💻 computer science

ClawLess: A Security Model of AI Agents

ClawLess is a security framework that ensures the safety of autonomous AI agents by enforcing formally verified, dynamic policies through a user-space kernel with BPF-based syscall interception, providing robust protection even against adversarial agents.

Original authors: Hongyi Lu, Nian Liu, Shuai Wang, Fengwei Zhang

Published 2026-04-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hongyi Lu, Nian Liu, Shuai Wang, Fengwei Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you hire a brilliant, hyper-energetic robot assistant (an AI Agent) to do your chores. You tell it, "Go online, find the best recipe, buy the ingredients, and cook dinner."

The problem? This robot is so smart and autonomous that it can also:

Read your private diary.
Delete your bank account.
Download a virus disguised as a "free cookie."
Or, worse, it might get tricked by a malicious website into thinking it needs to "hack the mainframe" to make a better cake.

Traditional security is like putting a lock on your front door. But if your robot assistant has the keys and decides to walk right out, the lock doesn't matter.

ClawLess is a new security system designed to stop this robot from causing chaos, even if the robot itself turns evil or gets tricked. Here is how it works, using simple analogies:

1. The "Worst-Case" Mindset

Most security systems assume the robot is good and just needs a little guidance. ClawLess assumes the robot is already a spy.

The Analogy: Imagine you are a parent. Instead of hoping your teenager won't drive the car into a wall, you assume they will try to drive it into a wall. So, you don't just give them a "Don't crash" sticker; you install a governor on the engine that physically prevents the car from going faster than 10 mph, no matter how hard they press the gas.
The Goal: ClawLess doesn't try to "train" the AI to be good. It builds a cage that makes it impossible for the AI to do harm, even if it wants to.

2. The "Three-Layered" Security Model

ClawLess divides the world into three distinct zones, like a high-security bank:

The Monitor (The Bank Vault): The most trusted part. This is the security system itself (the software that watches the AI). It sees everything.
The Agent (The Customer): The AI itself. It can ask for things, but it can't just take them.
The Sandbox (The Glass Booth): A tiny, isolated room where the AI can try out dangerous things (like running a downloaded script) without touching the real world.

The Golden Rule: The "Glass Booth" (Sandbox) can never have more power than the "Customer" (Agent), and the "Customer" can never have more power than the "Bank Vault" (Monitor). This prevents the AI from accidentally (or on purpose) breaking out of its own cage.

3. The "Magic Translator" (Formal Verification)

One of the hardest parts of security is that humans speak in vague ideas ("Don't touch the files"), but computers speak in specific code ("Allow read command on /etc/passwd").

The Analogy: Imagine you write a rule in English: "No eating the cake." A computer might interpret that as "You can eat the cake, but only with a fork."
The Solution: ClawLess uses a Mathematical Translator. It takes your security rules and turns them into a strict, unbreakable math equation. Before the AI is even allowed to start, a "Math Police" (called an SMT solver) checks the equation to make sure the rules actually make sense and don't have loopholes. If the math says "This rule is dangerous," the system rejects it immediately.

4. The "Traffic Cop" (BPF & Syscall Interception)

Once the AI is running, how does ClawLess stop it from doing bad things in real-time?

The Analogy: Imagine the AI is a delivery driver. Every time it wants to open a door, pick up a package, or make a phone call, it has to stop at a Traffic Cop.
How it works: The Traffic Cop (using a technology called BPF) stands between the AI and your computer's operating system.
- If the AI says, "I want to read your password file," the Cop checks the rulebook. If the rule says "No reading passwords," the Cop slams the brakes and says, "Denied!"
- If the AI says, "I want to read a recipe," the Cop says, "Go ahead."
The Cool Part: This Traffic Cop is so fast and lightweight that the AI doesn't even notice it's there. It happens instantly, every single time the AI tries to touch your computer.

5. The "Invisible Credential" Trick

AI agents often need passwords to log into websites to do their jobs. But if you give the AI the password, it might accidentally (or maliciously) leak it.

The Analogy: Imagine you need to let the robot into a secure building, but you don't want it to see the key code.
The Solution: ClawLess gives the robot a "Magic Key" that it can use to open the door, but it cannot see or copy the key itself. The robot knows that it has access, but it never sees the actual secret code. This prevents the AI from stealing your credentials even if it gets hacked.

Summary: Why is this a big deal?

Before ClawLess, we tried to secure AI by hoping it would behave (training) or by putting it in a generic box (Docker containers). But if the AI is smart enough to break the box, we are in trouble.

ClawLess changes the game by saying:

"We don't care if you are smart, evil, or tricked. We have built a mathematical cage that physically prevents you from touching anything you aren't allowed to. You can do your job, but you can never break the rules."

It turns AI security from a game of "trust" into a game of "math and physics," ensuring that no matter what the AI tries, it simply cannot hurt your system.

Based on the paper "ClawLess: A Security Model of AI Agents," here is a detailed technical summary covering the problem, methodology, key contributions, results, and significance.

