OpenClaw Adds Filesystem Sandboxing and Network Policy Controls.

OpenClaw has rolled out a new set of security features designed to give users tighter control over what its AI agents can access and modify on their machines.

The update centers on four capabilities: fs-safe for root-bounded filesystem operations, Proxyline for policy-driven network egress, ClawHub trust evidence for plugin verification, and refined command approval workflows. Together, these features aim to make OpenClaw's powerful local agent runtime more auditable and safer for everyday use.

The fs-safe feature restricts agent filesystem access to a defined root directory, preventing operations outside that boundary. This addresses a core concern with AI agents that operate locally: giving them enough access to be useful without exposing your entire system.

Proxyline, meanwhile, introduces policy-driven controls for outbound network requests. Users can now define which domains or endpoints an agent can reach, blocking unauthorized data exfiltration or unintended API calls. The feature builds on lessons from recent security work, as outlined in OpenClaw's May blog post on hardening the agent runtime.

These controls arrive after a rough week in late April when OpenClaw shipped controversial changes around execution permissions. The team has since focused heavily on balancing power with transparency.

ClawHub, OpenClaw's plugin marketplace, now surfaces trust evidence for each skill or tool extension. This includes static analysis results, VirusTotal scans (following their February partnership announcement), and community reputation signals.

The goal is to help users assess risk before installing plugins that will have access to local files, chat history, or network resources. OpenClaw's open-source model makes auditing possible, but most users lack time or expertise to review code line-by-line.

Smarter approval prompts also debuted in this release. Instead of simple yes/no dialogs, OpenClaw now shows context about what a command will affect, which files or directories are in scope, and whether network access is required. These prompts adapt based on the action's risk level, reducing noise for low-stakes operations while surfacing detail when it matters.

AI agents that run locally and operate across chat apps, files, and system commands need strong default protections. Unlike cloud-based assistants that execute in controlled environments, tools like OpenClaw blur the line between helpful automation and potential system access.

The challenge is making guardrails strict enough to prevent mistakes or abuse, but flexible enough that the agent remains useful. OpenClaw's approach—sandboxed filesystem boundaries, explicit network policies, auditable plugin trust signals—represents one path toward that balance.

The update follows a broader trend in the agentic AI space. As tools like Cursor and Windsurf give AI more direct control over codebases, developers are rethinking permission models and approval flows. OpenClaw's focus on local execution makes these questions even more urgent.

The new security features are available now in the latest OpenClaw release. Users running older versions can upgrade through the standard update flow. Full documentation on configuring fs-safe and Proxyline policies is available on OpenClaw's GitHub repository.