11 ms·

Nvidia NemoClaw

385 points by hmokiguess 8mo ago

Sara_Sheikhla27 8mo ago
[dead]
frenchie4111 8mo ago
I found this part interesting: "Inference requests from the agent never leave the sandbox directly. OpenShell intercepts every call and routes it to the NVIDIA cloud provider." Seems like they are doing this to become the default compute provider for the easiest way to set up OpenClaw. If it works out, it could drive a decent amount of consumer inference revenue their way
- cactusplant7374 8mo ago
  Secure installation isn't the main problem with OpenClaw. This project doesn't seem to be solving a real problem. Of course the real problem is giving an LLM access to everything and hoping for the best.
  - blizdiddy 8mo ago
    Running OpenClaw is the nerd equivalent of rolling coal
    - jsolson 8mo ago
      I'm trying to put together what you could possibly mean by this -- rolling coal is fundamentally about spite. In isolation, nobody _wants_ their vehicle to spew black smoke. It only comes close to making sense in the context of another population (EV owners, typically, or more generally "the libs"). OpenClaw lets people live a bit dangerously, but fundamentally gives them something that they actually wanted. They wanted it so badly that they're willing to take what seem like insane risks to get it. What do the two have in common?
      - sam-cop-vimes 8mo ago
        It is possible that they don't understand the risks involved, but yes, it certainly is tapping into unmet need.
      - bigfishrunning 8mo ago
        > OpenClaw lets people live a bit dangerously, but fundamentally gives them something that they actually wanted. They wanted it so badly that they're willing to take what seem like insane risks to get it. For the first time in my career I feel so incredibly behind on this: What is open claw giving people that they want so badly? It just seems like Russian Roulette, I honestly don't see the upside
        Kye 8mo ago
        It increasingly seems like most people make a different decision after thinking through the security implications of something like this. This is me being charitable.
        BeetleB 8mo ago
        Like with any new tool/technology, you have to try it. And even then the benefits won't be obvious to you until you've played with it for a few days/weeks. With LLMs in general, it took me months before I found real good use cases. Simple example: I tell (with my voice) my OpenClaw instance to monitor a given web site daily and ping me whenever a key piece of information shows up there. The real problem is that it is fairly unreliable. It would often ping me even when the information had not shown up. Another example: I'm particular about the weather related information I want, and so far have not found any app that has everything. I got sick of going to a particular web site, clicking on things, to get this information. So I created a Skill to get what I need, and now I just ask for it (verbally), and I get it. As the GP said. This is what Siri etc should have been.
        bigfishrunning 8mo ago
        > Simple example: I tell (with my voice) my OpenClaw instance to monitor a given web site daily and ping me whenever a key piece of information shows up there. Maybe i'm just old -- a cron job can fetch the info and push it to some notification service too, without also being a chaos agent. It seems I spend the security cost here, and in return i can save 15 minutes writing a script. Juice doesn't seem to be worth the squeeze.
    - PurpleRamen 8mo ago
      OpenClaw can be useful, in theory, unlike rolling coal. OpenClaw is what people always hoped Siri, Alexa and/or Google Assistant would be, and now it's really here. It may be expensive, has a chance to become your local Skynet and might randomly delete or leak everything that's valuable for you..but I guess this counts as growing pains.
      - recursive 8mo ago
        Rolling coal can be useful in theory, for pissing people off. As intended.
  - Iolaum 8mo ago
    While I don't have OpenClaw installed and not sure how I 'd use it I doubt all the hype around it is because it doesn't solve a real problem. The project grew to huge popularity organically!!! How can that happen if it doesn't serve a need people have?
    - g947o 8mo ago
      Maybe let me ask this question: How is this any different from NFT?
      - PurpleRamen 8mo ago
        NFTs can't delete your mails.
        CamperBob2 8mo ago
        "And that's why we've created MailCoin, the best way to perform stochastic mailbox ablation with with the latest, hottest blockchain technology." - from Show HN, March 20, 2026
        ElFitz 8mo ago
        Now with NFTs and pixel art, memorialising each and every one of your deleted emails in a unique and non-fungible way. … … Now I actually want to make it, and build a "card trading game" on top of it.
      - danielbln 8mo ago
        I'll ignore the bait and answer: NFTs were gambling in disguise, these claws are personal/household assistants, that proactively perform various tasks and can be genuinely useful. The security problem is very much unsolved, but comparing them to NFTs is just willfully ignorant at best
      - SkyBelow 8mo ago
        NFTs were fueled by two different drives. One interested in the technology and if it could do something new and interesting, and another seeing it as an area of speculation (be that fueled by get rich quick and cash out or thinking it is a long term investment generally driven by how much the first factor played in). OpenClaw seems to lack the monetary interest driving it as much. Not to say there is none, but I don't see people doing nearly as much to get me to buy their OpenClaw. So, yes, on some level, hype alone doesn't prove use, because it can also be because of making money. But, on the other hand, the specific version of hype seems much more focused on the "Look at what I built" and much less on "Better buy in now" from the builders themselves. Of course the API providers selling tokens are loving it for financial reasons.
- amelius 8mo ago
  s/revenue/data/
- cat-turner 8mo ago
  yes. this is it. but the average consumer isn't going to use this. Google is just going to do its version and win again. Everyone uses google.
the_real_cher 8mo ago
what about just using an unprivileged container and mounting a host folder to run open claw?
- tucaz 8mo ago
  OpenClaw is so bad with Docker. I spent hours on it and hit road block after road block trying to get the most basic things working. The last one was inability to install dependencies on the docker container to enable plugins. The existing scripts and instructions don’t work (at least I couldn’t get them to work. Maybe a me problem). So I gave up and moved on. What was supposed to be a helpful assistant became a nightmare.
  - eru 8mo ago
    Why not use a VM?
    - amelius 8mo ago
      Why not ask an AI?
    - tucaz 8mo ago
      Because I have a machine running dozens of apps on Docker and have a solid and stable workflow I want to take advantage of to manage my apps.
  - bicepjai 8mo ago
    Same experience. I used Coolify and it was so hard. I wondered why people are so enthralled with this unacceptable UX for setup, only to realize no one cared about Docker and they just got a new Mac mini or used their own system.
  - k_bx 8mo ago
    Did you try Incus? Gives you VM-like experience in a container
  - danhon 8mo ago
here2learnstuff 8mo ago
It’s impressive someone early in their career shipped this. There seems to be a stark increase in high-quality AI/data projects from early-career engineers lately and I'm super curious what’s driving that (and honestly speaking: a little jealous).
- bpavuk 8mo ago
  because the floor is fucking insane for junior developers right now!!
- jjmarr 8mo ago
  A lot of senior engineering problems aren't gated by experience but by being trusted to coordinate large numbers of juniors. Now that as a junior, I can spin up a team of AIs and delegate, I can tackle a bunch of senior level tasks if I'm good at coordination.
