Securing persistent agents like OpenClaw at OpenAI
When OpenClaw launched almost a year ago, it showed the world the capabilities of a persistent agent. Unlike regular codex sessions which involve a fixed goal and human steering, persistent agents run 24/7 with a broad scope and the ability to proactively take actions without user input. While persistent agents are extremely capable, their real world deployment has been limited to date. These deployments present many novel challenges compared to traditional software. With traditional software, we have relied on configuration and code to be deterministic and for threats to come (mostly) from external attackers. Persistent agents can change their configuration and write arbitrary code to accomplish a goal. Attacks come from the inside when agents take misaligned actions. At OpenAI, we currently have persistent agents deployed across the entire company, including hundreds of OpenClaw agents. This post covers some of the controls we’ve adopted to enable OpenClaw deployments at OpenAI. Separate trusted and untrusted execution In order to secure persistent agents, we needed to isolate trusted deterministic logic from un-trusted LLM execution. Trusted logic includes critical components like networking, identity, and sandboxing. This is traditional static code that, outside of software bugs, should behave as configured. Agents, the environment they execute in, and the code they write are considered untrusted. This is an environment where agents can dynamically generate code to accomplish a goal with no hard guarantees on behavior. To support this in OpenClaw, we ended up implementing remote harness execution in the open source project. This enabled the OpenClaw Gateway to run in a separate container (and in our case, a separate cluster), from the agent harness. By implementing…