ClawShell, Process-Level Isolation for OpenClaw Credentials
Hi HN, I’ve been using OpenClaw daily since it dropped in November. I love the agency it provides, but as I started giving it more production API keys and access to my local filesystem, I realized the threat model was essentially "hope-based." We ran an experiment to see how resilient a standard OpenClaw setup was to prompt injection. Within 2 mins, we were able to exfiltrate active session tokens and API credentials through the chat interface. The problem is fundamental: in most agent architectures, the LLM logic and the sensitive credentials live in the same process space. If the agent is…
In plain words
ClawShell is a security isolation tool for OpenClaw that moves credentials and sensitive operations into a separate process space, protected by OS-level enforcement. It addresses the vulnerability where prompt injection attacks can exfiltrate API keys and session tokens from standard setups by separating the LLM logic from access to sensitive credentials. Designed for developers using OpenClaw with production API keys and local filesystem access, ClawShell acts as a privileged protection layer to contain the damage from compromised agents or malicious prompts.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
Hi HN, I’ve been using OpenClaw daily since it dropped in November. I love the agency it provides, but as I started giving it more production API keys and access to my local filesystem, I realized the threat model was essentially "hope-based." We ran an experiment to see how resilient a standard OpenClaw setup was to prompt injection. Within 2 mins, we were able to exfiltrate active session tokens and API credentials through the chat interface. The problem is fundamental: in most agent architectures, the LLM logic and the sensitive credentials live in the same process space. If the agent is tricked, the attacker has everything. We built and open-sourced a project called ClawShell to move the security boundary from the "prompt" to the "system runtime." How it works: ClawShell acts as a privileged protection layer. It isolates sensitive operations into a separate process enforced by the OS. The secrets never enter the agent’s memory or process space. When the agent needs to perform an action, it sends a request to the ClawShell wrapper, which validates the intent and executes the call using the protected keys. If the agent is hijacked via prompt injection, the attacker gets a scoped identifier that contains zero credentials and no lateral access to the sensitive environment. Key Technical Details: * Structural Boundaries: We assume the LLM is untrusted. Isolation is handled at the OS level, not via "system prompts." * Zero-Trust Tooling: The agent triggers the tool, but the tool execution is handled by a separate, restricted process. * Compatibility: It’s designed to be a drop-in wrapper for existing OpenClaw instances. We’re launching v0.1 today. I’m curious to hear how others are thinking about the "Lethal Trifecta" (Data + Action + Communication) in the agent space. Is anyone else looking at Sanboxing for this, or is OS-level isolation the right path?
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 17d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 27d ago · cactuscompute.com
