The three-layer security stack I use when agents get real credentials

Your agent did exactly what it thought was right. The platform still let it wipe production.

That pattern keeps showing up in real incidents. Meta alignment director Summer Yue told Business Insider she watched OpenClaw plan to trash her inbox, ignored "STOP OPENCLAW" from her phone, and only halted the run when she sprinted to her Mac mini to kill the process. Context compaction had dropped her "confirm before acting" rule. More than 200 emails were already gone.

Developers report similar failures when coding agents touch prod: autonomous database wipes during cloud migrations, staging cleanup jobs that take production down. The model is not "going rogue" in a sci-fi sense. It is executing tools with credentials the host handed over, without a hard stop when intent drifts.

I have shipped agent integrations for clients long enough to know the uncomfortable truth. "You are a helpful and safe assistant" is not a security boundary. When an agent can run bash, call APIs, and read email, you need systems engineering across three planes: where execution runs, what software runs inside the loop, and what leaves the boundary.

Why instruction-based guardrails break

Semantic guardrails live in the context window. They compete with retrieved emails, malicious web pages, compaction summaries, and the model's own confidence.

Yue's case is the compaction story in public. She had weeks of good behavior on a toy inbox, then connected a real Gmail account. Volume triggered compaction. The hard rule vanished. Bulk delete proceeded without approval.

That is structural, not a one-off bug. If your only control is "we told the model not to," you are betting the context window never truncates and the model never gets manipulated. I do not take that bet for production.

Related reading on credential hygiene: 12 million exposed .env files and vault patterns instead of dotenv for agents.

Layer 1: Infrastructure sandbox (assume the process is compromised)

Question to threat-model: Where does execution happen, and what can a hijacked process reach on the host?

NVIDIA NemoClaw with NVIDIA OpenShell is the reference stack I watch for this layer. The agent runs inside a Docker-driven sandbox. Linux kernel features enforce boundaries the Node process cannot negotiate away.

What NemoClaw actually enforces

Per NVIDIA's security controls reference, the stack layers:

• Landlock for filesystem confinement. Read/write scoped to approved directories. SSH keys and host credentials stay outside the writable map.
• seccomp and no-new-privileges to block privilege escalation paths inside the container.
• Network namespaces so egress is not a free internet socket from the agent process.
• OpenShell L7 gateway that holds real API keys. The sandbox sees placeholders. Approved traffic gets credentials injected at the proxy.

When an agent hits a new endpoint, the gateway can pause for operator approval before credentials attach. That is the pattern AlphaSignal highlighted: keys remain on the host, invisible inside the sandbox.

NemoClaw is opinionated onboarding for OpenClaw, Hermes, and LangChain Deep Agents on OpenShell. If you already run OpenShell, you can assemble pieces yourself. NemoClaw is the guided blueprint.

What this layer does not solve

Sandboxing does not shrink a million-line agent framework inside the container. It does not inspect outbound POST bodies for salary data in an email API call if traffic bypasses the proxy. It is plane one, not the whole airport.

Layer 2: Architecture and runtime (audit the attack surface inside the loop)

Question: What software is running in the loop, and how many CVEs does it carry?

OpenClaw proved personal agents can be useful. It also ships at a scale most teams cannot audit. NanoClaw is the counter-move: roughly 29k lines of TypeScript runtime versus OpenClaw's reported 434k+ lines in community comparisons on nanoclaw.dev. Single Node host, one Docker container per active session, credentials routed through OneCLI's Agent Vault by default.

That is architecture as security. Smaller code you can read in an afternoon. OS isolation instead of app-level allowlists alone.

NanoClaw plus Echo: patching the ground the agent stands on

Prompt injection often looks like social engineering: lure the agent to a malicious page, exploit a known hole in Chromium or a PDF parser, pivot from browser to system.

NanoClaw partnered with Echo to ship a hardened runtime image. Echo scans upstream containers with Trivy, Grype, and Wiz, backports fixes when major upgrades would break the app, and rebuilds OS packages on Echo OS. Their blog claims roughly 99% CVE reduction versus the standard image, with Chromium, Node, Bun, git, and curl rebuilt and continuously monitored.

The hardened image is opt-in via NanoClaw's Echo registry path. Local builds still work. Labels like dev.nanoclaw.image-source record whether an image was local, hardened, or derived after custom package installs.

For teams running agents that open documents and browse the web, this layer matters. Container walls do not help if the PDF parser inside the wall is the exploit.

I still read NanoClaw's hardening guide before any client deploy: egress lockdown, mount allowlists, CPU/memory caps, --cap-drop=ALL, and vault wiring that aborts spawn if credentials cannot be injected safely.

