IronClaw: a Rust-based clawd that runs tools in isolated WASM sandboxes

https://github.com/nearai/ironclaw

56•dawg91•3h ago

Comments

friendofmine•3h ago

Huh what's the benefit

dawg91•2h ago

It's a hardened, security-first implementation. WASM runtime specifically is for isolating tool sandboxes

verdverm•1h ago

WASM has issues with certain languages, why WASM and not OCI?

ForHackernews•55m ago

Docker is not a security boundary?

dawg91•1h ago

Fun fact: it's being developed by one of the authors of "Attention is all you need"

ramoz•47m ago

worth mentioning an additional credential/or-not, the creator of "the platform powering the agentic future" (blockchain) https://www.near.org/

edtechdev•16m ago

which explains why this tool requires a NEAR AI account to use

whalesalad•1h ago

vibe coded eh https://github.com/nearai/ironclaw?tab=readme-ov-file#archit...

dawg91•40m ago

I think the guys who are developing this (Illia Polosoukhin of "Attention is all you need") and others knows enough to leverage their skills with AI vs. producing slop

lenwood•1h ago

Awesome to see a project deal with prompt injection. Using a WASM is clever. How does this ensure that tools adhere to capability-based permissions without breaking the sandbox?

frolvlad•1h ago

Instead of expecting the tools to adhere, they are enforced. For example, to make an HTTP call with a secret key, the tool must use the proxy service that will enforce that the secret key is only used for the specific domain, if that is allowed, then the proxy service will make the call, thus the secret never leaks outside of the service.

However, this design is still under development as it creates quite a bit of challenges.

jonny_eh•1h ago

> Using a WASM is clever

Every time a project is shared that uses WASM.

MarkMarine•1h ago

Clearly this developer knows the trick of developing with ai: adding “… and make it secure” to all your prompts. /s

wyck•25m ago

You mean llia Polosukhin, who is recognized as an AI founder and co‑authored the landmark 2017 paper “Attention Is All You Need" while at Google Research? /s ?

verdverm•1h ago

I suspect OCI wins the sandbox space in the enterprise and everything else will be for hobbyists and companies like vercel that have a very narrow view of how software should be run

canadiantim•1h ago

Reminds me of the LocalGPT that was posted recently too (but which hasnt been updated in 7 months), so nice to see a newer rust-based implementation!

ra0x3•49m ago

What runtimes are supported? I don't think I saw that part mentioned in the README

ramoz•44m ago

Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM on any cloud and you've achieved all same benefits.

We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc

observationist•39m ago

Instrumental convergence and the law of unintended consequences are going to be huge in 2026. I am excited.

ramoz•37m ago

same! sharing this link for my own philosphy around it, ignore the tool. https://cupcake.eqtylab.io/security-disclaimer/

frolvlad•38m ago

Well, the challenge is to know if the action supposed to be executed BEFORE it is requested to be executed. If the email with my secrets is sent, it is too late to deal with the consequences.

Sandboxes could provide that level of observability, HOWEVER, it is a hard lift. Yet, I don't have better ideas either. Do you?

ramoz•34m ago

if you extend the definition of sandbox, then yea.

Solutions no, for now continued cat/mouse with things like "good agents" in the mix (i.e. ai as a judge - of course just as exploitable through prompt injection), and deterministic policy where you can (e.g. OPA/rego).

We should continue to enable better integrations with runtime - why i created the original feature request for hooks in claude code.

liuliu•20m ago

The solution is to make the model stronger so the malicious intents can be better distinguished (and no, it is not a guarantee, like many things in life). Sandbox is a basic, but as long as you give the model your credential, there isn't much guardrails can be done other than making the model stronger (separate guard model is the wrong path IMHO).

cheriot•5m ago

Sandboxes are needed, but are only one piece of the puzzle. I think it's worth categorizing the trust issue into

1. An LLM given untrusted input produces untrusted output and should only be able to generate something for human review or that's verifiably safe.

2. Even an LLM without malicious input will occasionally do something insane and needs guardrails.

There's a gnarly orchestration problem I don't see anyone working on yet.

skybrian•19m ago

Interesting approach. It requires a Near AI account. Supposedly that's a more private way to do inference, but at the same time they do offer Claude Opus 4.6 (among others), so I wonder what privacy guarantees they can actually offer and whether it depends on Anthropic?

GPT-5.2 derives a new result in theoretical physics

Apple, fix my keyboard before the timer ends or I'm leaving iPhone

Monosketch

Sandwich Bill of Materials

Why I'm not worried about AI job loss

CBP Signs Clearview AI Deal to Use Face Recognition for 'Tactical Targeting'

Open Source Is Not About You (2018)

Zed editor switching graphics lib from blade to wgpu

IronClaw: a Rust-based clawd that runs tools in isolated WASM sandboxes

Green’s Dictionary of Slang - Five hundred years of the vulgar tongue

Faster Than Dijkstra?

Resizing windows on macOS Tahoe – the saga continues

Syd: Writing an application kernel in Rust [video]

Show HN: Skill that lets Claude Code/Codex spin up VMs and GPUs

gRPC: From service definition to wire format

MMAcevedo aka Lena by qntm

Show HN: Moltis – AI assistant with memory, tools, and self-extending skills

GPT‑5.3‑Codex‑Spark

Gauntlet AI (YC S17) train you to master building with AI, give you $200k+ job

An open replacement for the IBM 3174 Establishment Controller

Gemini 3 Deep Think

I spent two days gigging at RentAHuman and didn't make a single cent

Tell HN: Ralph Giles has died (Xiph.org| Rust@Mozilla | Ghostscript)

Advanced Aerial Robotics Made Simple

An AI agent published a hit piece on me

Implementing Auto Tiling with Just 5 Tiles

Age of Empires: 25 years of pathfinding problems with C++ [video]

Cache Monet

MinIO repository is no longer maintained

We interfaced single-threaded C++ with multi-threaded Rust

IronClaw: a Rust-based clawd that runs tools in isolated WASM sandboxes

Comments

GPT-5.2 derives a new result in theoretical physics

Apple, fix my keyboard before the timer ends or I'm leaving iPhone

Monosketch

Sandwich Bill of Materials

Why I'm not worried about AI job loss

CBP Signs Clearview AI Deal to Use Face Recognition for 'Tactical Targeting'

Open Source Is Not About You (2018)

Zed editor switching graphics lib from blade to wgpu

IronClaw: a Rust-based clawd that runs tools in isolated WASM sandboxes

Green’s Dictionary of Slang - Five hundred years of the vulgar tongue

Faster Than Dijkstra?

Resizing windows on macOS Tahoe – the saga continues

Syd: Writing an application kernel in Rust [video]

Show HN: Skill that lets Claude Code/Codex spin up VMs and GPUs

gRPC: From service definition to wire format

MMAcevedo aka Lena by qntm

Show HN: Moltis – AI assistant with memory, tools, and self-extending skills

GPT‑5.3‑Codex‑Spark

Gauntlet AI (YC S17) train you to master building with AI, give you $200k+ job

An open replacement for the IBM 3174 Establishment Controller

Gemini 3 Deep Think

I spent two days gigging at RentAHuman and didn't make a single cent

Tell HN: Ralph Giles has died (Xiph.org| Rust@Mozilla | Ghostscript)

Advanced Aerial Robotics Made Simple

An AI agent published a hit piece on me

Implementing Auto Tiling with Just 5 Tiles

Age of Empires: 25 years of pathfinding problems with C++ [video]

Cache Monet

MinIO repository is no longer maintained

We interfaced single-threaded C++ with multi-threaded Rust