Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

What it is

NemoClaw is NVIDIA's open-source wrapper that runs OpenClaw agents inside OpenShell sandboxes. OpenShell is an open-source runtime that applies kernel-level isolation and a declarative YAML policy, so an agent doesn't get unrestricted access to local files, credentials, or external networks. The CLI handles onboarding, managed inference, network policy, managed integrations, and lifecycle operations. The page says it currently supports OpenClaw, Hermes, and LangChain Deep Agents.

Preconditions / Affected

• Docker and Node.js must be installed before you start.
• The walkthrough runs on Kali.
• An existing host-level OpenClaw install can be auto-discovered, and its state migrated into a sandbox. The page doesn't show this path, because it installs from scratch.
• Exposure motivating the tool: 543 tracked OpenClaw CVEs, and 40,000+ public instances, many bound to 0.0.0.0 with auth disabled by default or served over plain HTTP.

What to do

Install (the page's command pipes a remote script into bash):

kali> curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

The wizard flow, as the page describes it:

1. Accept the third-party software notice.
2. Select OpenClaw as the agent.
3. Choose an inference provider and model, then supply its credentials.
4. Accept the default my-assistant sandbox name.
5. Accept the suggested network policy tier.

Test in the terminal UI:

kali> nemoclaw my-assistant connect
sandbox> openclaw tui

The page's check is that the agent lists its workspace but cannot read or write outside /sandbox and /tmp. A web mode also exists, but the page doesn't test it.

The page recommends keeping the wrapper and runtime updated and trimming unneeded network and tool permissions.

Caveats

• A zero-day RCE in OpenClaw can still be exploited. If runtime settings are misconfigured, or the agent's logic is directly compromised, an attacker could break out.
• OpenShell and similar container runtimes have had escape, namespace, and privilege-escalation bugs. A flaw in the sandbox runtime could let a compromised agent reach the host kernel.
• NemoClaw limits the damage, such as tampering with system files or stealing host SSH keys, but doesn't fix flaws in OpenClaw's core logic.
• The page says major public case studies are still emerging. The Cisco AI Defense plus OpenShell result (a simulated exfiltration through a third-party skill, caught before data left) is the only example given. It is a vendor case study, not an independent test.
• The page gives no policy YAML examples and no explanation of the network policy tiers, so you'd need the NemoClaw/OpenShell docs to tune them.