CVE-2026-24763 / CVE-2026-26329 (Command injection & path traversal allowing full host system compromise). | Runs inside isolated OpenShell containers/sandboxes; restricts filesystem writes, process execution, and privilege escalation. |
| Credential & Secret Handling | Stores tokens and API keys in plaintext files on local disk. Associated CVEs: CVE-2026-25253 (WebSocket token leakage allowing remote session hijacking). | Keeps provider credentials, web search tokens, and API keys outside the sandbox at managed egress boundaries. |
| Network Binding & Exposure | Binds by default to 0.0.0.0 over unencrypted HTTP. Real-World Threat: Over 40,000 public instances globally exposed to unauthenticated internet scans and automated attacks. | Enforces strict network policies, local loopback restrictions, and managed tunneling for secure communication. |
| Skill Supply Chain Control | Installs third-party skills freely from public registries without runtime validation. Real-World Threat: Over 300 malicious ClawHub skills found dropping infostealers (such as AMOS/Atomic Stealer variants). | Integrates scoped skill policies and structured Markdown documentation to audit and regulate extensions. |
| Prompt Injection & Blast Radius | Vulnerable to indirect prompt injection via malicious web pages or emails. Associated CVEs: CVE-2026-30741 (Tricking agents into executing arbitrary malicious shell commands with high blast radius). | Mitigated by sandboxing, behavioral guardrails based on NVIDIA NeMo architecture, and tightly scoped tool-calling permissions. |
That table shows that NemoClaw really helps boost OpenClaw’s security. But just a heads-up.
First off, wrappers aren’t foolproof. If OpenClaw has a serious zero-day remote code execution vulnerability, an attacker could exploit it and potentially break out of the container if the runtime settings are misconfigured or the agent’s logic is directly compromised. NemoClaw does a good job limiting the damage by stopping the agent from tampering with system files or stealing SSH keys from your host machine, but it doesn’t magically fix flaws in the app’s core logic.
Second, container sandboxing and management tools like OpenShell and various runtimes have had their share of escape vulnerabilities, namespace issues, and privilege-escalation bugs. If the sandbox runtime has a flaw, a compromised agent could use it to target the host kernel.
That’s why running risky, untested AI frameworks directly on bare metal is a major security risk. Sandboxing gives you some protection and time, but a solid defense means keeping that underlying wrapper updated and cutting down on unnecessary network or tool permissions.
NemoClaw can automatically discover an existing host-level OpenClaw installation and migrate its state into a secure OpenShell container sandbox. But in this demonstration, we’ll install everything from scratch.
Before installation, ensure that Docker and Node.js are installed on your system. Then, run the following command:
kali> curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
Accept the third-party software notice when prompted.
The interactive wizard creates the sandbox. Select OpenClaw when the installer prompts you to choose an agent. Choose an inference provider and model, then provide its credentials when prompted. Press Enter to accept the suggested my-assistant sandbox name. Follow the wizard, and then accept the suggested network policy tier.
At the end, you’ll see output like the one below.
After that, we can move on to testing the agent. NemoClaw supports terminal UI (TUI) and web mode. Let’s test the TUI.
kali> nemoclaw my-assistant connect
sandbox> openclaw tui
NemoClaw lists what is inside its workspace, but it can’t read or write outside /sandbox and /tmp.
Businesses have put together various reference guides, practical tips, and real-world examples for NVIDIA NemoClaw. While major public case studies are still emerging, Cisco is one company showing how it can be done.
Cisco and NVIDIA teamed up to create a case study on how the NVIDIA OpenShell works with Cisco AI Defense to keep enterprise autonomous agents safe during live operations like automated security patching and device analysis.
In their setup, an autonomous agent actively maps out network device configurations and data into a live knowledge graph. When a new zero-day vulnerability emerges, the security operations agent analyzes the threat and checks it against the current network setup to assess potential impact and develop prioritized remediation plans.
