ClawLess - An AI Agent Security Framework Developed by Southern University of Science and Technology and Others

What is ClawLess?

ClawLess is an AI Agent security framework jointly developed by Southern University of Science and Technology and Hong Kong University of Science and Technology. Based on a worst-case threat model, the framework provides mathematical-level security guarantees for autonomous intelligent agents such as OpenClaw and Claude Code through formally verified security policies and BPF system call interception technology. The framework introduces linear temporal logic to achieve dynamic access control and uses an SMT solver to verify policy consistency. Without relying on the internal logic of the Agent, it blocks unauthorized behavior and data leakage risks at the source of system calls.

ClawLess's main functions

• Formal security modelingEstablish a mathematical security model based on entities, scopes, and permissions, and incorporate system resources such as files, processes, and sockets into a unified formal definition framework.
• Dynamic time-sequence permission controlIntroducing linear time-series logic enables dynamic policy adjustment at runtime, automatically tightening or loosening access permissions based on Agent historical behavior, avoiding excessive restrictions on availability imposed by static rules.
• SMT Strategy Consistency VerificationAutomated formal deduction of security policies is performed using SMT solvers (such as Z3) to detect and block logical conflicts such as violations of sandbox level constraints before the configuration takes effect.
• BPF kernel call interception: Use BPF programs to mount to the kernel system call entry point, use native code performance to capture and verify every resource request in real time, and accurately intercept unauthorized operations.
• External script sandbox isolationWithin the Agent main container, a separate execution domain with lower privileges is created to isolate untrusted scripts downloaded from the network with the least privilege, preventing malicious payloads from moving laterally.

ClawLess's technical principles

• Worst-case threat modelingAn extreme threat model is established based on the "capability assumption" and the "malice assumption". The AI Agent and its container software stack are all classified as untrusted components, and the security mechanism does not depend on the internal logic of the Agent.
• User-space kernel isolationIt uses gVisor as a trusted monitoring layer to insert a streamlined user-space kernel agent between the untrusted agent and the vulnerable host kernel, intercepting and proxying almost all kernel interaction requests.
• Formal strategy compilationThe design strategy compiler bridges the semantic gap between the high-level formal permission model and the low-level Linux system call interface, translating abstract security specifications into specific system call control rules one by one.
• BPF System Call InterceptionThe raw_tracepoint hook of the BPF program is attached to the sys_enter event. The system call number is distributed to the corresponding handler through the tail call mechanism, and permission verification and interception are completed in kernel mode.
• Credential visibility semanticsThe "Visible" permission is introduced to replace the traditional read permission, enabling the Agent to use credentials in the current execution domain to complete external service verification.

How to use ClawLess

• Deploy isolation baseDeploy and configure a user-space kernel environment (such as gVisor) on a Linux host machine as an isolated container base for the Agent to run.
• Define security policyDefine the system entity set, scope hierarchy, and required security policy propositions using the ClawLess formal language.
• Verify policy consistency: Call the SMT attribute validator (such as Z3) to automatically deduce the strategy configuration and enter the compilation process after ensuring there are no logical conflicts.
• Compilation interception rulesRun the ClawLess policy compiler to convert the validated formal model into rules.json system call interception rules.
• Loading kernel monitoringLoad the BPF monitoring program into kernel space and capture all system calls initiated by the Agent in real time through the raw_tracepoint hook.
• Real-time permission verificationThe BPF program identifies the call number and checks the rule base. Unauthorized operations are directly intercepted in kernel mode, while legitimate calls are allowed.
• External script isolationExternal scripts downloaded by the Agent runtime are automatically injected into an external sandbox, and their execution scope is restricted using the principle of least privilege.

Key information and usage requirements for ClawLess

• R&D teamJoint team from the Institute of Trusted Autonomous Systems, Southern University of Science and Technology and the Department of Computer Science, Hong Kong University of Science and Technology
• Paper address:arXiv:2604.06284v1 (April 7, 2026)
• Core technologiesFormal safety model, Linear Temporal Logic (LTL), SMT solver (Z3), BPF system call interception, user-space kernel (gVisor)
• Operating environmentLinux system, requires support for BPF (newer kernel version)
• target objectAutonomous AI Agents such as OpenClaw, Claude Code, and OpenCode
• Isolation levelAgent container (untrusted) + external script sandbox (lower privileges) + monitor (trusted)

ClawLess's core advantages

• Mathematical-level securityBased on formal verification and SMT solver, we ensure that there are no logical dead ends in the strategy.
• Does not depend on Agent internal logicIt forcibly intercepts at the system call level, ignoring LLM black-box behavior and jailbreak prompts.
• Dynamic AdaptationLinear sequential logic supports adjusting permissions at runtime based on behavior history, balancing security and availability.
• Low overhead and high performanceBPF is executed natively in the kernel, requiring no modification to the kernel source code, and supports hot policy updates.
• High compatibilityThe user-space kernel solution maintains high interoperability with the host environment and does not affect the execution of Agent tasks.

ClawLess's project address

• arXiv technical paper: https://arxiv.org/pdf/2604.06284v1

ClawLess's Competitive Product Comparison

Application scenarios of ClawLess

• Deployment of enterprise-grade AI programming assistantsTo prevent tools such as Claude Code and OpenClaw from unauthorized access to sensitive code repositories or data leakage when executing code autonomously.
• Cloud-based multi-tenant agent serviceProvides fine-grained isolation for AI agents for different users, ensuring that malicious agents cannot breach containers to attack the host machine or other tenants.
• Automated processing of financial dataAfter the agent reads the customer's sensitive financial information, its network outbound channels are automatically blocked to prevent data leakage.
• Security hardening of open source intelligent agentsProvides out-of-the-box secure container packaging and policy verification tools for community-developed autonomous agents.