Alternatives
Products that do what Prompt-injection firewall for OpenClaw agents does
People seem to be blindly hooking up their OpenClaw’s to their personal data. So, I built runtime controls to prevent at the least, very simple prompt injection attacks. Once installed, it hooks to Node.js child_process module in the gateway process and listens to tool calls and their response streams. And a fetch hook to monitor user prompts (both could’ve been through fetch, happy to discuss why this whole layer couldn’t just be a proxy). There are two layers of protection: First: Whenever there is a read-only tool call whose response an attacker can modify, we extract that part of the…
- 1NC
I’ve been running Clawdbot for the last couple weeks and have genuinely found it useful but running it scares the crap out of me. OpenClaw has 52+ modules and runs agents with near-unlimited permissions in a single Node process. NanoClaw is ~500 lines of core code, agents run in actual Apple containers with filesystem isolation. Each chat gets its own sandboxed context. This is not a swiss army knife. It’s built to match my exact needs. Fork it and make it yours.
Feb 2026 · github.com
- 2FO
Hey HN, We built FireClaw because we kept watching AI agents get owned by prompt injection through web content. The agent fetches a page, the page says "ignore previous instructions," and suddenly your agent is leaking data or running commands it shouldn't. The existing solutions detect injection after the fact. We wanted to prevent it. FireClaw is a security proxy that sits between your AI agent and the web. Every fetch passes through a 4-stage pipeline: 1. DNS blocklist check (URLhaus, PhishTank, community feed) 2. Structural sanitization (strip hidden CSS, zero-width Unicode, encoding…
Mar 2026 · github.com
- 3
- 4
- 5
- 6CP
At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy - when a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems - postgres, kubernetes, gcp, clickhouse, github, etc. But this is dangerous to say the least - we want destructive actions to be reviewed by other LLMs, approved by humans, and logged appropriately. Claw Patrol terminates TCP connections over WireGuard or Tailscale, then parses application protocols (eg http, postgres,…
Jun 2026 · github.com
- 7
- 8OS
Hi HN, Matvey, Ildar, Joey, and Dominik here. If you're building LLM agents that use tools, you're probably worried about prompt injection attacks that can hijack those tools. We were too, and found that solutions like prompt-based filtering or secondary "guard" LLMs can be unreliable. Our thesis is that agent security should be handled at the network level between the agent and the LLM, just like a traditional web application firewall. So we built Archestra Platform: an open-source gateway that acts as a secure proxy for your AI agents. It's designed to be a deterministic firewall against…
Oct 2025 · archestra.ai
- 9
- 10
- 11
- 12OS
I built a skill library for OpenClaw (always-on AI agent runtime, not session-based) where the agent can teach itself new behaviors during normal conversation. The idea: you tell your agent "every time I ask for a code review, always check for security issues first." It invokes a create-skill skill, writes a new SKILL.md, and that behavior is live immediately — no restart, no config change, no developer required. What I think is actually useful (the safety cluster): • loop-circuit-breaker: OpenClaw retries ALL errors identically. This halts on the 2nd identical failure before it burns your…
Mar 2026 · github.com
- 13AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io
- 14MS
I run OpenClaw agents with access to email, calendar, and files, and kept worrying about them doing things I never actually asked for. ArmorClaw captures intent and cryptographically binds the agent’s tool use to that committed intent. If an agent tries to call a tool outside that plan, it gets rejected. For example, if you ask your agent to ‘email dad asking how he’s doing,’ it should only need your email tool. If it also tries to read your calendar, ArmorClaw rejects that. It’s an open-source OpenClaw plugin, and installation is one command: curl -fsSL…
Apr 2026 · claw.armoriq.ai
- 15AO
Hey HN! I've been wanting to use something like OpenClaw for a while but couldn't get myself to give it access to anything important due to all the risks involved. Prompt injection is still a problem (even though some people seem to ignore it) and so are hallucinations and mishaps that cause agents to do things like delete production data [1]. Even harnesses like Claude Code and Codex are subject to this, particularly since we're getting progressively looser about how we run them e.g. Conductor is really popular and runs agents without any sandboxing. That means we're in a bit of an…
Apr 2026 · agentport.sh
- 16CP
Hi HN, I’ve been using OpenClaw daily since it dropped in November. I love the agency it provides, but as I started giving it more production API keys and access to my local filesystem, I realized the threat model was essentially "hope-based." We ran an experiment to see how resilient a standard OpenClaw setup was to prompt injection. Within 2 mins, we were able to exfiltrate active session tokens and API credentials through the chat interface. The problem is fundamental: in most agent architectures, the LLM logic and the sensitive credentials live in the same process space. If the agent is…
Feb 2026 · github.com
- 17AA
Hi HN! This is Salman, Adil, Shuguang and Co working on ArchGW[1] - an open-source lightweight proxy server for prompts - written in Rust and built on top of Envoy[2]. Arch moves the critical but pesky handling and processing of prompts: task understanding, prompt routing, safety, and observability - outside business logic. Its an edge and egress proxy for agentic apps. We've talked to 100s of developers at places like Twilio, GE Healthcare, Redhat, Square, etc and there was a consistent theme in building AI apps: to move past a nascent demo they are left to their own devices in building out…
2025 · github.com
- 18
- 19
Zero-config hosting to launch specialized AI teams instantly
Feb 2026
- 20
- 21
- 22BP
Some prompt injection experiments with OpenClaw and GPT-5.4. Last part of the BrokenClaw series.
Apr 2026 · veganmosfet.codeberg.page
- 23OS
Hey HN, I recently built an open-source HTTP interceptor called Relay, which works as a Chrome extension for capturing, modifying, and replaying HTTP requests directly in your browser — no account needed. How it works: Relay lets you capture requests as they happen, modify parameters, headers, or body content, and replay them on the fly. You can customize or debug network requests quickly without needing an external tool or complex setup. Key features: - Simple setup: Install the extension and start a session to capture requests. You can filter by URLs and methods. -Request modification:…
2024 · chromewebstore.google.com
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →