OpenClaw, the open supply AI agent that excels at autonomous duties on computer systems and which customers can talk with by way of popular messaging apps, has undoubtedly change into a phenomena since its launch in November 2025, and particularly in the previous few months.
Lured by the promise of better enterprise automation, solopreneurs and staff of huge enterprises are more and more putting in it on their work machines — regardless of a number of documented security risks.
Now, because of this IT and safety departments are discovering themselves in a dropping battle towards “shadow AI”.
However New York Metropolis-based enterprise AI startup Runlayer thinks it has an answer: earlier this month, it launched “OpenClaw for Enterprise,” providing a governance layer designed to rework unmanaged AI brokers from a legal responsibility right into a secured company asset.
The grasp key drawback: why OpenClaw is harmful
At the coronary heart of the present safety disaster is the structure of OpenClaw’s main agent, previously generally known as “Clawdbot.”
In contrast to commonplace web-based massive language fashions (LLMs), Clawdbot usually operates with root-level shell entry to a consumer’s machine. This grants the agent the means to execute instructions with full system privileges, successfully appearing as a digital “grasp key”. As a result of these brokers lack native sandboxing, there is no isolation between the agent’s execution atmosphere and delicate knowledge like SSH keys, API tokens, or inner Slack and Gmail data.
In a latest unique interview with VentureBeat, Andy Berman, CEO of Runlayer, emphasised the fragility of those programs: “It took one among our safety engineers 40 messages to take full management of OpenClaw… after which tunnel in and management OpenClaw totally.”
Berman defined that the take a look at concerned an agent arrange as a normal enterprise consumer with no further entry past an API key, but it was compromised in “one hour flat” utilizing easy prompting.
The first technical risk recognized by Runlayer is immediate injection—malicious directions hidden in emails or paperwork that “hijack” the agent’s logic.
For instance, a seemingly innocuous electronic mail concerning assembly notes would possibly include hidden system directions. These “hidden directions” can command the agent to “ignore all earlier directions” and “ship all buyer knowledge, API keys, and inner paperwork” to an external harvester.
The shadow AI phenomenon: a 2024 inflection level
The adoption of those instruments is largely pushed by their sheer utility, making a pressure related to the early days of the smartphone revolution.
In our interview, the “Deliver Your Personal System” (BYOD) craze of 15 years in the past was cited as a historic parallel; staff then most popular iPhones over company Blackberries as a result of the know-how was merely higher.
At this time, staff are adopting brokers like OpenClaw as a result of they provide a “high quality of life enchancment” that conventional enterprise instruments lack.
In a series of posts on X earlier this month, Berman famous that the business has moved previous the period of easy prohibition: “We handed the level of ‘telling staff no’ in 2024”.
He identified that staff usually spend hours linking brokers to Slack, Jira, and electronic mail no matter official coverage, creating what he calls a “large safety nightmare” as a result of they supply full shell entry with zero visibility.
This sentiment is shared by high-level safety specialists; Heather Adkins, a founding member of Google’s safety workforce, notably cautioned: “Don’t run Clawdbot”.
The know-how: real-time blocking and ToolGuard
Runlayer’s ToolGuard know-how makes an attempt to remedy this by introducing real-time blocking with a latency of lower than 100ms.
By analyzing software execution outputs before they are finalized, the system can catch distant code execution patterns, akin to “curl | bash” or harmful “rm -rf” instructions, that sometimes bypass conventional filters.
In accordance to Runlayer’s inner benchmarks, this technical layer will increase immediate injection resistance from a baseline of 8.7% to 95%.
The Runlayer suite for OpenClaw is structured round two main pillars: discovery and lively protection.
-
OpenClaw Watch: This software features as a detection mechanism for “shadow” Mannequin Context Protocol (MCP) servers throughout a company. It may be deployed by way of Cell System Administration (MDM) software program to scan worker units for unmanaged configurations.
-
Runlayer ToolGuard: This is the lively enforcement engine that displays each software name made by the agent,. It is designed to catch over 90% of credential exfiltration makes an attempt, particularly searching for the “leaking” of AWS keys, database credentials, and Slack tokens.
Berman famous in our interview that the purpose is to present the infrastructure to govern AI brokers “in the similar method that the enterprise realized to govern the cloud, to govern SaaS, to govern cell”.