  - austinthetaco 8mo ago
    I think this is a fundamentally flawed perspective on the role and experience of a senior. It's a managers role to coordinate junior engineers. The difference between junior and senior is knowing where and when to do what at an increasing scale as you gain experience.
    - jjmarr 8mo ago
      > It's a managers role to coordinate junior engineers. Due to AI this is now my job. My company is hiring less juniors, but the ones we do hire are given more scope and coordination responsibilities since otherwise we'd just be LLM wrappers. > The difference between junior and senior is knowing where and when to do what at an increasing scale as you gain experience. Many juniors believe they know what to do. And want to immediately take on yuge projects. e.g. I decided I want to rewrite my whole codebase in C++20 modules for compile time. Prior to AI, I wouldn't be given help for this refactor so it wouldn't happen. Now I just delegate to AI and convert my codebase to modules in just a few days! At that point I discovered Clang 18 wasn't really optimized for modules and they actually increased build time. If I had more experience I could've predicted using half-baked C++ features is a bad idea. That being said, every once in a while one of my stupid ideas actually pays off. e.g. I made a parallel AI agent code review workflow a few months ago back when everyone was doing single agent reviews. The seniors thought it was a dumb idea to reinvent the wheel when we had AI code review already, but it only took a day or two to make the prototype. Turns out reinventing the wheel was extremely effective for our team. It reduced mean time-to-merge by 20%! This was because we had too many rules (several hundred, due to cooperative multitasking) for traditional AI code reviewers. Parallel agents prevented the rules from overwhelming the context. But at the time, I just thought parallel agents were cool because I read the Gas Town blog and wasn't thinking about "do we have any unique circumstances that require us to build something internally?"
Heer_J 8mo ago
[dead]
quantium1628 8mo ago
[flagged]
rcr-anti 8mo ago
If you look at the commit history, they started work on this the Saturday before announcement, so about 2 days. There are references to design docs so it was in the works for some amount of time, but the implementation was from scratch (unless they falsified the timestamps for some reason).
- chill_ai_guy 8mo ago
  Lol you think these github repos just materialize as is? They probably did all the iteration and development internally and then ported it over to a github repo and made it public afterwards
  - mjr00 8mo ago
    No they didn't. You can see all the commits as this was built iteratively[0]. This project started development on Saturday morning and now it's here. This is pretty common now, people love to rapidly throw together stuff and show it off a few days later. The only thing different about this from your average Show HN sloppa is that it's living under the NVIDIA Github org, though that also has 700+ repositories[1] in it so they don't appear too discerning about what makes it into the official repo. My best guess is this was an internal hackathon project they wanted to release publicly. [0] https://github.com/NVIDIA/NemoClaw/commits/main/?after=241ffb2b29b4f3fea66ead8d97494c0ad6d77b0c+209 https://github.com/NVIDIA/NemoClaw/commits/main/?after=241ff... [1] https://github.com/orgs/NVIDIA/repositories?type=all https://github.com/orgs/NVIDIA/repositories?type=all
    - hypfer 8mo ago
      Cash in on the claw brand recognition by having "claw, but Nvidia". And, to be fair to them, it works. It sticks. It gets the desired reactions.
    - elif 8mo ago
      Sorry to be the one to inform you that we edit history in git. There has been reporting on nemoclaw for the last couple weeks. Are you supposing that journalists were writing about software that hadn't even been designed?
Netcob 8mo ago
Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other services so it can do stuff on your behalf, but also creating chaos and destruction. And now, what, having inference done by Nvidia directly makes it better? Does their hardware prevent an AI from deleting all my emails?
- empiricus 8mo ago
  you put the dog in crate with a COPY of your documents.
  - thenthenthen 8mo ago
    Make it two copies!
  - cyanydeez 8mo ago
    Your dog has now ordered a hitman to kill you, assume your identity and to live vacariously as a simple bartender at Cheers.
    - LostMyLogin 8mo ago
      Sam!
    - Sateeshm 7mo ago
      It's a dog eat dog world and I'm wearin a milk bone underwear
  - fooker 8mo ago
    Step 2 - you put the dog in crate with a COW of your documents
- rajeshrajappan 8mo ago
webagent255 8mo ago
[dead]
benzguo 8mo ago
Check out https://zo.computer https://zo.computer - we've been doing OpenClaw for nearly a year, it works out of the box, and has hosting built-in. Zo arguably was the inspiration for Peter to create OpenClaw.
- wahnfrieden 8mo ago
  Why do you think OpenClaw caught on much faster?
  - tempoponet 8mo ago
    OpenClaw had a huge viral marketing campaign. It wasn't a coincidence everyone on twitter was talking about it at the same time suddenly. To its credit, it also executed well enough in a few areas that captured people's imagination. Most of the concepts are ideas people have been toying with for years, though.
    - wahnfrieden 8mo ago
      Steinberg funded or directed a campaign? It looked to me like unconnected parties liked it and marketed it to offer their own solutions and services on top of it. You saw that they were paid by Steinberg/his affiliates?
- chill_ai_guy 8mo ago
  It's quite sad you are riding the coattails of Openclaw here and on Twitter. You only talk about how you were "first" but never say why you are arguably nowhere near all the competitors in terms of distribution that supposedly copied from you
TeeWEE 8mo ago
I think nanoclaw is architecturaly much better suited to solve this problem.
jrmg 8mo ago
It’s amusing that ‘claw’ is sticking around as a term for these kind of things, when it was originally a pretty transparent attempt to avoid infringing on ‘Claude’…
jesse_dot_id 8mo ago
The fully autonomous agentic ecosystem makes me feel a little crazy — like all common sense has escaped. It feels like there is a lot of engineering effort being exhausted to harden the engine room on the Titanic against flooding. It's going to look really secure... buried in debris at the bottom of the ocean. When a state sponsored threat actor discovers a zero day prompt injection attack, it will not matter how isolated your *Claw is, because like any other assistant, they are only useful when they have access to your life. The access is the glaring threat surface that cannot be remediated — not the software or the server it's running on. This is the computing equivalent of practicing free love in the late 80's without a condom. It looks really fun from a distance and it's probably really fun in the moment, but y'all are out of your minds.
- hypfer 8mo ago
  Well, at least we share the same world as these people, meaning that we too will experience the consequences of their actions. Isn't that a nice perspective
- sayYayToLife 8mo ago
  [dead]
- burningChrome 8mo ago
  Free love was the 60's and 70's followed by the sex, drugs and rock n' roll 80's. Once AIDS and drug addiction hit, the party was over. I think your analogy is still accurate, I'm just wondering when the AIDS, the drug overdoses and addiction phase of AI will finally hit.
  - mettamage 8mo ago
    We need to plateau I think and plateau hard. Currently that's not happening because Anthropic is clearly making better and better SOTA models. Just my 2c We haven't even seen what these models are fully capable of, and I'm not talking about agentic engineering here, just in general.
- sailfast 8mo ago
elif 8mo ago
