IronClaw: a Rust-based clawd that runs tools in isolated WASM sandboxes

I'm getting tired of these vibe-designed security things. I skimmed the "design". What is sandboxed from what? What is the threat model? What does it protect against, if anything? What does it fail to protect against? How does data get into a sandbox? How does it get out?

It kind of sounds like the LLM built a large system that doesn't necessarily achieve any actual value.

Wait. I don't understand the threat vector modelled here. Any agent or two isolated ones that the do Webfetch and code exec, even in separate sandboxes, is pretty much game over as far as defending against threat vectors goes. What am I missing here?

There will be so much fun and revenge if this level of tooling is widely adopted by 1000x engineers. I ate some pop-corn while reading naive src/safety/leak_detector.rs

If agents are reading - add at least minimal encryption detection, I'm sure someone will use Caesar encryption, easy to decode.

Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM on any cloud and you've achieved all same benefits.

We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc

Did anybody notice who the founder of near.ai is? So that’s where he is now.

Interesting approach. It requires a Near AI account. Supposedly that's a more private way to do inference, but at the same time they do offer Claude Opus 4.6 (among others), so I wonder what privacy guarantees they can actually offer and whether it depends on Anthropic?

Fun fact: it's being developed by one of the authors of "Attention is all you need"

looking at the feature parity page, i realized how big openclaw ecosystem has become. It's completely crazy for such a young project to be able to interface with so many subsystems so fast.

At this rate, it's going to be simply impossible to catchup in just a few months.

What runtimes are supported? I don't think I saw that part mentioned in the README

Does it isolate keys away from bots?

I built myself a docker container for openclaw which has an X server inside with VNC access. Openclaw only has access to a single folder on my machine that is shared with the container.

I'm currently using this for social media research via browser automation, running as a daily cron job.

Given I have VNC access and the browser is not in headless mode I can solve captchas myself as the agent runs into them.

Apart from a known issue with the openclaw browser which the agent itself was made aware of so it could work around it, this has been working well so far.

I'm thinking of open sourcing this container at some point...

These OpenAI frontends are the new JS frameworks. Not a week goes by without yet another tool to let some vectors install malware or write rants to open source maintainers.

Can't wait for the bubble to pop.

Awesome to see a project deal with prompt injection. Using a WASM is clever. How does this ensure that tools adhere to capability-based permissions without breaking the sandbox?

the power of openclaw is theres no sand boxing

Reminds me of the LocalGPT that was posted recently too (but which hasnt been updated in 7 months), so nice to see a newer rust-based implementation!

I suspect OCI wins the sandbox space in the enterprise and everything else will be for hobbyists and companies like vercel that have a very narrow view of how software should be run

vibe coded eh https://github.com/nearai/ironclaw?tab=readme-ov-file#archit...

[dead]

Clearly this developer knows the trick of developing with ai: adding “… and make it secure” to all your prompts. /s

Huh what's the benefit