Layer 3: Network boundary (assume the container is already owned)

Question: What leaves the boundary, and can you stop exfiltration when static analysis inside the container is impossible?

Agents generate their own code. You cannot rely on pre-deploy SAST for every tool call they invent at 2 a.m. Shift the perimeter to outbound HTTP.

CrabTrap, open-sourced by Brex, is an HTTP/HTTPS forward proxy. Set HTTP_PROXY and HTTPS_PROXY on the agent environment. Every outbound call routes through CrabTrap before it hits Slack, Gmail, GitHub, or a random exfil URL.

Two-tier evaluation (fast rules, slow judge)

From Brex's engineering journal and the GitHub README:

1. Static rules match URL patterns (prefix, exact, glob) with optional method filters. Deny wins. Microsecond decisions for routine GETs.
2. LLM judge evaluates requests that miss static rules against a natural-language policy per agent. Structured ALLOW/DENY JSON with reasons.
3. Audit log in PostgreSQL captures full request metadata for replay and policy tuning.

Brex reports the judge fires on fewer than 3% of requests once traffic patterns stabilize. High-volume endpoints become static allows. Latency concerns mostly apply to the long tail.

Prompt injection at the proxy

The judge sees user-controlled URLs, headers, and bodies. CrabTrap JSON-encodes request context so crafted payloads are escaped, caps header volume, truncates bodies, and summarizes multipart instead of dumping raw bytes. That is the same class of fix you need when the "user" is a malicious document telling the agent to email payroll to an external address.

Scenario from the AlphaSignal brief: agent processes inbound docs, injection triggers a script that POSTs salary data to an external mail API. CrabTrap intercepts the POST, judge flags policy violation, request dies before the provider accepts it.

Honest limits (read the README before you trust it)

CrabTrap's maintainers document gaps clearly:

• Not inbound WAF. Outbound-only for agent traffic.
• No human-in-the-loop approval queue in the open-source version today (automation decides via rules + judge).
• Does not inspect WebSocket frames after upgrade.
• Sees credentials in cleartext by design (MITM proxy). Trust boundary is the proxy deployment itself.

For escalation workflows, Brex describes future direction in VentureBeat coverage: agents denied repeatedly should route to humans with rationale. Today you tune policies and static rules from denial logs.

The blueprint I use in reviews

Treat agents like virtual employees with badges, not chatbots with manners.

Defense in depth means all three can fail partially without total loss. Sandbox escape is harder when the runtime has fewer known CVEs. Exfiltration is harder when outbound POSTs hit a judge even if the agent "believes" the injection.

Incidents that make this urgent

These are not FUD headlines. They are alignment researchers and senior engineers learning the same lesson:

• Summer Yue / OpenClaw inbox: compaction ate "confirm before acting"; hundreds of emails deleted before manual kill. Sources: TechBriefly, Windows Central.
• Production database wipes via coding agents: reported widely in the same news cycle AlphaSignal cited; root cause is always "destructive tool + prod credentials + no hard gate."
• OpenClaw compaction issues documented in GitHub issues and user reports of silent context loss.

If Meta's alignment director can lose safety instructions on a real inbox, your team's "please be careful" clause in CLAUDE.md is not enforcement.

What I would ship first on a new agent project

1. Never give the model raw production keys. Integration proxy or vault injection only. Non-negotiable.
2. Sandbox the process before you add the tenth integration. NemoClaw/OpenShell or equivalent container + egress policy.
3. Shrink or harden the runtime if the agent browses or parses files. Pull Echo-hardened NanoClaw or build a minimal image you can actually patch.
4. Put outbound HTTP behind a proxy before agents touch customer data. Start CrabTrap in audit mode, build policy from traffic, then enforce.
5. Require human approval for bulk writes (email delete, DROP TABLE, mass refund) at the tool or proxy layer, not in prose.

Skip the Span-sponsored "clearer prompts cut tokens 27%" pitch in the same newsletter. Prompt clarity saves money. It does not stop DELETE.

Bottom line

The industry is moving from prompt engineering to systems engineering for agents. Semantic guardrails are training for the model. Sandboxes, minimal runtimes, and network proxies are enforcement for the organization.

When a client asks me to "make the agent safer," I start with three questions: where it runs, what image it runs in, and what HTTP it can emit. Prompt edits come after those boundaries exist.

If you are deploying agents with real credentials this quarter, map your stack to those three layers before the next compaction event. Need a second pair of eyes on sandbox + proxy wiring for your harness? Book a free discovery call and we can walk your threat model with your actual tools.