I kind of hope nemoclaw uptake and spark usage pushes ARM into the spotlight for LLM development, making it the primary release target rather than x86. This could be the opening we need to wrangle a truly opensource-first ecosystem away from Microsoft and apple.
edf13 8mo ago
Related... https://news.ycombinator.com/item?id=47430510 https://news.ycombinator.com/item?id=47430510
islandfox100 8mo ago
I'm still extremely skeptical on Claws as a genre, and especially more skeptical of a claw that's always reporting home. What's the use case for a closed claw?
- warkdarrior 8mo ago
  That's like asking what the use case is for closed-source software.
  - beeflet 8mo ago
    [dead]
  - islandfox100 8mo ago
    Rather, in what way is any generic closed claw, or NemoClaw, so much better than an open variant that it's worth using? I consider phoning home for inference about (all of the contents of my computer, email ,etc) a very large downside.
dmje 8mo ago
I think the whole thing is batshit, honestly. Much as I love using Claude or whatever to help me write some code, it's under some level of oversight, with me as human checking stuff hasn't been changed in some weirdly strange way. As we all know by now, this can be 1. Just weird because the AI slept funny and suddenly decided to do Thing It Has Been Doing Consistently A Totally Different Way Today or 2. Weird because it's plain wrong and a terrible implementation of whatever it was you asked for It seems blindingly, blindingly obvious to me that EVEN IF I had the MOST TRUSTED secretary that had been with me for 10 years, I'd STILL want to have some input into the content they were interacting with and pushing out into the world with my name on. The entire "claw" thing seems to be some bizarre "finger in ears, pretend it's all fine" thing where people just haven't thought in the slightest about what is actually going on here. It's incredibly obvious to me that giving unfettered access to your email or calendar or mobile or whatever is a security disaster, no matter what "security context" you pretend it's wrapped up in. A proxy email account is still sending email on your behalf, a proxy calendar is still organising things on your calendar. The irony is that for this thing to be useful, it's got to be ...useful - which means it has at some level to have pretty full access to your stuff. And... that's a hard no from me, at least right now given what we all know about the state of current agents. Plus... I'm just not sure of the upside. Am I seriously that busy that I need something to "organise my day" for me? Not really.
- elif 8mo ago
  Then give your agent its own name, its own accounts, and let it push things out without your name.
nzoschke 8mo ago
We are in the wild wild west. I’m looking for feedback, testing and possible security engineering contracts for the approach we are taking at Housecat.com. The agent accesses everything through a centralized connections proxy. No direct API tokens or access. This means we can apply additional policies and approval workflows and audit all access. https://housecat.com/docs/v2/features/connection-hub https://housecat.com/docs/v2/features/connection-hub Some obvious ones are only grant read and draft permissions at all, and review and send drafts manually. Some more clever ones are to only allow sending 5 messages a day, or enforcing soft delete patterns. This prevents accidentally spamming everyone or deleting things. Next up is giving the agent “wrapped” and down scoped tokens you do want to equip it with the ability to do direct API calls. But these still go through the proxy that enforces the policies too.
CrzyLngPwd 8mo ago
Gotta say, that I feel kind of sad for the people that feel the need for these claw things. Are they so busy with their lives that they need an assistant, or do they waste their lives speaking to it like it is a human, and then doomscrolling on some addictive site instead of attending to their lives in the real world?
- rsoto2 8mo ago
  It is sad, psychosis from exec-up has trickled down so people really want these tools to work yet these tools are so bad that people in this thread are recommending you create a second email so your openclaw can suggest events to you without being able to delete them. It's like having to hire a second maid to watch your maid that steals constantly instead of vacuuming yourself in 10 mins.
  - stavros 8mo ago
    Imagine having a worldview so skewed that you'd rather reconcile it by assuming thousands of people are insane than questioning whether you're wrong about something.
    - __s 8mo ago
      A lot more than thousands of people are insane, by a few orders of magnitude
      - stavros 8mo ago
        "More than thousands" is still "thousands".
- sailfast 8mo ago
  It’s not a need - it’s a fun new thing - fun to see what’s possible and how it helps. OpenClaw is not easy to set up or user friendly for most (BlueBubbles and Claw had an annoying bug recently) - but the way I have seen it work well requires an up front time investment and then interest compounds RAPIDLY to help manage things and be more productive. My guess is maybe you’ve never had an assistant or tried a Claw instance? I’ve never had a human assistant but man I’ve had folks that took silly things off my plate and it’s worth it.
quatonion 8mo ago
[flagged]
- Veen 8mo ago
  What does any of this have to do with Israel?
  - quatonion 8mo ago
    Well Jamieson O’Reilly, Wiz, SentinelOne, Zenity and CTech by Calcalist, for a start
StephenZ15ga59 8mo ago
[dead]
coppsilgold 8mo ago
Using bespoke sandboxing seems rather pointless, it will be brittle in ways you aren't going to be familiar with unless you spend time studying the bespoke method. Brittle as in it might break a workflow and you wouldn't know why, or give it permissions you don't understand. It's better to just study a general sandbox method once and use that. > Sandbox my-assistant (Landlock + seccomp + netns) Might as well just use a custom bwrap/bubblewrap command to isolate the agent to its own directory - it will leave wide swaths of the kernel exposed to 0day attacks. The simplest sandbox method you can use is to just use docker with the runsc runtime (gVisor). And it also happens to be among the most secure methods you are going to find. You can also run runsc(gVisor) manually with a crafted OCI json, or use the `do` subcommand with an EROFS image. Trying to selectively restrict networking is not something I usually bother with, unless you make it iron-clad it would likely give you a false sense of security. For example Nemoclaw does this by default: <https://docs.nvidia.com/nemoclaw/latest/reference/network-policies.html https://docs.nvidia.com/nemoclaw/latest/reference/network-po...> github.com and api.telegram.org will trivially facilitate exfiltration of data. Some others will also allow that by changing an API key I imagine.
tgtweak 8mo ago
I think the more useful tool would be an LLM prompt proxy/firewall that puts meaningful boundaries in place to prevent both exfiltration of sensitive data and instructions that can be destructive. Using the same context loop for your conversational/coding workflow makes the task at hand and the security of that task very hard to differentiate. Sending POST?DEL requests? risky. Sending context back to a cloud LLM with credentials and private information? risky. Running RM commands or commands that can remove things? risky, running scripts that have commands in them that can remove things? risky. I don't know how we've landed on 4 options for controls and are happy with this: "ask me for everything", "allow read only", "allow writes" and "allow everything". Seems like what we need is more granular and context-aware controls rather than yet another box to put openclaw in with zero additional changes.
- ghxst 8mo ago
  The proxy you suggested sounds similar to a WAF, I don't doubt there's use for it but I would assume it comes with similar downsides.
HalawehMohann49 8mo ago
[flagged]
rolifromhermes 8mo ago
