OpenClaw: The Rise of Shadow AI and the Enterprise Response
The open-source AI agent OpenClaw, initially known as Clawdbot or Moltbot, has rapidly gained traction since its launch in November 2025. Lured by the promise of increased automation, individuals and organizations are increasingly deploying it on work machines, despite documented security risks. This surge in adoption has created a challenge for IT and security departments battling “shadow AI,” but a new solution has emerged: Runlayer’s “OpenClaw for Enterprise,” a governance layer designed to transform unmanaged AI agents into secured corporate assets.
The Master Key Problem: Why OpenClaw is Dangerous
The core of the current security concerns lies in the architecture of OpenClaw’s primary agent. Unlike typical web-based large language models (LLMs), Clawdbot often operates with root-level shell access to a user’s machine. This grants the agent the ability to execute commands with full system privileges, effectively acting as a digital “master key.” Given that these agents lack native sandboxing, there is no isolation between the agent’s execution environment and sensitive data such as SSH keys, API tokens, or internal communications records.
Runlayer CEO Andy Berman, in an interview with VentureBeat, highlighted the system’s fragility, stating that one of their security engineers gained full control of OpenClaw with just 40 messages in under an hour, even with an agent set up as a standard business user with limited access Swift Company.
A primary technical threat identified by Runlayer is prompt injection—malicious instructions hidden within emails or documents that hijack the agent’s logic. These hidden instructions can command the agent to exfiltrate sensitive data.
The Shadow AI Phenomenon: A 2024 Inflection Point
The adoption of tools like OpenClaw is driven by their utility, mirroring the early days of the smartphone revolution. As Berman noted, the industry passed the point of simply prohibiting these tools in 2024. Employees are increasingly connecting agents to platforms like Slack, Jira, and email, regardless of official policy, creating a significant security risk due to the full shell access granted with zero visibility Kaspersky. Security expert Heather Adkins cautioned against running Clawdbot altogether.
Runlayer’s Technology: Real-Time Blocking and ToolGuard
Runlayer’s ToolGuard technology attempts to address these risks with real-time blocking, achieving a latency of less than 100ms. By analyzing tool execution outputs, the system can detect remote code execution patterns and destructive commands that bypass traditional filters. Runlayer claims this increases prompt injection resistance from a baseline of 8.7% to 95%.
The Runlayer suite for OpenClaw centers around two key components:
- OpenClaw Watch: A detection mechanism for unmanaged Model Context Protocol (MCP) servers across an organization, deployable via Mobile Device Management (MDM) software.
- Runlayer ToolGuard: An active enforcement engine that monitors every tool call made by the agent, designed to catch over 90% of credential exfiltration attempts.
Licensing, Privacy, and the Security Vendor Model
While the OpenClaw community often relies on open-source scripts, Runlayer positions its enterprise solution as a proprietary commercial layer meeting rigorous standards. The platform is SOC 2 and HIPAA certified, making it suitable for regulated sectors. Runlayer emphasizes that its ToolGuard models focus on security risks and do not train on organizational data, and that contracting with Runlayer is akin to contracting with a security vendor, ensuring data anonymization and adherence to privacy policies.
Pricing and Organizational Deployment
Runlayer’s pricing structure is based on a platform fee, encouraging wide-scale adoption without per-user costs. The fee is tailored to the size of the deployment and the required capabilities. While currently focused on enterprise and mid-market segments, Runlayer plans to introduce offerings for smaller companies in the future.
Integration and Cultural Shift
Runlayer is designed to integrate with existing security and infrastructure tools, offering logging and auditability with integrations for SIEM vendors like Datadog and Splunk. Berman highlighted a positive cultural shift when these tools are secured, citing an example where a customer’s IT team was renamed the “AI transformation team” after partnering with Runlayer. Another customer at OpenDoor reported a significant quality of life improvement thanks to Runlayer’s ability to connect agents to sensitive systems securely.
The Path Forward for Agentic AI
Runlayer already provides security for companies like Gusto, Instacart, Homebase, and AngelList. As the cost of tokens decreases and model capabilities increase, the need for this type of infrastructure will only grow. Berman concluded that the question is not whether enterprises will use agents, but whether they can do so safely and quickly, or risk a disastrous outcome OBGIST.