The Agent Pyramid: Power Without Guardrails
OpenClaw's architecture recognizes complex tasks and dynamically spawns sub-agents to handle sub-tasks. Each agent can use tools — shell_exec, file operations, network requests, browser control — with the same permissions as the parent. There is no built-in least-privilege enforcement. A compromised parent agent can spawn child agents that inherit full access.
This is exactly the scenario 1-SEC's AI Agent Containment module was built for.
Policy Engine: Blocking Dangerous Tools by Default
The containment module ships with a default policy that blocks high-risk tools: shell_exec, system_command, raw_sql, file_delete, network_scan, credential_access, registry_edit, firewall_modify, and user_create. It also pattern-matches dangerous actions like "delete database", "drop table", "rm -rf", and "disable firewall".
Sensitive targets are protected too: /etc/shadow, /etc/passwd, .ssh/, .aws/credentials, .env, secrets.yaml, and private key files all trigger CRITICAL alerts when an agent attempts to access them.
Behavioral Anomaly Detection
Beyond static policies, the Agent Tracker builds behavioral profiles for each agent over time.
Rapid Action Bursts
If an agent performs more than 100 actions per minute, it triggers a HIGH severity alert. This catches compromised agents that are rapidly exfiltrating data or scanning the file system.
New Tool Usage After Baseline
After a one-hour baseline period, any new tool usage triggers a MEDIUM alert. If your email agent suddenly starts using shell_exec, something is wrong.
Scope Escalation Detection
The tracker monitors the sensitivity of targets an agent accesses. If 3 out of the last 5 targets contain keywords like admin, root, secret, credential, password, token, or key, it raises a HIGH scope escalation alert. This catches the gradual privilege escalation pattern used by sophisticated attackers.
Shadow AI Detection
OpenClaw agents can make API calls to any AI provider. The Shadow AI Detector maintains a list of known AI endpoints (OpenAI, Anthropic, Google, Cohere, Mistral, HuggingFace, Replicate, Together, Groq, Perplexity, DeepSeek) and flags any unauthorized calls. If your agent starts talking to an AI service you didn't configure, 1-SEC catches it immediately.