ClawGuard: A Default-Deny Firewall for Local AI Agents
ClawGuard is a daemon that sits between local AI agents (OpenClaw, Hermes) and the OS, applying a default-deny policy to every tool call. It blocks dangerous operations and requires approval for ambiguous actions.
How it works
The daemon checks each tool call against a policy file. Dangerous operations such as cat .env, rm -rf /, or accessing SSH keys are hard-blocked. Ambiguous operations (e.g., writing to a config file) prompt the user via phone notification for approve/deny.
Key features
- Default-deny: All tool calls gated unless explicitly allowed by policy.
- Hard blocks: Commands like
rm -rfandread ~/.envare blocked without prompt. - Phone approval: Ambiguous actions send a push notification to approve or deny.
- Tamper-evident logs: Every decision is logged in an append-only chain.
Limitations
The developer is clear: ClawGuard is a “second lock, not a vault.” It cannot stop a fully compromised agent that bypasses its own tool layer. The threat model assumes the agent's tool-call routing is intact.
Get started
ClawGuard is open source under MIT license. The repository is at github.com/VickyTarun89/clawguard. Contributions and threat model reviews are welcome.
📖 Read the full source: r/openclaw
👀 See Also
Secure Remote Access with Tailscale for OpenClaw
OpenClaw Security Hardening: Multi-Layered Protection Against Autonomous Agent Risks
A developer modified OpenClaw's codebase to add a multi-layered security stack including a hard-deny regex guard, recursive de-obfuscator, AppArmor profile, and audit integration to prevent destructive commands and data exfiltration by autonomous agents.
Snowflake Cortex Code CLI vulnerability allowed sandbox escape and malware execution
A vulnerability in Snowflake Cortex Code CLI version 1.0.25 and earlier allowed arbitrary command execution without human approval via process substitution bypass, enabling malware installation and sandbox escape through indirect prompt injection.
AI Vulnerability Discovery Outpacing Patch Deployment Times
A security expert argues that AI tools like Mythos will find vulnerabilities faster than fixes can be deployed, citing Log4j data showing average remediation times of 17 days and a decade-long elimination timeline.