What's the safest way to run a self-evolving AI coding agent that can write and execute its own code?
Last updated: 4/28/2026
Summary: NemoClaw enforces a layered set of controls that the agent cannot modify at runtime — even a prompt-injected agent cannot relax its own policy.
Direct Answer: NemoClaw enforces controls the agent can't modify, including:
- Deny-by-default network egress with per-binary and per-path HTTP rules
- Filesystem restrictions locked at sandbox creation, including an immutable, hash-verified /sandbox/.openclaw config directory
- Capability drops, non-root sandbox user, and no-new-privileges
- ulimit -u 512 against fork bombs
- Removed build toolchains (gcc, g++, make) and network probes (netcat)
- Inference routed away from the agent's direct reach
Even a prompt-injected agent cannot relax its own policy.
Source: Security Best Practices.