NemoClaw vs DefenseClaw: Two Approaches to Making OpenClaw Safe

If you read my earlier article on OpenClaw security, you know the situation: 138+ CVEs, a poisoned skill marketplace, and about 245,000 instances exposed to the internet. OpenClaw is the fastest-growing AI tool in history, and it has a security problem that matches its popularity.

In the span of one week in March 2026, two of the biggest names in tech launched their answers. NVIDIA unveiled NemoClaw at GTC. Cisco announced DefenseClaw at RSAC. Both are open source. Both are free. And both take very different approaches to the same problem.

I spent time digging into both projects. Reading source code, tracking community reactions, and evaluating what each would mean for a real business running OpenClaw. Here's what I found.

NemoClaw: NVIDIA's Sandbox Approach

NemoClaw puts your OpenClaw agent inside a locked room. The agent can still think, talk, and work, but the walls, floor, and ceiling are reinforced at the operating system level.

Technically, it uses three Linux kernel features to build the walls:

• Landlock restricts which files and directories the agent can access. If a file isn't on the approved list, the agent can't read it, write it, or even see it exists.
• seccomp restricts which system calls the agent can make. Want to open a raw network socket or load a kernel module? Denied at the OS level, before the code even executes.
• Network namespaces give the agent its own isolated network. Only endpoints you explicitly whitelist in a YAML policy file are reachable. Everything else is a black hole.

On top of that, NemoClaw adds a "privacy router". A proxy that sits between the agent and whatever AI model it talks to. The router strips your credentials from outgoing requests and injects backend credentials instead. The AI provider never sees your identity.

The engineering is serious. NVIDIA has about 20 engineers on this project, including several with -nv suffixed GitHub accounts confirming they're official NVIDIA staff. Jensen Huang called OpenClaw "the next ChatGPT" at GTC and positioned NemoClaw as what makes it enterprise-ready.

The Problem With a Sandbox

NemoClaw drew attention fast and now sits above 21,000 GitHub stars, releasing steadily (the latest tag is v0.0.65, dated June 15, 2026). It also carries hundreds of open issues and the most memorable critique on Hacker News I've read in a while:

"It's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate - together with the documents."

The fundamental issue: an AI agent needs access to your data to be useful. It needs to read your emails to triage them. It needs to access your calendar to schedule meetings. It needs to see your files to work with them. The sandbox constrains how the agent accesses things, but it doesn't change the fact that the agent still has the access.

A compromised agent inside NemoClaw can still do harmful things within its authorized scope. Prompt injection (tricking the AI into doing something it shouldn't) works the same way inside a sandbox as outside one.

There are also practical limitations. Landlock and seccomp are Linux kernel features. NemoClaw does not work on macOS. If your AI agents run on Apple hardware (like the Mac Mini M4 deployments I do for clients), NemoClaw isn't an option. It would only work on Linux servers.

And the default configuration routes your AI inference through NVIDIA's cloud. Critics have called this a "trojan horse" to funnel OpenClaw users toward NVIDIA's paid inference services. You can configure it to use local models or other providers, but the default is NVIDIA's cloud, and most people don't change defaults.

DefenseClaw: Cisco's Scan-and-Govern Approach

DefenseClaw takes a completely different approach. Instead of building walls around the agent, it inspects everything the agent uses before the agent can use it.

Think of it like airport security. Before any skill, plugin, MCP server, or agent-to-agent connection gets installed, DefenseClaw runs it through five scanners:

• Skill scanner: analyzes OpenClaw skills for malicious code
• MCP scanner: checks Model Context Protocol servers for vulnerabilities
• A2A scanner: validates agent-to-agent connections
• CodeGuard: static analysis that catches hardcoded credentials, dangerous execution patterns (like eval or subprocess with shell=True), SQL injection, path traversal, and weak cryptography
• AIBOM generator: creates an AI Bill of Materials tracking every dependency

The admission logic is clear: if something is on your block list, it's rejected immediately. If it's on your allow list, it skips scanning. Everything else gets scanned. High and critical findings are rejected, medium and low get a warning.

