Has the solution to 99% of OpenClaw's security problems been found?
Experts from Echo and NanoCo have introduced a solution to drastically reduce vulnerabilities in OpenClaw. The method ensures transparent protection without requiring users to change their habits.
How can the number of vulnerabilities in OpenClaw be drastically reduced in a transparent manner and without requiring the user to change their habits?
By Eilam Milner, CTO at Echo, and Gabriel Cohen, CEO of NanoCo
The growing popularity of OpenClaw has significantly expanded the scope of AI agent usage, but it has also raised serious security questions about what happens when they are given access to our tools and systems. Reports from many users have revealed that the agents do not always act in accordance with the user's intent, and have exposed critical security issues. For example, cases where OpenClaw agents were installed with malware, deleted email boxes, and performed incorrect financial transactions.
The open-source project NanoClaw was built as a response to these problems, and it operates according to several security principles: the agents run in isolation from the endpoint (in what is called Sandboxing), they are not exposed to access keys, and the user has full ability to define policies — what the agent is allowed to do independently and what requires approval.
A new collaboration between NanoCo and the company Echo takes the security concept a step further — and also cleans the tools and libraries used by the agent of security vulnerabilities. From now on, agents can run in an environment free of vulnerabilities. How does this solution work?
Fixing the car while driving
Every software company encounters security vulnerabilities (CVEs) in open-source libraries. The solution to these vulnerabilities relies on a global community of volunteers called Maintainers. The entire process — from the moment the fix is found by the Maintainers until its implementation in the end organization — takes on average about 180 days. Echo's solution shortens the process to 24 hours from the moment the fix is published until it is in use in production work environments.
This brings us to the NanoClaw runtime environment, which includes a wide collection of open-source libraries — among them Chromium, Node.js, Bun, pnpm, Corepack, Git, curl, and unzip. Each of these packages contains dozens of security vulnerabilities.
The collaboration between the two Israeli companies is intended to answer the question: how can the number of vulnerabilities be drastically reduced, in a transparent manner and without requiring the user to change the tasks, habits, or the way the agent is operated?
The main challenge: vulnerabilities marked as Won't fix
As part of the collaboration, we at Echo rebuilt the NanoClaw Container Image in a hardened way — clean of 99% of existing security vulnerabilities.
The process starts with scanning the NanoClaw environment using several independent vulnerability scanners, including Trivy, Grype, and Wiz. The use of multiple tools gives us a more complete and reliable picture, because each scanner relies on slightly different databases and identification rules.
After mapping, we divided the findings into two groups: components that can be upgraded safely, and components that require research and individual work. Chromium, for example, could be updated with relative confidence, but even after removing the vulnerabilities associated with it, about 600 vulnerabilities remained that required further treatment.
The more complex challenge was vulnerabilities marked as Won't fix — those that distribution managers fix only in new versions that are not necessarily compatible with the version in use by end users. In these cases, we used Backporting: we took an official fix from a newer version of the package and adapted it to the version that NanoClaw depends on. The process is carried out using dedicated AI agents that specialize in finding fixes and adapting them. In every such fix, it is necessary to locate the correct Commit, ensure it is complete and safe, apply it without compromising compatibility, and verify that the vulnerability has indeed been closed.
The NanoClaw Dockerfile is based on Debian 12, and Echo's operating system is compatible with it — but with one fundamental difference: it is clean of vulnerabilities and constantly hardened by the company's agents. It is compatible with popular Upstream Distros such as Ubuntu, Debian, RHEL, and more, with the goal of enabling a transparent process for end users without code changes on their part.
After the scans and tests confirm that all available fixes have been applied, the Image is built and transferred to the Echo Store. From there, it is synchronized within minutes to the dedicated NanoClaw Registry. The process does not end with the first publication: the Image continues to be monitored, and when new fixes become available, it is updated and republished.
Two security layers that complement each other
At the end of the process, we managed to reduce the number of CVEs by about 99%.
The connection between the two solutions creates protection in two layers. The first layer protects the workstation by allowing the agent to run in a separate work environment (the Sandbox). The second layer hardens the tools used by the agent, and thus reduces the possibility that an attacker will exploit the browser, library, or system tool to penetrate its environment.
Neither layer replaces the other. A hardened environment without isolation still gives the agent too much freedom of action, and isolation without hardening leaves vulnerable components in the agent's environment that could turn an innocent site or file into an entry point to the organization. As AI agents receive more responsibility, it is no longer enough to ask what they are allowed to do. One must also check what they are running on and who maintains these tools.