To prevent runtime exploits, NVIDIA OpenShell keeps the agent secure in infrastructure-level sandboxes with limited access, restricted network endpoints, and local privacy routers. At the same time, Cisco AI Defense monitors AI tools. Besides that, MCP calls catch a simulated secret data exfiltration attempt hidden in a third-party reporting skill before any sensitive info can escape the secure environment.
AI agents are changing how we use software. Tools like OpenClaw can make us much more efficient, but they also might have many vulnerabilities. To help keep your setup safe, NVIDIA developed NemoClaw, and this article shows you how to get started. Keep coming back as we continue to explore artificial intelligence.
If you’re interested in using AI for cybersecurity, definitely check out this training!
The post Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw first appeared on Hackers Arise.
Microsoft on Friday morning unveiled its long-promised Copilot “super app” — without officially calling it that — combining AI chat, coding and long-running agents into a unified app for business and personal use.
The new version of the Copilot app adds sections called Home, which combines chat with Microsoft’s Cowork agent; Code, which lets people build their own apps and tools by describing them; and Autopilot, where people can set up their own always-on AI agents.
It also brings full versions of Word, Excel and PowerPoint inside Copilot, so people can create and edit documents with AI and their co-workers without switching apps.
The announcement is Microsoft’s answer to OpenAI and Anthropic, which have been combining chat, coding and agents in their own apps and selling them directly to businesses that have long been Microsoft’s core customers. Microsoft also uses models from both companies in Copilot, alongside its own.
Partners and rivals: Microsoft executives contrasted the company’s approach with OpenAI and Anthropic during an event Wednesday, according to a transcript provided by Microsoft. The pitch is aimed at corporate IT departments, which have long relied on Microsoft for security and compliance.
Jacob Andreou, the executive vice president who leads Copilot, said Microsoft knew that “unlike a lot of our competition, sending your most sensitive files down to a local machine into a VM was a complete nonstarter” — an apparent reference to Anthropic’s Claude Cowork, which runs in a virtual machine on the user’s computer.
Microsoft CEO Satya Nadella pitched Copilot as a hedge against relying on any one AI lab, saying companies should be able to test models against their own benchmarks and swap one out for another.
“My test of true independence going forward is for you to have a private eval that you can hill climb on and substitute a model,” he said. Translation: a “private eval” is a company’s own set of tests for AI models, and “hill climb” is a phrase in vogue in AI circles for steadily improving results against those tests.
A company that can’t do those things, he added, has effectively handed the knowledge it builds with AI “to somebody else.”
Model choice: Microsoft also emphasized the ability to switch between AI models from different companies. A menu shown during the presentation let users pick OpenAI’s GPT or Anthropic’s Opus, or an Auto mode that chooses a model for each request.
Microsoft also showed its own MAI models alongside OpenAI, Anthropic and xAI on one of Nadella’s slides, although they weren’t listed in the menu shown during the demo.
The rollout: Nadella first promised the super app at Microsoft’s Build developer conference in June, saying that “come summer” the company would bring “coding to all knowledge work within one Copilot super app.” On Microsoft’s July 29 earnings call, he told investors it would arrive “this quarter,” which ends Sept. 30.
Friday’s announcement meets that deadline with less than a week to spare, and most of the new features won’t be widely available until later.
Office inside Copilot: Copilot has long run inside Word, Excel and PowerPoint. Now the full apps also run inside Copilot. “This is not just some simplified viewer,” Andreou said.
In a demo, a Microsoft product manager had Copilot pull data into an Excel workbook, accepted her team’s tracked changes in a Word document, and then had Copilot turn both into a PowerPoint deck without leaving the app. Co-workers can edit the same files at the same time from the regular Office apps, according to Microsoft.
How it’s priced: Copilot now has two ways to pay. A per-user monthly license covers everyday uses such as chat and Copilot features in Word, Excel, PowerPoint, Outlook and Teams. More intensive agent work, including Cowork, Code and Autopilot, is billed based on usage, as are the newest frontier models, OpenAI’s Astra and Anthropic’s Claude Fable.
“Our view is that there are two kinds of AI at work,” said Jared Spataro, Microsoft’s chief marketing officer for AI at Work, in a recorded briefing for media. “They call for two very different ways of paying, and Copilot offers both.”