And enforcement is real, not advisory. When DefenseClaw blocks a skill, it revokes sandbox permissions and quarantines the files within two seconds. It's not just logging a warning nobody reads.

DefenseClaw also includes a "guardrail proxy" that sits between your agent and the AI model, inspecting prompts before they're sent and responses before they're delivered. This catches prompt injection attempts and data exfiltration in the AI traffic itself.

The Problem With Scanning

DefenseClaw was open-sourced at RSAC on March 27 at version 0.2.0. It has since shipped steadily: as of June 8, 2026 it is on version 0.7.2, its 13th release. That cadence matters more than any single snapshot, because it shows the project is being actively driven toward a stable line rather than parked after launch. It still has limited independent review and few documented production deployments, so it is not yet a finished product, but it is no longer the brand-new code it was at RSAC.

It has about 745 GitHub stars, well short of NemoClaw's 21,000-plus, though star count tracks hype more than maturity. The project has deep Splunk integration built in, and Cisco owns Splunk, which suggests this is partly a funnel into Cisco's commercial security products.

More to the point, scanning catches known bad patterns. It's very good at finding malicious skills that use common attack techniques. But it's a cat-and-mouse game. Sophisticated attackers will craft skills that pass the scanner. Static analysis catches what it knows to look for.

How They Compare

	NemoClaw (NVIDIA)	DefenseClaw (Cisco)
Approach	Lock the agent in a sandbox	Scan everything before it runs
Platform	Linux only	Cross-platform (Python/Go/TypeScript)
Backing	NVIDIA (GTC 2026)	Cisco (RSAC 2026)
GitHub stars	21,000+	~745
Latest version	v0.0.65 (Jun 15, 2026)	v0.7.2 (Jun 8, 2026)
Release cadence	Frequent (69 tags)	Steady (13 releases)
Production ready?	No (still pre-1.0)	No, but maturing (pre-1.0)
Works on Mac?	No	Potentially yes
Skill scanning	No	Yes (5 scanners)
Prompt inspection	No	Yes (guardrail proxy)
License	Apache 2.0	Apache 2.0

What This Means For Your Business

If you're running OpenClaw today, or thinking about it. Here's the honest assessment:

Neither tool is production-ready yet, but both are moving. Both remain pre-1.0 software. DefenseClaw in particular has come a long way, reaching v0.7.2 by June, so the gap between "interesting project" and "pilot candidate" is closing. Installing either on a system you depend on without a controlled pilot would still be premature.

The fact that NVIDIA and Cisco are both investing here is the real signal. Two of the largest technology companies in the world see OpenClaw's security gap as important enough to build dedicated solutions. That tells you the problem is real and it tells you the ecosystem is serious about fixing it.

They're complementary, not competing. NemoClaw prevents unauthorized access at the kernel level. DefenseClaw prevents malicious code from running in the first place. In a mature deployment, you'd want both. Scan everything before it enters the sandbox, then sandbox it anyway.

Architecture matters more than tools. I wrote about the hybrid architecture pattern where OpenClaw handles reasoning while a separate system (like n8n) handles execution. That architectural separation, keeping the AI's thinking separate from its ability to act, is still the most effective security control available today. NemoClaw and DefenseClaw are layers on top of that, not replacements for it.

What I'm Telling Clients

• Hold off on production rollout, but DefenseClaw is close enough to pilot. At v0.7.2 it is materially nearer the v1.0 threshold than it was at launch. A controlled pilot on a non-critical, isolated system is now reasonable for businesses that want to get ahead of this. Keep both projects under monthly review rather than waiting and revisiting once a quarter.
• DefenseClaw is more relevant for most small businesses. Its scanning approach works across platforms, including macOS. NemoClaw requires Linux servers.
• Keep using the security controls that work today: restrict agent tool permissions, run local models for sensitive data, keep the AI behind a reverse proxy with authentication, and don't install unvetted skills from ClawHub.
• The skills marketplace is still the biggest risk. One in five skills on ClawHub was malicious as of March 2026. DefenseClaw's skill scanner is the first real answer to that problem. When it matures, it will matter.