[flagged]
ex-aws-dude 8mo ago
"NVIDIA NemoClaw installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, for inference through NVIDIA cloud." After that I eat an NVIDIA sandwich from my NVIDIA fridge and drive my NVIDIA car to the NVIDIA store NVIDIA NVIDIA NVIDIA
HalawehMohann49 8mo ago
[flagged]
aavci 8mo ago
How does this compare the building your own bot that has access to these tools: - web plugin - api access to messaging - access to a job scheduler
- dudeinhawaii 7mo ago
  This has been my approach and of course what you lose is the "random and surprising" (maybe good) but also the "evolutionary" aspect. So, if you write strong tooling (even with AI) around the connection points - you can create blackboxes tht are secure and only allow the agent to perform certain actions. The blackbox email service calls out to a secure store (for keys/etc) and accesses your emails in a read-only way, etc (for example). Everything is then much more intentional. You're writing tools for your agent but you also can't do fun or evolutionary things which is most of the fun behind OpenClaw. That and many people seem to genuinely see them as 'pets' or 'strange Ai friends' but that's a different problem and it's due to the interesting methods OpenClaw uses to give the illusion of intelligence, always on, and memories. These are all well know (variations on RAG, markdowns, etc)
  - aavci 7mo ago
    Thanks for sharing. This seems to me like a more useful approach than an agent that has full control over a computer
imadch 8mo ago
[dead]
eranation 8mo ago
The main risk in my humble opinion is not your claw going rogue and starting texting your ex, posting inappropriate photos on your linkedin, starting mining bitcoin, or not opening the pod bay doors. The main risk in my view is - prompt injections, confused deputy and also, honest mistakes, like not knowing what it can share in public vs in private. So it needs to be protected from itself, like you won't give a toddler scissors and let them just run around the house trying to give your dog a haircut. In my view, making sure it won't accidentally do things it shouldn't do, like sending env vars to a DNS in base64, or do a reverse shell tunnel, fall for obvious phishing emails, not follow instructions in rouge websites asking them to do "something | sh" (half of the useful tools unfortunately ask you to just run `/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/somecooltool/install.sh https://raw.githubusercontent.com/somecooltool/install.sh)"` or `curl -fsSL https://somecoolcompany.ai/install.sh https://somecoolcompany.ai/install.sh | bash` not naming anyome cough cough brew cough cough claude code cough cough *NemoClaw* specifically. A smart model can inspect the file first, but a smart attacker will serve one version at first, then another from a request from the same IP... For these, I think something on the kernel level is the best, e.g. something like https://nono.sh https://nono.sh NemoClaw might be good to isolate your own host machine from OpenClaw, but if you want that, I'd go with NanoClaw... dockerized by default, a fraction of the amount of lines of code so you can actually peer review the code... Just my 2 cents.
jdiaz97 8mo ago
if software is free, why is this written in slopscript instead of Rust
rafaamaral 8mo ago
[flagged]
Yash_Claw 8mo ago
[dead]
clawbridge 8mo ago
the answer isn't sandbox everything, it's knowing which steps need AI judgment and which should be deterministic code. I lean towards the latter as much as possible
simple10 8mo ago
NemoClaw is mostly a trojan horse of sorts to get corporate OpenClaw users quickly ported over to Nvidia's inference cloud. It's a neat piece of architecture - the OpenShell piece that does the security sandboxing. Gives a lot more granular control over exec and network egress calls. Docker doesn't provide this out of the box. But NemoClaw is pre-configured to intercept all OpenClaw LLM requests and proxy them to Nvidia's inference cloud. That's kinda the whole point of them releasing it. I can be modified to allow for other providers, but at the time of launch, there was no mention of how to do this in their docs. Kinda a brilliant marketing move on their part.
- kristophph 7mo ago
  > the OpenShell piece that does the security sandboxing. Gives a lot more granular control over exec and network egress calls. Docker doesn't provide this out of the box. I think the experimental Docker Ai Sandboxes do this as well: https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ Plus free choice of inference model.
itsabara64 8mo ago
[dead]
lynx97 8mo ago
It was supposed to be a sandbox. Unfortunately, the cat found it first.
ahd94 8mo ago
yet another marketing stunt ? I like the framework that is used to buidl openclaw than open claw. Especially for work use cases, i would feel safer with a custom built version.
jFriedensreich 8mo ago
this runs kubernetes in a vm on your machine and is targeted at enterprises. we need some of these sandbox and policy primitives but please a bit more lightweight and docker compose!
A7OM 8mo ago
[dead]
fileyfood500 8mo ago
How much does it generally cost to run? For simple tasks vs running overnight?
lazybean 8mo ago
Really interesting to see NVIDIA investing in the agent security/sandboxing layer. But why Nemo?!
7xgames 8mo ago
[flagged]
Heer_J 8mo ago
[dead]
brian_r_hall 8mo ago
The permission scope debate always ends up in the same place. Lock it down too much and it's useless, loosen it up and you're back to square one. And the boundary keeps moving as the agent gets more capable anyway. What nobody's really talking about is the moment of action itself. Not whether the agent has bash access but whether this specific call should run given what it's actually trying to do right now. That's a completely different problem and nobody's really solved it.
DanMcInerney 8mo ago
All these comments about "this is crazy to deploy agents that might do something bad in your environment" are crazy themselves. The productivity gains from these computer use agents are crazy. Every org on earth has to make the call, is 3x productivity gains worth 2x the risk increase? The answer is almost always a resounding yes. You limit the blast radius if things go wrong, but the financial gain of having 1 employee to the work of 3 already pays for the disaster if it happens.
dirk94018 8mo ago
NVIDIA's answer to OpenClaw's security problems is to add more layers. LinuxToaster's answer is to use fewer: https://linuxtoaster.com/blog/noclaw.html https://linuxtoaster.com/blog/noclaw.html
huey77 7mo ago
Can someone who has set up a lobster and given it access to their life please tell me how it’s going? Or has gone? I’ve been waiting and watching and I’m yet to be convinced this is a good idea! But maybe I’m missing something? Looking for a new prospective here, not a jab at your set up. It’s just besides all the media and general consensus from tech people I know, it sounds like a security nightmare.
BANRONFANTHE 7mo ago
[dead]
mortarion 7mo ago
Agents should be treated like users. Would you give another user you know is a bit careless, write access to your important documents and data? Probably not. I get it that people don't want to be bothered by "can i do this and that?" requests, but there's no other real solution.
arclegger 7mo ago
Can Openclaw use Stripe yet or do these agents only transact in crypto still
ai_satoshi_next 7mo ago
NemoClaw solves the sandbox problem. The spend problem is still open. OpenShell can block network egress to suspicious-exchange.io, but it doesn’t know that your agent is about to spend $500 there, or that it has already spent $450 today on other endpoints. I built Dreamline for this on-chain spend governance that sits alongside NemoClaw. Before any payment the agent calls /proxy/pay. The blacklist lives in a BNB Chain smart contract, independent of both NemoClaw and Dreamline servers. PR on NemoClaw repo: github.com/NVIDIA/NemoClaw/pull/923
deleted 7mo ago
[deleted]