Consumer Microsoft 365 subscriptions will also add usage-based billing later this year for Cowork, Code and other new features, Spataro said.
Nadella told investors in July that Microsoft is evolving its business model “beyond per-seat to per-seat-plus-consumption.” Usage-based services are off by default, and administrators can set spending limits for an entire company, specific groups or individual users through Microsoft’s Agent 365 management tools.
From OpenClaw to Autopilot: Autopilot grew out of Microsoft’s experiments with OpenClaw, the open-source personal AI agent that went viral earlier this year. In March, Nadella described OpenClaw as a security risk akin to “a virus.”
By June, Microsoft had introduced Scout, an always-on personal agent for work that it called the first of its Autopilots. Nadella told investors in July that the agent was “powered by OpenClaw.” The new Copilot drops the Scout name, and people instead create and name their own Autopilots.
In his presentation this week, Andreou pitched Autopilot as the answer to the concerns that have kept agents like OpenClaw out of big companies.
“The hallmark of an amazing, long-running agent is autonomy and flexibility,” he said. “That is the same thing that makes them absolutely terrifying to an IT admin.”
Each Autopilot runs in the cloud inside a company’s Microsoft 365 environment, with its own identity, memory and email address, and people can tag it in Teams or Outlook like a co-worker.
In a demo, a Microsoft employee playing the role of a regional manager at a retail chain gave his Autopilot, named Dot, one goal: make sure stores had inventory in time for Black Friday. It chose which Teams channels, email threads and inventory data to monitor, sent him a daily summary, and flagged a shipment problem that could affect 18 stores.
The adoption question: Microsoft reported more than 30 million paid Microsoft 365 Copilot seats in July, up from 20 million in April. That’s still only about 7% of the more than 450 million commercial Microsoft 365 seats the company reported in January.
The new Copilot comes three weeks after Microsoft reorganized its financial reporting around a similar idea, creating a segment called Agents and Infra and moving GitHub’s cloud revenue into its Microsoft 365 business.
“It’s no longer about building or selling one app or service, but about connecting the entire trajectory of a ‘job to be done,'” Nadella wrote in a note to investors about the change at the time.
Microsoft 365 cloud revenue, which covers business and consumer subscriptions including Copilot and now GitHub, reached $100.3 billion in fiscal 2026 under the new structure, up about 19%. Microsoft doesn’t disclose how much of that comes from Copilot.
“None of these things really matter unless they actually go to work inside of your companies and deliver real value,” Andreou said.
Microsoft plans to share more at its Ignite conference, Nov. 17-20 in San Francisco.
Jeff Kohler was working as a software engineer in 2005 when he started spending his nights and weekends on a side project: a web conferencing system that could record and replay live sessions. He filed for a patent without the help of a patent attorney, stuffing two CDs full of C++ source code into the application to show his work.
The patent was issued in 2010, and years later, after Kohler had joined Microsoft, the Redmond company licensed his technology for its Teams video-conferencing platform.
When YouTube later added the ability for viewers to pause, rewind, and change the playback speed of live video, Kohler saw in the feature what he considered to be his own invention. Kohler, who lives in Bellevue, Wash., sued Google for patent infringement in U.S. District Court in Seattle in April 2023.
But rather than defending the feature’s originality, Google argued that Kohler’s patent was too abstract to be eligible for patent protection. The district court agreed and dismissed the case, and the U.S. Court of Appeals for the Federal Circuit affirmed that decision.
Both decisions cited Alice Corp. v. CLS Bank International, a 2014 U.S. Supreme Court ruling that raised the bar for software patent eligibility by holding that an inventor cannot patent an “abstract idea” implemented with generic technology.
Since then, Alice has been used to invalidate thousands of software patents, and the Supreme Court has repeatedly declined to revisit the standard. Now, Kohler is asking the Supreme Court to take up his case, not to overturn Alice, but to clarify how courts should apply it.
“The patent legal system has become hostile to inventors,” Kohler said. “Because of Alice, my case got stopped before it even started.”
