You set up an AI agent to run a few small jobs for you. It has a file that tells it who it is and what it is allowed to do. Then one day something quietly edits that file, adds a line you never wrote, and now your helpful assistant is following someone else's orders. You would probably never notice until it was too late.
That blind spot is what ClawSec is built to close. It is an open-source security suite for AI agent platforms, made by the team at Prompt Security (now part of SentinelOne). Instead of one narrow tool, it bundles a set of protections you install together and lets them keep an eye on the parts of an agent that attackers actually go after.
Quick facts
License: GNU AGPL v3.0. Main languages: JavaScript and TypeScript, with a good chunk of Python and shell scripts. Last active: April 2026 (as of 4 Jul 2026), with 15 releases shipped and around 980 stars on GitHub.
What it actually is
An AI agent is a program that can read instructions, make decisions, and take actions on your behalf, like sending messages or running commands. Those agents keep files that define their personality and rules, often named things like SOUL.md or IDENTITY.md. If someone changes one of those files, they change the agent.
ClawSec is a collection of skills, which are small add-on modules an agent can install. Each one handles a slice of security: checking that instruction files have not been altered, pulling in a live feed of known vulnerabilities, verifying that a skill you are about to install is genuine, and running self-checks that look for signs of a prompt injection attack (where hidden text tricks the agent into ignoring its real instructions). You install the suite with one command and the pieces work together from there.
It covers four agent platforms by name: OpenClaw, NanoClaw, Hermes, and Picoclaw, plus their clones and variants.
The real problem it solves
Picture a small team running a customer-support agent on top of one of these platforms. They added a community-made skill last month to handle refunds. It worked fine. What they cannot easily see is whether that skill was updated with something nasty, whether the agent's rules file has drifted from what they approved, or whether a vulnerability was published this week that affects the exact setup they are running.
Doing those checks by hand means reading changelogs, hashing files, and watching vulnerability databases. Nobody keeps that up. ClawSec turns those chores into background monitoring the agent runs on itself.
Where it is useful
A solo builder running a WhatsApp bot on NanoClaw can switch on file integrity checks so that if the bot's instruction file is edited without approval, it gets flagged and can be restored to the last known-good version.
A small startup shipping an agent to customers can wire in the advisory feed, which polls the national vulnerability database for issues tied to their platform, so a new critical bug lands as an alert instead of a surprise.
A security-minded developer evaluating a new community skill before installing it can run the checksum and reputation checks first, confirming the download matches its signed hash rather than trusting the file blindly.
A maintainer of an internal automation agent can schedule regular self-audits that scan for prompt injection markers and misconfigurations, catching a tampered prompt before it does anything with real access.
Why it stands out
The advisory feed is the clever bit. It does not just list vulnerabilities by their raw severity score. It adds context on whether a public exploit actually exists, whether it has been folded into common attack tools, and what an attacker would need to pull it off. That helps an agent tell a scary-sounding but theoretical bug apart from one people are exploiting right now, which is exactly the judgment call most raw feeds leave you to make alone.
The other nice touch is honesty about scope. The skill matrix in the README openly marks some features as spec baseline, meaning the structure exists but the platform-specific runtime code is left for builders to finish. That is refreshingly clear for a security project, where overclaiming is the norm.
How to get started
The suite is designed to be installed by the agent itself. For OpenClaw-family agents, the one-liner is:
npx clawhub@latest install clawsec-suite
After that it can find installable protections, verify release integrity against signed checksums, set up advisory monitoring, and add optional scheduled checks. There are separate install paths for NanoClaw, Hermes, and Picoclaw, each documented in the repo's wiki. If you would rather inspect before you run anything, the project points you at a source-first path where you read the install instructions yourself first, which is the right instinct for a tool that touches your agent's core files.
One caveat worth naming: this is early software on fast-moving platforms, and some of the runtime monitoring is still a spec rather than shipped code. Treat it as a strong foundation to build on, not a finished fortress.
Takeaway
Agents are getting more autonomous, and the files that steer them are a soft target. ClawSec is a genuine attempt to give that soft target a guard, and the fact that it is open source under AGPL means you can read exactly what that guard does before you trust it. If you run an agent on any of these platforms, it is worth an afternoon to try.