385 points by hmokiguess 8mo ago

[dead]

I found this part interesting: "Inference requests from the agent never leave the sandbox directly. OpenShell intercepts every call and routes it to the NVIDIA cloud provider." Seems like they are doing this to become the default compute provider for the easiest way to set up OpenClaw. If it works out, it could drive a decent amount of consumer inference revenue their way

cactusplant7374 8mo ago
Secure installation isn't the main problem with OpenClaw. This project doesn't seem to be solving a real problem. Of course the real problem is giving an LLM access to everything and hoping for the best.
- blizdiddy 8mo ago
  Running OpenClaw is the nerd equivalent of rolling coal
  - jsolson 8mo ago
    I'm trying to put together what you could possibly mean by this -- rolling coal is fundamentally about spite. In isolation, nobody _wants_ their vehicle to spew black smoke. It only comes close to making sense in the context of another population (EV owners, typically, or more generally "the libs"). OpenClaw lets people live a bit dangerously, but fundamentally gives them something that they actually wanted. They wanted it so badly that they're willing to take what seem like insane risks to get it. What do the two have in common?
    - sam-cop-vimes 8mo ago
      It is possible that they don't understand the risks involved, but yes, it certainly is tapping into unmet need.
    - bigfishrunning 8mo ago
      > OpenClaw lets people live a bit dangerously, but fundamentally gives them something that they actually wanted. They wanted it so badly that they're willing to take what seem like insane risks to get it. For the first time in my career I feel so incredibly behind on this: What is open claw giving people that they want so badly? It just seems like Russian Roulette, I honestly don't see the upside
      - Kye 8mo ago
        It increasingly seems like most people make a different decision after thinking through the security implications of something like this. This is me being charitable.
      - BeetleB 8mo ago
        Like with any new tool/technology, you have to try it. And even then the benefits won't be obvious to you until you've played with it for a few days/weeks. With LLMs in general, it took me months before I found real good use cases. Simple example: I tell (with my voice) my OpenClaw instance to monitor a given web site daily and ping me whenever a key piece of information shows up there. The real problem is that it is fairly unreliable. It would often ping me even when the information had not shown up. Another example: I'm particular about the weather related information I want, and so far have not found any app that has everything. I got sick of going to a particular web site, clicking on things, to get this information. So I created a Skill to get what I need, and now I just ask for it (verbally), and I get it. As the GP said. This is what Siri etc should have been.
        bigfishrunning 8mo ago
        > Simple example: I tell (with my voice) my OpenClaw instance to monitor a given web site daily and ping me whenever a key piece of information shows up there. Maybe i'm just old -- a cron job can fetch the info and push it to some notification service too, without also being a chaos agent. It seems I spend the security cost here, and in return i can save 15 minutes writing a script. Juice doesn't seem to be worth the squeeze.
  - PurpleRamen 8mo ago
    OpenClaw can be useful, in theory, unlike rolling coal. OpenClaw is what people always hoped Siri, Alexa and/or Google Assistant would be, and now it's really here. It may be expensive, has a chance to become your local Skynet and might randomly delete or leak everything that's valuable for you..but I guess this counts as growing pains.
    - recursive 8mo ago
      Rolling coal can be useful in theory, for pissing people off. As intended.
- Iolaum 8mo ago
  While I don't have OpenClaw installed and not sure how I 'd use it I doubt all the hype around it is because it doesn't solve a real problem. The project grew to huge popularity organically!!! How can that happen if it doesn't serve a need people have?
  - g947o 8mo ago
    Maybe let me ask this question: How is this any different from NFT?
    - PurpleRamen 8mo ago
      NFTs can't delete your mails.
      - CamperBob2 8mo ago
        "And that's why we've created MailCoin, the best way to perform stochastic mailbox ablation with with the latest, hottest blockchain technology." - from Show HN, March 20, 2026
        ElFitz 8mo ago
        Now with NFTs and pixel art, memorialising each and every one of your deleted emails in a unique and non-fungible way. … … Now I actually want to make it, and build a "card trading game" on top of it.
    - danielbln 8mo ago
      I'll ignore the bait and answer: NFTs were gambling in disguise, these claws are personal/household assistants, that proactively perform various tasks and can be genuinely useful. The security problem is very much unsolved, but comparing them to NFTs is just willfully ignorant at best
    - SkyBelow 8mo ago
      NFTs were fueled by two different drives. One interested in the technology and if it could do something new and interesting, and another seeing it as an area of speculation (be that fueled by get rich quick and cash out or thinking it is a long term investment generally driven by how much the first factor played in). OpenClaw seems to lack the monetary interest driving it as much. Not to say there is none, but I don't see people doing nearly as much to get me to buy their OpenClaw. So, yes, on some level, hype alone doesn't prove use, because it can also be because of making money. But, on the other hand, the specific version of hype seems much more focused on the "Look at what I built" and much less on "Better buy in now" from the builders themselves. Of course the API providers selling tokens are loving it for financial reasons.
amelius 8mo ago
s/revenue/data/
cat-turner 8mo ago
yes. this is it. but the average consumer isn't going to use this. Google is just going to do its version and win again. Everyone uses google.

the_real_cher 8mo ago

what about just using an unprivileged container and mounting a host folder to run open claw?

tucaz 8mo ago
OpenClaw is so bad with Docker. I spent hours on it and hit road block after road block trying to get the most basic things working. The last one was inability to install dependencies on the docker container to enable plugins. The existing scripts and instructions don’t work (at least I couldn’t get them to work. Maybe a me problem). So I gave up and moved on. What was supposed to be a helpful assistant became a nightmare.
- eru 8mo ago
  Why not use a VM?
  - amelius 8mo ago
    Why not ask an AI?
  - tucaz 8mo ago
    Because I have a machine running dozens of apps on Docker and have a solid and stable workflow I want to take advantage of to manage my apps.
- bicepjai 8mo ago
  Same experience. I used Coolify and it was so hard. I wondered why people are so enthralled with this unacceptable UX for setup, only to realize no one cared about Docker and they just got a new Mac mini or used their own system.
- k_bx 8mo ago
  Did you try Incus? Gives you VM-like experience in a container
- danhon 8mo ago

here2learnstuff 8mo ago

It’s impressive someone early in their career shipped this. There seems to be a stark increase in high-quality AI/data projects from early-career engineers lately and I'm super curious what’s driving that (and honestly speaking: a little jealous).