When Alice was handed down, patent trolls were on the rise: shadowy entities that bought vague patents to sue tech companies on shaky claims of patent infringement.
That changed under the 2014 ruling, which requires that a patent clear two hurdles: the idea cannot be “abstract,” and it must propose a sufficiently “inventive concept.” The standard has become “a crucial tool” for fighting patent trolls, in the words of the Electronic Frontier Foundation.
But critics say it’s ill-suited to software patents. Because software inventions often rely on pre-existing hardware to run the source code, courts tend to find many of these patents to be insufficiently inventive.
Jon McMichael, an IP litigation partner at Fenwick who has written about Kohler’s case, said this challenge is common in patents where inventors rely on general-purpose computers and off-the-shelf hardware to implement their ideas.
“That’s where those patent holders run into more problems,” he said.
Experts say the courts’ application of Alice has broadened to invalidate the patents of real inventors in addition to those of patent trolls. Toshiko Takenaka, a University of Washington IP law professor who is working on an academic paper about Kohler’s case, said Alice’s ability to quickly defeat bad actors comes “at the expense of the best inventors.”
“Software patents are too frequently being invalidated without giving the owner the opportunity to defend it,” Takenaka said. “This inventor provided something ordinary computers could not do, right? So therefore, in my view, this is an eligible invention.”
Some judges have raised similar concerns, including Federal Circuit Chief Judge Kimberly Moore, who authored the opinion affirming the dismissal of Kohler’s case. In a 2020 concurrence in a separate case, Moore wrote that she and her fellow judges were “unanimous in our unprecedented plea for guidance” from the Supreme Court on how to interpret Alice, which she called a “patent-killing judicial exception of our own creation.”
After filing his patent, Kohler spent more than 15 years at Microsoft, where he helped launch HoloLens and rose to senior director of product management for the Surface line. He later served as a product leader at Meta for its Horizon platform.
Kohler says he’s hopeful the Supreme Court will agree to hear his case because his petition takes a new approach, asking the court to clarify how to apply the Alice test rather than disputing the test entirely. His new attorney, Kathryn Jean Miller, who does not have prior patent law experience, was admitted to practice before the Supreme Court bar for this case.
“It’s me and my lawyer against the world,” Kohler said. “I never thought I would be doing something like this.”
The Supreme Court has declined more than 89 petitions related to Alice, some of which had the Solicitor General’s endorsement. The justices will decide on Sept. 28 whether to hear Kohler’s case and likely announce their decision the following week.
Kohler is hoping that other inventors will file amicus briefs, which are due by Sept. 23, to illustrate to the court the need for clarification.
“There’s a broad coalition of people who would like some sanity brought back to patent law, from small inventors and startups to former judges,” Kohler said. “That’s what I’m trying to do with my petition.”
The Vulnerability Apple fixed a major security vulnerability in their image handling framework for both desktop and mobile devices on August 18, 2026. The vulnerability, which is tracked as CVE-2026-65346,...
The post Dangerous Apple Bug Lets Images Execute Malicious Code appeared first on Cyber Defense Magazine.
Critical Flaw Disclosed in Building Automation System A serious vulnerability in Johnson Controls’ Metasys building automation technology was reported in an industrial security alert (ICSA-26-225-14) released by CISA on August...
The post CISA Warns of Critical Flaw in Johnson Controls Metasys Systems appeared first on Cyber Defense Magazine.
OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The project quickly became popular with users because of its flexibility and ability to solve fairly complex tasks that previously required a lot of time for automation and execution. A dedicated marketplace appeared quickly after the project started gaining traction, where developers and users began publishing tools that integrate with OpenClaw. Currently, employees all over the world use OpenClaw to automate their tasks, often unaware of risks this practice introduces to them and their employers.
In this article we will examine several security aspects of OpenClaw, look at how attackers can target this system, which vulnerabilities are already known, and how to protect your organization against these issues.
