NVIDIA Releases NemoClaw, an Open Stack for Secure Local AI Agents

NVIDIA has described on its developer blog a new way to run autonomous AI agents that bypasses the cloud entirely. NemoClaw, an open reference stack released on GitHub, combines the OpenShell security sandbox with the OpenClaw agent framework and the local Ollama inference engine, giving companies and developers an agent that runs around the clock entirely on their own hardware.

The problem with cloud agents

The post's authors, NVIDIA engineers Patrick Moorhead and Edward Li, point to a specific risk: running an agent that executes code and uses external tools without proper isolation poses a real threat to data privacy, especially when the agent runs on someone else's cloud infrastructure. AI agents are evolving from simple question-and-answer systems into long-running assistants that read files, call APIs, and carry out multi-step processes, which expands the attack surface.

Running an agent to execute code and use tools without proper isolation carries real risk, particularly when using third-party cloud infrastructure, due to data privacy and control concerns - NVIDIA Developer Blog

How NemoClaw works

The architecture rests on four layers. OpenShell handles network and filesystem isolation and manages sensitive credentials. OpenClaw, described as a self-hosted gateway linking communication platforms like Slack or Discord to coding agents built on open models, manages persistent memory and tool integration. Ollama serves as the local model-serving engine, and Nemotron 3 Super 120B is the agent's actual brain, responsible for multi-step reasoning and instruction-following.

In practice, a query reaches the locally running Ollama instance, which queries the Nemotron model, and the result goes back to the OpenClaw agent, which carries out the task and replies in the communication channel, for example on Telegram. This entire loop happens on a single machine, without sending content to external inference servers.

Safeguards and limitations

By default, the sandbox restricts the agent to a narrow set of network endpoints, and the user sees connection attempts blocked by the system in real time and can approve or reject them individually. However, NVIDIA states explicitly that no sandbox provides full protection against advanced prompt injection, meaning NemoClaw reduces risk but does not eliminate it. That's an important caveat for companies that might treat a local deployment as a security guarantee rather than just one layer of protection.

Available hardware and deployment

The stack is designed primarily for the NVIDIA DGX Spark, a compact AI computer built on the GB10 chip, but NVIDIA's documentation also mentions other tested configurations, including RTX Spark laptops, GeForce RTX cards, RTX PRO workstations, and DGX Station. Installation is launched with a single command that downloads a script from NVIDIA's servers, after which a setup wizard walks users through choosing a sandbox name, inference provider, model, and security policy profile. Remote access to the agent can be configured via SSH tunneling, allowing it to be managed from outside the local network without exposing it directly to the internet.

What it means for companies and developers

For enterprises that have spent months hearing warnings about data leaks through cloud-based AI agents, NemoClaw offers an alternative: full control over data at the cost of needing sufficiently powerful hardware and patience for slower responses on the order of tens of seconds. That's a tradeoff that can pay off in data-sensitive sectors such as law, finance, or public administration, where sending document contents to an external API is often ruled out from the start.

For developers, it also means the ability to experiment with a full-fledged 120-billion-parameter agent without API token fees, provided they have hardware capable of running a model of that size. The open nature of the NemoClaw repository on GitHub also allows for modifying security policies and adapting the sandbox to specific requirements, setting this approach apart from the closed agent platforms offered by cloud providers.

The release fits into a broader trend in which hardware makers, including NVIDIA, are promoting local AI deployments as a response to a growing number of security incidents tied to agents running in the cloud on third-party infrastructure. Whether NemoClaw spreads beyond a narrow circle of enthusiasts with DGX hardware remains to be seen over the coming year, but the underlying direction, treating isolation and locality as a core feature of a secure agent rather than an add-on, looks like a lasting shift in how such tools are designed.