… If someone sends you an email that contains a carefully crafted prompt injection, and your OpenClaw agent processes that email, the sandbox won't help. The agent isn't escaping containment, it's operating within its approved boundaries while doing something you didn't authorize. …
… Rather than relying on behavioral prompts or in-agent guardrails which, as OpenClaw's vulnerabilities demonstrate, can simply be bypassed , OpenShell enforces constraints on the environment the agent runs in. …
… The gateway is still an attack surface to think about, and prompt injection isn't solved by anyone yet nor does it look like it ever can be , but Hermes treats security as a starting constraint where OpenClaw treats it as a bug class to triage later. …
… Finally, the model also shows significant improvement in agentic safety, meaning it's a lot better at recognizing and refusing prompt injection attacks when you're using it as an agent. …
… They leak in CI logs, or they get scraped in supply-chain attacks, or, sometimes, they're just sitting in plain sight. …
… Names, email addresses, the custom prompts users had written to make their profiles, and enough personal information to be properly dangerous. …