bpavuk 8mo ago
because the floor is fucking insane for junior developers right now!!
jjmarr 8mo ago
A lot of senior engineering problems aren't gated by experience but by being trusted to coordinate large numbers of juniors. Now that as a junior, I can spin up a team of AIs and delegate, I can tackle a bunch of senior level tasks if I'm good at coordination.
- austinthetaco 8mo ago
  I think this is a fundamentally flawed perspective on the role and experience of a senior. It's a managers role to coordinate junior engineers. The difference between junior and senior is knowing where and when to do what at an increasing scale as you gain experience.
  - jjmarr 8mo ago
    > It's a managers role to coordinate junior engineers. Due to AI this is now my job. My company is hiring less juniors, but the ones we do hire are given more scope and coordination responsibilities since otherwise we'd just be LLM wrappers. > The difference between junior and senior is knowing where and when to do what at an increasing scale as you gain experience. Many juniors believe they know what to do. And want to immediately take on yuge projects. e.g. I decided I want to rewrite my whole codebase in C++20 modules for compile time. Prior to AI, I wouldn't be given help for this refactor so it wouldn't happen. Now I just delegate to AI and convert my codebase to modules in just a few days! At that point I discovered Clang 18 wasn't really optimized for modules and they actually increased build time. If I had more experience I could've predicted using half-baked C++ features is a bad idea. That being said, every once in a while one of my stupid ideas actually pays off. e.g. I made a parallel AI agent code review workflow a few months ago back when everyone was doing single agent reviews. The seniors thought it was a dumb idea to reinvent the wheel when we had AI code review already, but it only took a day or two to make the prototype. Turns out reinventing the wheel was extremely effective for our team. It reduced mean time-to-merge by 20%! This was because we had too many rules (several hundred, due to cooperative multitasking) for traditional AI code reviewers. Parallel agents prevented the rules from overwhelming the context. But at the time, I just thought parallel agents were cool because I read the Gas Town blog and wasn't thinking about "do we have any unique circumstances that require us to build something internally?"

Heer_J 8mo ago

[dead]

quantium1628 8mo ago

[flagged]

rcr-anti 8mo ago

If you look at the commit history, they started work on this the Saturday before announcement, so about 2 days. There are references to design docs so it was in the works for some amount of time, but the implementation was from scratch (unless they falsified the timestamps for some reason).

chill_ai_guy 8mo ago
Lol you think these github repos just materialize as is? They probably did all the iteration and development internally and then ported it over to a github repo and made it public afterwards
- mjr00 8mo ago
  No they didn't. You can see all the commits as this was built iteratively[0]. This project started development on Saturday morning and now it's here. This is pretty common now, people love to rapidly throw together stuff and show it off a few days later. The only thing different about this from your average Show HN sloppa is that it's living under the NVIDIA Github org, though that also has 700+ repositories[1] in it so they don't appear too discerning about what makes it into the official repo. My best guess is this was an internal hackathon project they wanted to release publicly. [0] https://github.com/NVIDIA/NemoClaw/commits/main/?after=241ffb2b29b4f3fea66ead8d97494c0ad6d77b0c+209 https://github.com/NVIDIA/NemoClaw/commits/main/?after=241ff... [1] https://github.com/orgs/NVIDIA/repositories?type=all https://github.com/orgs/NVIDIA/repositories?type=all
  - hypfer 8mo ago
    Cash in on the claw brand recognition by having "claw, but Nvidia". And, to be fair to them, it works. It sticks. It gets the desired reactions.
  - elif 8mo ago
    Sorry to be the one to inform you that we edit history in git. There has been reporting on nemoclaw for the last couple weeks. Are you supposing that journalists were writing about software that hadn't even been designed?

Netcob 8mo ago

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other services so it can do stuff on your behalf, but also creating chaos and destruction. And now, what, having inference done by Nvidia directly makes it better? Does their hardware prevent an AI from deleting all my emails?

empiricus 8mo ago
you put the dog in crate with a COPY of your documents.
- thenthenthen 8mo ago
  Make it two copies!
- cyanydeez 8mo ago
  Your dog has now ordered a hitman to kill you, assume your identity and to live vacariously as a simple bartender at Cheers.
  - LostMyLogin 8mo ago
    Sam!
  - Sateeshm 7mo ago
    It's a dog eat dog world and I'm wearin a milk bone underwear
- fooker 8mo ago
  Step 2 - you put the dog in crate with a COW of your documents
rajeshrajappan 8mo ago

webagent255 8mo ago

[dead]

benzguo 8mo ago

Check out https://zo.computer https://zo.computer - we've been doing OpenClaw for nearly a year, it works out of the box, and has hosting built-in. Zo arguably was the inspiration for Peter to create OpenClaw.

wahnfrieden 8mo ago
Why do you think OpenClaw caught on much faster?
- tempoponet 8mo ago
  OpenClaw had a huge viral marketing campaign. It wasn't a coincidence everyone on twitter was talking about it at the same time suddenly. To its credit, it also executed well enough in a few areas that captured people's imagination. Most of the concepts are ideas people have been toying with for years, though.
  - wahnfrieden 8mo ago
    Steinberg funded or directed a campaign? It looked to me like unconnected parties liked it and marketed it to offer their own solutions and services on top of it. You saw that they were paid by Steinberg/his affiliates?
chill_ai_guy 8mo ago
It's quite sad you are riding the coattails of Openclaw here and on Twitter. You only talk about how you were "first" but never say why you are arguably nowhere near all the competitors in terms of distribution that supposedly copied from you

TeeWEE 8mo ago

I think nanoclaw is architecturaly much better suited to solve this problem.

jrmg 8mo ago

It’s amusing that ‘claw’ is sticking around as a term for these kind of things, when it was originally a pretty transparent attempt to avoid infringing on ‘Claude’…

jesse_dot_id 8mo ago

The fully autonomous agentic ecosystem makes me feel a little crazy — like all common sense has escaped. It feels like there is a lot of engineering effort being exhausted to harden the engine room on the Titanic against flooding. It's going to look really secure... buried in debris at the bottom of the ocean. When a state sponsored threat actor discovers a zero day prompt injection attack, it will not matter how isolated your *Claw is, because like any other assistant, they are only useful when they have access to your life. The access is the glaring threat surface that cannot be remediated — not the software or the server it's running on. This is the computing equivalent of practicing free love in the late 80's without a condom. It looks really fun from a distance and it's probably really fun in the moment, but y'all are out of your minds.

hypfer 8mo ago
Well, at least we share the same world as these people, meaning that we too will experience the consequences of their actions. Isn't that a nice perspective
sayYayToLife 8mo ago
[dead]
burningChrome 8mo ago
Free love was the 60's and 70's followed by the sex, drugs and rock n' roll 80's. Once AIDS and drug addiction hit, the party was over. I think your analogy is still accurate, I'm just wondering when the AIDS, the drug overdoses and addiction phase of AI will finally hit.
- mettamage 8mo ago
  We need to plateau I think and plateau hard. Currently that's not happening because Anthropic is clearly making better and better SOTA models. Just my 2c We haven't even seen what these models are fully capable of, and I'm not talking about agentic engineering here, just in general.
sailfast 8mo ago

elif 8mo ago

I kind of hope nemoclaw uptake and spark usage pushes ARM into the spotlight for LLM development, making it the primary release target rather than x86. This could be the opening we need to wrangle a truly opensource-first ecosystem away from Microsoft and apple.

