OpenClaw security is about the bot that bridges Discord, WhatsApp, Telegram, Signal — and holds keys. Model safety features do not replace runtime isolation.
We host OpenClaw. This post is protect your agent, never "don't use OpenClaw."
What people mean by the query
They have seen:
- Exposed agent instances on the public internet
- CVE chatter around agent stacks
- Horror stories of bots with over-scoped tokens
They want a practical answer: how do I run OpenClaw without making my chat bridges everyone else's problem?
Threat model in one screen
| Asset | Risk if shared-kernel / shared host |
|---|---|
| Channel tokens | Cross-tenant or host-level leak |
| Model keys | Same |
| Conversation history | Persist on a disk others can mount |
| Plugins / skills | Malicious or buggy code with shell reach |
Shared Docker density is the wrong default for that table.
The jurniti posture
- One Firecracker microVM per tenant — KVM boundary, not a shared kernel story
- BYOK — keys inside the guest; no platform model proxy
- Persistent workspace — state survives restart; snapshot/fork when you need a clean golden box
- Public TLS subdomain for the UI without you babysitting certs
That is managed agent ops for OpenClaw, not a lecture against the project.
What we will not claim
- That OpenClaw is "insecure" as a brand
- That any host makes prompt injection impossible
- That free forever compute is how serious isolation gets paid for
Related
- Self-host OpenClaw guide (informational)
- MCP security
- AI agent security
From $25/mo, 30-day money-back on first purchase.