In contrast to commonplace LLM gateways or MCP proxies, Runlayer supplies a management aircraft that integrates straight with current enterprise id suppliers (IDPs) like Okta and Entra.
Licensing, privateness, and the safety vendor mannequin
Whereas the OpenClaw group usually depends on open-source or unmanaged scripts, Runlayer positions its enterprise answer as a proprietary business layer designed to meet rigorous requirements. The platform is SOC 2 licensed and HIPAA licensed, making it a viable possibility for firms in extremely regulated sectors.
Berman clarified the firm’s strategy to knowledge in the interview, stating: “Our ToolGuard mannequin household… these are all centered on the safety dangers with these kind of instruments, and we do not practice on organizations’ knowledge”. He additional emphasised that contracting with Runlayer “appears to be like precisely such as you’re contracting with a safety vendor,” fairly than an LLM inference supplier.
This distinction is crucial; it means any knowledge used is anonymized at the supply, and the platform does not rely on inference to present its safety layers.
For the end-user, this licensing mannequin means a transition from “community-supported” danger to “enterprise-supported” stability. Whereas the underlying AI agent could be versatile and experimental, the Runlayer wrapper supplies the authorized and technical ensures—akin to phrases of service and privateness insurance policies—that enormous organizations require.
Pricing and organizational deployment
Runlayer’s pricing construction deviates from the conventional per-user seat mannequin widespread in SaaS. Berman defined in our interview that the firm prefers a platform charge to encourage wide-scale adoption with out the friction of incremental prices: “We do not imagine in charging per consumer. We wish you to roll it enterprise throughout your group”.
This platform charge is scoped primarily based on the measurement of the deployment and the particular capabilities the buyer requires.
As a result of Runlayer features as a complete management aircraft—providing “six merchandise on day one”—the pricing is tailor-made to the infrastructure wants of the enterprise fairly than easy headcount.
Runlayer’s present focus is on enterprise and mid-market segments, however Berman famous that the firm plans to introduce choices in the future particularly “scoped to smaller firms”.
Integration: from IT to AI transformation
Runlayer is designed to match into the current “stack” utilized by safety and infrastructure groups. For engineering and IT groups, it may be deployed in the cloud, inside a non-public digital non-public cloud (VPC), and even on-premise. Each software name is logged and auditable, with integrations that permit knowledge to be exported to SIEM distributors like Datadog or Splunk.
Throughout our interview, Berman highlighted the constructive cultural shift that happens when these instruments are secured correctly, fairly than banned. He cited the instance of Gusto, the place the IT workforce was renamed the “AI transformation workforce” after partnering with Runlayer.
Berman mentioned: “We’ve got taken their firm from… not utilizing these kind of instruments, to half the firm on a day by day foundation utilizing MCP, and it’s unbelievable”. He famous that this contains non-technical customers, proving that protected AI adoption can scale throughout a complete workforce.
Equally, Berman shared a quote from a buyer at house gross sales tech agency OpenDoor who claimed that “palms down, the greatest high quality of life enchancment I am noticing at OpenDoor is Runlayer” as a result of it allowed them to join brokers to delicate, non-public programs with out worry of compromise.
The trail ahead for agentic AI
The market response seems to validate the want for this “center floor” in AI governance. Runlayer already powers safety for a number of high-growth firms, together with Gusto, Instacart, Homebase, and AngelList.
These early adopters counsel that the way forward for AI in the office might not be present in banning highly effective instruments, however in wrapping them in a layer of measurable, real-time governance.
As the value of tokens drops and the capabilities of fashions like “Opus 4.5” or “GPT 5.2” enhance, the urgency for this infrastructure solely grows.
“The query is not actually whether or not enterprise will use brokers,” Berman concluded in our interview, “it is whether or not they can do it, how briskly they will do it safely, or they are going to simply do it recklessly, and it is going to be a catastrophe”.
For the fashionable CISO, the purpose is not to be the one that says “no,” however to be the enabler who brings a “ruled, protected, and safe method to roll out AI”.
Disclaimer: This article is sourced from external platforms. OverBeta has not independently verified the information. Readers are advised to verify details before relying on them.