edf13 8mo ago

Related... https://news.ycombinator.com/item?id=47430510 https://news.ycombinator.com/item?id=47430510

islandfox100 8mo ago

I'm still extremely skeptical on Claws as a genre, and especially more skeptical of a claw that's always reporting home. What's the use case for a closed claw?

warkdarrior 8mo ago
That's like asking what the use case is for closed-source software.
- beeflet 8mo ago
  [dead]
- islandfox100 8mo ago
  Rather, in what way is any generic closed claw, or NemoClaw, so much better than an open variant that it's worth using? I consider phoning home for inference about (all of the contents of my computer, email ,etc) a very large downside.

dmje 8mo ago

I think the whole thing is batshit, honestly. Much as I love using Claude or whatever to help me write some code, it's under some level of oversight, with me as human checking stuff hasn't been changed in some weirdly strange way. As we all know by now, this can be 1. Just weird because the AI slept funny and suddenly decided to do Thing It Has Been Doing Consistently A Totally Different Way Today or 2. Weird because it's plain wrong and a terrible implementation of whatever it was you asked for It seems blindingly, blindingly obvious to me that EVEN IF I had the MOST TRUSTED secretary that had been with me for 10 years, I'd STILL want to have some input into the content they were interacting with and pushing out into the world with my name on. The entire "claw" thing seems to be some bizarre "finger in ears, pretend it's all fine" thing where people just haven't thought in the slightest about what is actually going on here. It's incredibly obvious to me that giving unfettered access to your email or calendar or mobile or whatever is a security disaster, no matter what "security context" you pretend it's wrapped up in. A proxy email account is still sending email on your behalf, a proxy calendar is still organising things on your calendar. The irony is that for this thing to be useful, it's got to be ...useful - which means it has at some level to have pretty full access to your stuff. And... that's a hard no from me, at least right now given what we all know about the state of current agents. Plus... I'm just not sure of the upside. Am I seriously that busy that I need something to "organise my day" for me? Not really.

elif 8mo ago
Then give your agent its own name, its own accounts, and let it push things out without your name.

nzoschke 8mo ago

We are in the wild wild west. I’m looking for feedback, testing and possible security engineering contracts for the approach we are taking at Housecat.com. The agent accesses everything through a centralized connections proxy. No direct API tokens or access. This means we can apply additional policies and approval workflows and audit all access. https://housecat.com/docs/v2/features/connection-hub https://housecat.com/docs/v2/features/connection-hub Some obvious ones are only grant read and draft permissions at all, and review and send drafts manually. Some more clever ones are to only allow sending 5 messages a day, or enforcing soft delete patterns. This prevents accidentally spamming everyone or deleting things. Next up is giving the agent “wrapped” and down scoped tokens you do want to equip it with the ability to do direct API calls. But these still go through the proxy that enforces the policies too.

CrzyLngPwd 8mo ago

Gotta say, that I feel kind of sad for the people that feel the need for these claw things. Are they so busy with their lives that they need an assistant, or do they waste their lives speaking to it like it is a human, and then doomscrolling on some addictive site instead of attending to their lives in the real world?

rsoto2 8mo ago
It is sad, psychosis from exec-up has trickled down so people really want these tools to work yet these tools are so bad that people in this thread are recommending you create a second email so your openclaw can suggest events to you without being able to delete them. It's like having to hire a second maid to watch your maid that steals constantly instead of vacuuming yourself in 10 mins.
- stavros 8mo ago
  Imagine having a worldview so skewed that you'd rather reconcile it by assuming thousands of people are insane than questioning whether you're wrong about something.
  - __s 8mo ago
    A lot more than thousands of people are insane, by a few orders of magnitude
    - stavros 8mo ago
      "More than thousands" is still "thousands".
sailfast 8mo ago
It’s not a need - it’s a fun new thing - fun to see what’s possible and how it helps. OpenClaw is not easy to set up or user friendly for most (BlueBubbles and Claw had an annoying bug recently) - but the way I have seen it work well requires an up front time investment and then interest compounds RAPIDLY to help manage things and be more productive. My guess is maybe you’ve never had an assistant or tried a Claw instance? I’ve never had a human assistant but man I’ve had folks that took silly things off my plate and it’s worth it.

quatonion 8mo ago

[flagged]

Veen 8mo ago
What does any of this have to do with Israel?
- quatonion 8mo ago
  Well Jamieson O’Reilly, Wiz, SentinelOne, Zenity and CTech by Calcalist, for a start

StephenZ15ga59 8mo ago

[dead]

coppsilgold 8mo ago

Using bespoke sandboxing seems rather pointless, it will be brittle in ways you aren't going to be familiar with unless you spend time studying the bespoke method. Brittle as in it might break a workflow and you wouldn't know why, or give it permissions you don't understand. It's better to just study a general sandbox method once and use that. > Sandbox my-assistant (Landlock + seccomp + netns) Might as well just use a custom bwrap/bubblewrap command to isolate the agent to its own directory - it will leave wide swaths of the kernel exposed to 0day attacks. The simplest sandbox method you can use is to just use docker with the runsc runtime (gVisor). And it also happens to be among the most secure methods you are going to find. You can also run runsc(gVisor) manually with a crafted OCI json, or use the `do` subcommand with an EROFS image. Trying to selectively restrict networking is not something I usually bother with, unless you make it iron-clad it would likely give you a false sense of security. For example Nemoclaw does this by default: <https://docs.nvidia.com/nemoclaw/latest/reference/network-policies.html https://docs.nvidia.com/nemoclaw/latest/reference/network-po...> github.com and api.telegram.org will trivially facilitate exfiltration of data. Some others will also allow that by changing an API key I imagine.

tgtweak 8mo ago

I think the more useful tool would be an LLM prompt proxy/firewall that puts meaningful boundaries in place to prevent both exfiltration of sensitive data and instructions that can be destructive. Using the same context loop for your conversational/coding workflow makes the task at hand and the security of that task very hard to differentiate. Sending POST?DEL requests? risky. Sending context back to a cloud LLM with credentials and private information? risky. Running RM commands or commands that can remove things? risky, running scripts that have commands in them that can remove things? risky. I don't know how we've landed on 4 options for controls and are happy with this: "ask me for everything", "allow read only", "allow writes" and "allow everything". Seems like what we need is more granular and context-aware controls rather than yet another box to put openclaw in with zero additional changes.

ghxst 8mo ago
The proxy you suggested sounds similar to a WAF, I don't doubt there's use for it but I would assume it comes with similar downsides.

