NemoClaw

NemoClaw is NVIDIA's Apache 2.0 reference stack for running always-on AI agents inside a hardened OpenShell sandbox. It enforces filesystem, process, network and inference policy at the infrastructure layer rather than in the prompt, so a compromised or manipulated agent cannot talk its way past its own guardrails. Announced at GTC in March 2026.

NemoClaw is NVIDIA's open-source reference stack for running always-on AI agents inside a hardened sandbox, announced at GTC on 16 March 2026 and published under Apache 2.0 at github.com/NVIDIA/NemoClaw. It exists because the popular open-source agent OpenClaw - which automates multi-step desktop work such as organising local files and performing web research - runs with the same privileges as the user who starts it. NemoClaw moves the control point outside the agent entirely: policy is enforced by host infrastructure, not by prompt instructions a model could be argued out of. The stack has four parts. A TypeScript CLI plugin drives setup on the host machine. A versioned Python 'blueprint' artifact manages sandbox creation and policy configuration through a four-stage lifecycle. The OpenShell sandbox isolates the agent using Linux Landlock, seccomp and network namespaces, confining filesystem access to /sandbox and /tmp and blocking privilege escalation and dangerous syscalls at creation time. A privacy router intercepts model calls and keeps sensitive prompts on local models while routing the rest to cloud endpoints such as NVIDIA's nemotron-3-super-120b-a12b. Network rules are written in YAML and hot-reloadable at runtime; filesystem and process rules are deliberately immutable once a sandbox exists, so a compromised agent cannot rewrite its own cage. It runs on GeForce RTX, RTX PRO workstations, DGX Spark and DGX Station, needs Ubuntu 22.04+ with Docker and Node 20+ (macOS via Colima or Docker Desktop), and ships supported profiles for OpenClaw, Nous Research's Hermes and LangChain Deep Agents. NVIDIA labels the project alpha with unstable APIs and best-effort maintainer support.

Category

AI Agents & Orchestration

Pricing

Free

Target Market

CISOs, CTOs, Platform Engineers, AI Infrastructure Leads, Security Architects

Deployment

Open-source, Self-hosted, Edge-first, Hybrid

Founded

1993

Headquarters

Santa Clara, United States

Team Size

500+

• ✓
  OpenShell kernel-level sandbox

  Uses Linux Landlock, seccomp and network namespaces to confine the agent to /sandbox and /tmp and block dangerous syscalls.

• ✓
  Immutable filesystem and process policy

  Those rules are locked at sandbox creation, so an agent that is compromised mid-run cannot widen its own permissions.

• ✓
  Hot-reloadable YAML network policy

  Outbound connection rules are declarative and can be changed at runtime without restarting a long-running agent.

• ✓
  Privacy router for inference

  Intercepts model calls and keeps sensitive prompts on local models, sending only permitted traffic to cloud LLM endpoints.

• ✓
  Versioned Python blueprints

  Sandbox creation and policy live in a versioned artifact with a four-stage lifecycle, so agent environments are reproducible and reviewable.

• ✓
  Multi-agent profiles

  Ships tuned configurations for OpenClaw, Nous Research's Hermes and LangChain Deep Agents rather than supporting a single runtime.

• •
  Governed desktop agent pilot

  Let an always-on agent organise files and run research on employee machines while the kernel prevents access to anything outside its working directories.

• •
  Data-exfiltration containment

  Network namespace policy blocks unauthorised outbound connections, so an injected instruction to POST data somewhere simply fails.

• •
  Hybrid local/cloud inference for sensitive prompts

  The privacy router keeps regulated content on a local Nemotron model and sends only non-sensitive reasoning to a frontier cloud API.

• •
  Cost reduction through model routing

  NVIDIA reports the hybrid pattern of specialised local models plus frontier orchestration can cut query costs by more than 50%.

• •
  Reproducible agent environments

  Versioned blueprints give security review a concrete artifact to sign off rather than an ad-hoc developer machine configuration.

NemoClaw itself is free and Apache 2.0 licensed with no paid tier, no hosted control plane and no published enterprise SKU - the entire stack installs from GitHub or a single terminal command. The real cost is hardware and inference: local agent compute assumes NVIDIA silicon (GeForce RTX, RTX PRO workstation, DGX Spark or DGX Station), and any cloud model the privacy router forwards to is billed by that provider separately. NVIDIA positions it inside the broader NVIDIA AI Enterprise ecosystem, so production support and the surrounding NeMo tooling are where commercial terms eventually appear.

This page was written from 5 sources, 4 on domains other than nvidia.com.

1. 1.nvidia.com — nemoclawvendor
2. 2.github.com — NemoClaw
3. 3.siliconangle.com — nvidia launches nemoclaw agent toolkit enhance ai agents
4. 4.dev.to — nemoclaw nvidias open source stack for running ai agents you
5. 5.yottalabs.ai — what is nemoclaw nvidia s ai agent platform explained