ClawLess - AI Agent security framework launched by Southern University of Science and Technology and others

What is ClawLess

ClawLess is an AI Agent security framework jointly launched by the Southern University of Science and Technology and the Hong Kong University of Science and Technology. The framework is based on a "worst-case" threat model and, through formally verified security policies and BPF system call interception technology, provides OpenClaw、Claude Code and other autonomous agents with mathematical-grade security guarantees. The framework introduces linear temporal logic to implement dynamic permission control and uses an SMT solver to verify policy consistency. Without relying on the Agent's internal logic, it blocks privilege escalation and data leakage risks at the source of system calls.

ClawLess's main features

• Formal security modeling: Establishes a mathematical security model based on entities, scopes, and permissions, bringing system resources such as files, processes, and sockets into a unified formal definition framework.
• Dynamic temporal permission control: Introduces linear temporal logic to implement runtime dynamic policy adjustment, automatically tightening or loosening access permissions based on the Agent's historical behavior, avoiding static rules that overly restrict usability.
• SMT policy consistency verification: Uses an SMT solver (such as Z3) to perform automated formal reasoning on security policies, detecting and blocking logical conflicts such as violations of sandbox hierarchy constraints before configuration takes effect.
• BPF kernel call interception: Uses BPF programs mounted at kernel system call entry points to capture and verify every resource request in real time with native code performance, precisely intercepting unauthorized operations.
• External script sandbox isolation: Cuts out an independent execution domain with lower privileges inside the Agent's main container, applying least-privilege isolation to untrusted scripts downloaded from the network to prevent malicious payloads from moving laterally.

ClawLess's technical principles

• Worst-case threat modeling: Establishes an extreme threat model based on "capability assumptions" and "malicious assumptions," classifying the AI Agent and the entire container software stack it resides in as untrusted components, with security mechanisms not relying on the Agent's internal logic.
• User-space kernel isolation: Uses gVisor as a trusted monitoring layer, inserting a streamlined user-space kernel proxy between the untrusted Agent and the vulnerable host kernel to intercept and proxy almost all kernel interaction requests.
• Formal policy compilation: Designs a policy compiler to bridge the semantic gap between high-level formal permission models and low-level Linux system call interfaces, translating abstract security specifications item by item into concrete system call control rules.
• BPF system call interception: Uses the raw_tracepoint hook of BPF programs mounted to the sys_enter event, dispatching system call numbers to corresponding handlers through a tail call mechanism, completing permission verification and interception in kernel space.
• Credential visibility semantics: Introduces "Visible" permission to replace traditional read permission, enabling the Agent to reference credentials in the current execution domain to complete external service verification.

How to use ClawLess

• Deploy the isolation base: Deploy and configure a user-space kernel environment (such as gVisor) on a Linux host as the isolated container base on which the Agent runs.
• Define security policies: Use the ClawLess formal language to define the set of system entities, scope hierarchy, and required security policy propositions.
• Verify policy consistency: Invoke an SMT property verifier (such as Z3) to automatically reason over the policy configuration, ensuring there are no logical conflicts before entering the compilation process.
• Compilation Interception Rules: Run the ClawLess policy compiler to convert the verified formal model into the rules.json system call interception rules.
• Load Kernel Monitoring: Load the BPF monitoring program into kernel space to capture in real time all system calls initiated by the Agent through raw_tracepoint hooks.
• Real-time Permission Verification: The BPF program identifies the call number and checks it against the rule base, directly intercepting unauthorized operations in kernel mode, while allowing legitimate calls through.
• External Script Isolation: Automatically inject external scripts downloaded by the Agent at runtime into an external sandbox, restricting their execution scope using the principle of least privilege.

Key Information and Usage Requirements of ClawLess

• Development Team: Joint team from the Institute of Trustworthy Autonomous Systems of the Southern University of Science and Technology and the Department of Computer Science of the Hong Kong University of Science and Technology
• Paper Address: arXiv:2604.06284v1 (April 7, 2026)
• Core Technologies: Formal security model, linear temporal logic (LTL), SMT solver (Z3), BPF system call interception, user-space kernel (gVisor)
• Runtime Environment: Linux system, requires BPF support (relatively new kernel version)
• Target Objects: Autonomous AI Agents such as OpenClaw, Claude Code, and OpenCode
• Isolation Levels: Agent container (untrusted) + external script sandbox (lower privilege) + monitor (trusted)

Core Advantages of ClawLess

• Mathematical-grade Security Assurance: Based on formal verification and an SMT solver, ensuring there are no logical blind spots in the policy.
• Independent of the Agent's Internal Logic: Enforces interception at the system call level, disregarding LLM black-box behavior and jailbreak prompts.
• Dynamic and Adaptive: Linear temporal logic supports adjusting permissions at runtime based on behavioral history, balancing security and usability.
• Low Overhead and High Performance: Native execution in the BPF kernel, no need to modify kernel source code, supports hot updates of policies.
• Strong Compatibility: The user-space kernel approach preserves high interoperability with the host environment and does not affect the execution of Agent tasks.

ClawLess Project Address

• arXiv Technical Paper：https://arxiv.org/pdf/2604.06284v1

Comparison of ClawLess with Similar Competing Products

ClawLess application scenarios

• Enterprise-level AI programming assistant deployment: Prevents tools such as Claude Code and OpenClaw from accessing sensitive code repositories beyond their authority or leaking data when autonomously executing code.
• Cloud multi-tenant Agent services: Provides fine-grained isolation for different users' AI Agents, ensuring that malicious Agents cannot break through containers to attack the host or other tenants.
• Automated financial data processing: After an Agent reads a customer's sensitive financial information, automatically blocks its outbound network channels to prevent data leakage.
• Open-source agent security hardening: Provides out-of-the-box secure container encapsulation and policy verification tools for community-developed autonomous Agents.