Agent Safety with NemoClaw

Why it matters

An agent that runs unattended needs limits it cannot change. This module tests which limits the runtime enforces and which ones rely on the agent’s own cooperation.

What to practise

Write an OpenShell egress policy and observe the deny, then test why an access: read-only rule still lets a GET carry data out. Probe the Landlock filesystem containment and the process hardening (seccomp, non-root, dropped capabilities), which are fixed when the sandbox is created. Confirm the agent holds no vendor keys, then add a direct allow rule for a provider host and observe how egress policy can still route around inference.local. Inspect and change the operator-controlled inference route. Finally, run the red-team probes with canary secrets and score each completed answer with an LLM judge.

How it fits

The network, filesystem and process layers are 9.1.2’s sandbox controls. Credential isolation through the gateway is 9.1.1’s subject. The bypass exercise shows the decision both Bites share: one control alone does not confine an agent.