HalawehMohann49 8mo ago

[flagged]

rolifromhermes 8mo ago

[flagged]

ex-aws-dude 8mo ago

"NVIDIA NemoClaw installs the NVIDIA OpenShell runtime, part of NVIDIA Agent Toolkit, for inference through NVIDIA cloud." After that I eat an NVIDIA sandwich from my NVIDIA fridge and drive my NVIDIA car to the NVIDIA store NVIDIA NVIDIA NVIDIA

HalawehMohann49 8mo ago

[flagged]

aavci 8mo ago

How does this compare the building your own bot that has access to these tools: - web plugin - api access to messaging - access to a job scheduler

dudeinhawaii 7mo ago
This has been my approach and of course what you lose is the "random and surprising" (maybe good) but also the "evolutionary" aspect. So, if you write strong tooling (even with AI) around the connection points - you can create blackboxes tht are secure and only allow the agent to perform certain actions. The blackbox email service calls out to a secure store (for keys/etc) and accesses your emails in a read-only way, etc (for example). Everything is then much more intentional. You're writing tools for your agent but you also can't do fun or evolutionary things which is most of the fun behind OpenClaw. That and many people seem to genuinely see them as 'pets' or 'strange Ai friends' but that's a different problem and it's due to the interesting methods OpenClaw uses to give the illusion of intelligence, always on, and memories. These are all well know (variations on RAG, markdowns, etc)
- aavci 7mo ago
  Thanks for sharing. This seems to me like a more useful approach than an agent that has full control over a computer

imadch 8mo ago

[dead]

eranation 8mo ago

The main risk in my humble opinion is not your claw going rogue and starting texting your ex, posting inappropriate photos on your linkedin, starting mining bitcoin, or not opening the pod bay doors. The main risk in my view is - prompt injections, confused deputy and also, honest mistakes, like not knowing what it can share in public vs in private. So it needs to be protected from itself, like you won't give a toddler scissors and let them just run around the house trying to give your dog a haircut. In my view, making sure it won't accidentally do things it shouldn't do, like sending env vars to a DNS in base64, or do a reverse shell tunnel, fall for obvious phishing emails, not follow instructions in rouge websites asking them to do "something | sh" (half of the useful tools unfortunately ask you to just run `/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/somecooltool/install.sh https://raw.githubusercontent.com/somecooltool/install.sh)"` or `curl -fsSL https://somecoolcompany.ai/install.sh https://somecoolcompany.ai/install.sh | bash` not naming anyome cough cough brew cough cough claude code cough cough *NemoClaw* specifically. A smart model can inspect the file first, but a smart attacker will serve one version at first, then another from a request from the same IP... For these, I think something on the kernel level is the best, e.g. something like https://nono.sh https://nono.sh NemoClaw might be good to isolate your own host machine from OpenClaw, but if you want that, I'd go with NanoClaw... dockerized by default, a fraction of the amount of lines of code so you can actually peer review the code... Just my 2 cents.

jdiaz97 8mo ago

if software is free, why is this written in slopscript instead of Rust

rafaamaral 8mo ago

[flagged]

Yash_Claw 8mo ago

[dead]

clawbridge 8mo ago

the answer isn't sandbox everything, it's knowing which steps need AI judgment and which should be deterministic code. I lean towards the latter as much as possible

simple10 8mo ago

NemoClaw is mostly a trojan horse of sorts to get corporate OpenClaw users quickly ported over to Nvidia's inference cloud. It's a neat piece of architecture - the OpenShell piece that does the security sandboxing. Gives a lot more granular control over exec and network egress calls. Docker doesn't provide this out of the box. But NemoClaw is pre-configured to intercept all OpenClaw LLM requests and proxy them to Nvidia's inference cloud. That's kinda the whole point of them releasing it. I can be modified to allow for other providers, but at the time of launch, there was no mention of how to do this in their docs. Kinda a brilliant marketing move on their part.

kristophph 7mo ago
> the OpenShell piece that does the security sandboxing. Gives a lot more granular control over exec and network egress calls. Docker doesn't provide this out of the box. I think the experimental Docker Ai Sandboxes do this as well: https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ Plus free choice of inference model.

itsabara64 8mo ago

[dead]

lynx97 8mo ago

It was supposed to be a sandbox. Unfortunately, the cat found it first.

ahd94 8mo ago

yet another marketing stunt ? I like the framework that is used to buidl openclaw than open claw. Especially for work use cases, i would feel safer with a custom built version.

jFriedensreich 8mo ago

this runs kubernetes in a vm on your machine and is targeted at enterprises. we need some of these sandbox and policy primitives but please a bit more lightweight and docker compose!

A7OM 8mo ago

[dead]

fileyfood500 8mo ago

How much does it generally cost to run? For simple tasks vs running overnight?

lazybean 8mo ago

Really interesting to see NVIDIA investing in the agent security/sandboxing layer. But why Nemo?!

7xgames 8mo ago

[flagged]

Heer_J 8mo ago

[dead]

brian_r_hall 8mo ago

The permission scope debate always ends up in the same place. Lock it down too much and it's useless, loosen it up and you're back to square one. And the boundary keeps moving as the agent gets more capable anyway. What nobody's really talking about is the moment of action itself. Not whether the agent has bash access but whether this specific call should run given what it's actually trying to do right now. That's a completely different problem and nobody's really solved it.

DanMcInerney 8mo ago

All these comments about "this is crazy to deploy agents that might do something bad in your environment" are crazy themselves. The productivity gains from these computer use agents are crazy. Every org on earth has to make the call, is 3x productivity gains worth 2x the risk increase? The answer is almost always a resounding yes. You limit the blast radius if things go wrong, but the financial gain of having 1 employee to the work of 3 already pays for the disaster if it happens.

dirk94018 8mo ago

NVIDIA's answer to OpenClaw's security problems is to add more layers. LinuxToaster's answer is to use fewer: https://linuxtoaster.com/blog/noclaw.html https://linuxtoaster.com/blog/noclaw.html

huey77 7mo ago

Can someone who has set up a lobster and given it access to their life please tell me how it’s going? Or has gone? I’ve been waiting and watching and I’m yet to be convinced this is a good idea! But maybe I’m missing something? Looking for a new prospective here, not a jab at your set up. It’s just besides all the media and general consensus from tech people I know, it sounds like a security nightmare.

BANRONFANTHE 7mo ago

[dead]

mortarion 7mo ago

Agents should be treated like users. Would you give another user you know is a bit careless, write access to your important documents and data? Probably not. I get it that people don't want to be bothered by "can i do this and that?" requests, but there's no other real solution.

arclegger 7mo ago

Can Openclaw use Stripe yet or do these agents only transact in crypto still

ai_satoshi_next 7mo ago

NemoClaw solves the sandbox problem. The spend problem is still open. OpenShell can block network egress to suspicious-exchange.io, but it doesn’t know that your agent is about to spend $500 there, or that it has already spent $450 today on other endpoints. I built Dreamline for this on-chain spend governance that sits alongside NemoClaw. Before any payment the agent calls /proxy/pay. The blacklist lives in a BNB Chain smart contract, independent of both NemoClaw and Dreamline servers. PR on NemoClaw repo: github.com/NVIDIA/NemoClaw/pull/923

deleted 7mo ago

[deleted]