Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

What it claims

NemoClaw is NVIDIA's open-source wrapper, built with Peter Steinberger, that runs autonomous agents (OpenClaw, Hermes, LangChain Deep Agents) inside OpenShell sandboxes. Its purpose is to stop a compromised agent from touching host files, stealing SSH keys or gaining local privileges. The page grounds the risk in two figures: 543 tracked OpenClaw CVEs and more than 40,000 publicly reachable instances. The exposure detail matters for anyone already running OpenClaw. Many of those instances bind to 0.0.0.0 with authentication disabled by default, or serve over unencrypted HTTP.

How it works

• Sandbox plus policy. OpenShell combines kernel-level sandbox runtime controls with a declarative YAML policy covering files, credentials and network egress.
• What the CLI handles. The NemoClaw CLI and its per-agent aliases cover onboarding, managed inference, network policy, managed integrations and lifecycle operations.
• Filesystem confinement. In the demo, the agent can list its workspace but cannot read or write outside /sandbox and /tmp.
• Migration. NemoClaw can detect an existing host-level OpenClaw install and migrate its state into a sandbox. The tutorial does not demonstrate this; it installs from scratch.

How to use it

Prerequisites are Docker and Node.js. Install with:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

This pipes a remote script straight into the shell. Review the script before running it on a machine you care about.

The wizard then walks through these steps:

1. Accept the third-party software notice.
2. Choose the agent (OpenClaw in the tutorial).
3. Choose an inference provider and model, and enter its credentials.
4. Accept the default sandbox name my-assistant.
5. Accept the suggested network policy tier.

To connect and open the terminal UI (a web mode also exists):

nemoclaw my-assistant connect
openclaw tui

The first command runs on the host. The second runs at the sandbox> prompt.

Evidence

The only deployment evidence is the Cisco/NVIDIA case study:

• An agent maps network device configurations into a live knowledge graph.
• It assesses new zero-days against that graph and produces prioritised remediation plans.
• OpenShell supplies restricted endpoints and local privacy routers.
• Cisco AI Defense monitors MCP calls. It caught a simulated secret-exfiltration attempt hidden in a third-party reporting skill.

The page gives no metrics. It notes that major public case studies "are still emerging."

Limits

• Not a fix for agent flaws. A zero-day RCE in OpenClaw itself still gets an attacker in. Escape becomes possible if runtime settings are misconfigured or the agent's logic is directly compromised.
• The sandbox can fail too. OpenShell and similar runtimes have had escape, namespace and privilege-escalation bugs that could expose the host kernel.
• The author's own advice. Keep the wrapper updated and cut unnecessary network and tool permissions.
• Missing content. The OpenClaw vs NemoClaw comparison table and the installer's output were images and are not in the fetched text.
• Unchecked claims. The page does not source the CVE and exposure figures.