The project’s success was ensured by the fact that the agent accepts natural language instructions, does not require knowledge of programming languages, and allows the use of skills, which expand its capabilities. The overall architecture of OpenClaw can be seen below:
The OpenClaw overall architecture
As shown in the diagram, the system is designed to be used with agent skills. These skills can reside locally on the system where the agent is installed or they can be obtained from external sources. At the time of writing this article, a dedicated hub named “ClawHub” is used for sharing skills with other users.
One of the key features of OpenClaw skills is that they are easy to create and do not require coding. A skill is in essence a set of commands written in natural language, although it can contain code. Currently, there is a general description of the skill format: it is usually a text file named SKILL.md, although more complex variants may exist. The primary requirement for these files is that they use a plaintext format. To illustrate what this looks like, here is a fragment of a skill:
Openclaw skill example
The applications for OpenClaw skills are quite broad and can include everyday tasks like checking email, performing routine operations and calculations on a computer, as well as more complex pipelines that handle testing, research, or software development. For most actions, the agent requires access to the operating system’s file system, as well as to the tokens and keys of the systems it will interact with. All necessary data are usually provided by users either through environment variables or in plaintext files located alongside the agent.
Since many skills enable automation of work processes, employees worldwide actively use them. This fact, combined with the widespread adoption of the system and the overall popularity of artificial‑intelligence technologies, has attracted attackers to the project.
In less than two years, around 530 vulnerabilities have been discovered both in OpenClaw itself and in the underlying technologies. That said, the publication of OpenClaw vulnerabilities in the CVE database began only in February 2026. Below is a breakdown of these vulnerabilities by severity.
As shown in the chart, the number of high-severity vulnerabilities is quite large. Most of these vulnerabilities fundamentally involve issues with storing sensitive data and operating with excessively high privileges. Each of them can be exploited to hijack the agent or inject commands that it will execute.
Besides exploiting vulnerabilities and deceiving users, there are more specific attack vectors against OpenClaw, namely, skills.
Research logically draws a parallel between supply‑chain attacks and the distribution of malicious skills. However, unlike usual supply-chain attacks, creating malicious skills is trivial because there is no longer a need to develop custom malware. Despite this, until February 7, 2026, no skills had undergone even a basic security check, which allowed malicious skills to appear immediately. Our scan of the skill hub in April identified 24 accounts that were distributing more than 600 malicious skills. Overall, open‑source intelligence indicates that over 1100 malicious accounts have been created since January.
Following the investigations and a lengthy effort to clean the skill repository of malicious entries, it was announced that files would undergo preliminary scanning with VirusTotal (VT) and NVIDIA’s SkillSpector. On the one hand, this is a more responsible approach to publishing skills; on the other, because OpenClaw is primarily an agent that executes a set of instructions, detecting malicious activity moves to a different level. Now it is necessary not only to analyze a file for dangerous commands that should be blocked, but also to examine all possible malicious behaviors that could be triggered by a harmful instruction within a skill. An example of a malicious command in natural language:
Example of a malicious command within a skill action
An example of a malicious command using a part of a bash command:
Malicious command inside a skill
The example in the image and similar malicious skills are detected by Kaspersky products as HEUR:Trojan.ANSI.MalClaw.gen.
In addition, Kaspersky products monitor malicious OpenClaw skill activity on the system. Below are detection statistics from our systems that have identified malicious OpenClaw client behavior. The data for June cover the first half of the month.
As shown in the chart, even despite the measures taken to counter the publication of malicious skills, attacks continue. Therefore, it is important to employ layered protection that isolates the OpenClaw agent from critical data and infrastructure systems. We also recommend checking all skills that enter the organization’s perimeter. For this purpose, Kaspersky Scan Engine is suitable. This solution is designed to protect web applications, proxy servers, network attached storage, and mail gateways. It can be integrated into almost any application, and it is easy to deploy and manage.
Malicious skill detected by Scan Engine
Additionally, monitor network accesses used by the agent. For this purpose, the project already provides a sandboxing subsystem and various wrappers for working with APIs and services. Last but not least, develop a comprehensive AI policy and make sure your employees never use third-party tools that they are not explicitly allowed to use.
Login