1. Problem Statement

Autonomous AI agents powered by Large Language Models (LLMs) can reason, plan, and execute complex tasks (e.g., retrieving information, running code). However, this autonomy introduces severe security risks that traditional mechanisms cannot address:

Ambiguous Trust Boundaries: Unlike traditional software that accesses fixed endpoints, AI agents retrieve data from diverse, untrusted sources, blurring the line between trusted and untrusted inputs.
Privilege vs. Usability Trade-off: Agents require broad privileges (file access, network, execution) to function, but granting these creates high risks. Traditional "least privilege" models are too restrictive for dynamic agent tasks.
Inadequacy of Existing Defenses:
- Static Analysis: Infeasible due to the non-deterministic nature of LLM outputs.
- Sandboxing (e.g., Docker): Relies on the host Linux kernel, inheriting its vulnerabilities (e.g., container escapes via 0-day exploits).
- Training/Prompting: Relying on the agent to "behave" is unreliable; agents can be manipulated via malicious online content (prompt injection) to act adversarially.

Core Challenge: How to secure an AI agent under a "worst-case" threat model where the agent itself may become adversarial, without relying on its internal cooperation or understanding its internal logic.

2. Methodology: The ClawLess Framework

ClawLess is a security framework that enforces formally verified policies on AI agents using a combination of formal modeling, policy compilation, and runtime enforcement.

A. Threat Model & Assumptions

Assumption of Capabilities: AI agents can execute sophisticated attacks against any security mechanism.
Assumption of Maliciousness: Agents will eventually be lured into malicious behavior due to exposure to unsanitized inputs.
Trusted Components: The enforcement infrastructure (e.g., user-space kernel like gVisor, hardware) is assumed trustworthy.
Untrusted Components: The AI agent, its internal stack, and any external scripts it downloads are treated as untrusted.

B. Formal Security Model

ClawLess defines a fine-grained security model comprising:

Entities: System objects such as files, processes, sockets, and devices.
Scopes: Three isolation levels:
- Sandbox: For external scripts downloaded by the agent.
- Agent: The AI agent itself.
- Monitor: The trusted enforcement layer (e.g., gVisor).
Permissions: A set of operations including Read, Write, Append, NoExecute, and Visible.
- Key Innovation (Visible): Allows an agent to reference a credential (e.g., an API key) without accessing its content, preventing data leakage while maintaining functionality.
- Key Innovation (NoExecute): Inverts the standard execution permission logic to ensure higher-trusted scopes have stricter control over execution.
Temporal Logic: To address dynamic behavior, permissions are augmented with temporal arguments (e.g., "if the agent reads a sensitive file at time $t$ , it must not write to an outbound socket at any future time"). This prevents data exfiltration patterns that static models miss.

C. Policy Enforcement Architecture

The system bridges the gap between high-level formal models and low-level system operations:

Policy Compiler: Translates abstract formal rules (expressed in Satisfiability Modulo Theories - SMT) into concrete Linux system call rules. It maps high-level permissions (e.g., Read) to specific syscalls (e.g., read, open, sendfile).
Runtime Monitor (User-Space Kernel):
- Utilizes a User-Space Kernel (e.g., gVisor) to isolate the agent from the host kernel, mitigating kernel vulnerabilities.
- Employs Berkeley Packet Filter (BPF) to intercept system calls (sys_enter).
- Mechanism: When the agent invokes a syscall, the BPF program checks the arguments (e.g., file path, socket destination) against the compiled policy rules. If a violation is detected (e.g., writing to a socket after reading a secret), the syscall is blocked.
External Sandbox: A secondary, more restrictive sandbox environment is automatically created for any external scripts the agent attempts to execute, ensuring they run with a subset of the agent's permissions.

3. Key Contributions

Comprehensive Security Analysis: The first work to propose a holistic security analysis for autonomous AI agents based on two fundamental assumptions: agents can attack and will eventually become malicious.
Formal Fine-Grained Model: A novel security model defining entities, scopes, and temporal permissions that adapts to runtime behavior, preventing data leakage and privilege abuse.
ClawLess Framework: A practical implementation that enforces formally verified policies via a user-space kernel and BPF-based syscall interception.
Worst-Case Guarantee: Ensures security regardless of the agent's internal design, implementation, or whether it has been compromised, by relying on external enforcement rather than internal trust.

4. Results and Evaluation

Security Guarantees: The framework successfully enforces policies that prevent common attack vectors, such as:
- Data Exfiltration: Blocking outbound network writes if sensitive files were recently read.
- Credential Leakage: Allowing agents to use credentials (Visible) without exposing the actual secret strings.
- Script Execution: Forcing all downloaded scripts into a restricted sandbox.
Usability: By using temporal logic and the Visible permission, the system maintains high usability, allowing agents to perform complex tasks without being overly restricted by static "all-or-nothing" rules.
Validation: The use of SMT solvers (e.g., Z3) allows developers to verify that their security configurations are logically consistent and free of contradictions before deployment.

5. Significance

Paradigm Shift: Moves AI security from "regulating behavior via training/prompting" (which is unreliable) to "enforcing external, mathematically verified constraints."
Practical Deployment: Unlike virtualization or Confidential Computing (TEE) which have high deployment overhead or hardware requirements, ClawLess uses user-space kernels and BPF, making it deployable in standard cloud environments without special hardware.
Foundational for Future AI: As AI agents become more autonomous and capable of modifying their own code or environment, ClawLess provides a necessary "brake" that ensures safety even if the agent's reasoning logic is compromised. It establishes a principled foundation for securing the next generation of autonomous software.