NVIDIA expands NemoClaw beyond OpenClaw

What NVIDIA announced

NVIDIA's October 30 technical post [1] describes NemoClaw as a set of open blueprints for three supported harnesses: Hermes Agent, OpenClaw and LangChain Deep Agents. Each blueprint combines a tuned harness, Nemotron models, NeMo optimization and observability tools, and the OpenShell runtime.

The NVIDIA repository [2] describes guided onboarding, managed inference, network policy, managed integrations, state persistence and lifecycle commands. The code is published under Apache 2.0.

NemoClaw itself is neither an agent harness nor a standalone runtime.[1] The harness controls how an agent works, OpenShell enforces the sandbox boundary, and NemoClaw assembles and operates the supported combination.

What changed from the March preview

TechCrunch covered the original March 16 preview [5] as an early-stage OpenClaw security and privacy stack. At that point, NVIDIA warned developers to expect rough edges.

The current repository and documentation now provide agent-specific paths for Hermes and LangChain Deep Agents Code alongside OpenClaw.[2][3] NVIDIA's October post presents these as supported blueprints rather than a single OpenClaw wrapper.[1]

This is an expansion of an existing preview, not the first launch of NemoClaw. The new value is a shared operational and policy layer across several harnesses, with each harness retaining its own task logic and state model.

How the security boundary works

NVIDIA's security guide [4] lists five control layers: network, filesystem, process, gateway authentication and inference. OpenShell supplies network namespaces, seccomp filters, SSRF protection, TLS handling and gateway authentication.

Outbound traffic is denied unless an endpoint appears in policy.[4] Rules can restrict hosts, ports, binaries, HTTP methods and URL paths. OpenShell brokers supported provider credentials so the sandbox does not receive the raw host credential.[4]

Those controls reduce exposure, but policy quality still matters. NVIDIA warns that every allowed endpoint can become an exfiltration path, and removing binary restrictions lets other processes use an approved destination.[4] A sandbox also cannot decide whether the business task itself is authorized or whether an agent's output is correct.

What Hermes users gain

The Hermes blueprint places Hermes skills, memory and orchestration inside an OpenShell-governed sandbox.[1][2] NVIDIA's example adds NeMo Relay traces at Hermes session boundaries and keeps managed inference and MCP credentials outside the sandbox.[1]

Version 0.0.140 release notes [3] include Hermes-specific work on managed OpenRouter credential references, the default profile's SOUL.md and skills index, dashboard export, and web-tool availability. These details show active integration work rather than a finished compatibility claim.

A team already using Hermes can test the runtime without replacing its harness. The trade-off is another operational layer whose image, provider binding, policy and state-recovery behavior must be versioned and reviewed.

A safe evaluation plan

• Start with a disposable sandbox and synthetic data. Keep production credentials, repositories and messaging accounts out of the first test.
• Choose one bounded workflow and list every file, command, endpoint, method and credential it needs before creating policy.
• Keep deny-by-default egress. Add endpoints one at a time, scope them to the required binaries and methods, and test denied paths as well as successful ones.[4]
• Verify that provider secrets stay outside the sandbox, that the agent cannot read unrelated host files and that an unapproved destination remains unreachable.[4]
• Interrupt a task during a write, rebuild and provider switch. Confirm what state survives, what rolls back and which audit evidence remains.[3]
• Run prompt-injection tests through web pages, repository files, messages and memory. Confirm that retrieved instructions cannot widen OpenShell policy.
• Measure task success, human review time, model cost and recovery effort. Do not treat a successful installation as proof that the workflow is ready.
• Pin a tested NemoClaw version and image, review release notes before upgrades, and keep an independent backup for state you cannot recreate.[3]

Where the evidence stops

• NVIDIA has not published a broad independent security audit of the current Hermes and Deep Agents blueprints in the cited material.[1][2][4]
• The claim of near-frontier LangChain performance at about one-tenth the cost comes from a tuned benchmark path and does not establish cost or quality for another harness or workload.[1]
• The October 30 post does not report production availability, service-level commitments or a stable 1.0 release.[1][3]
• The release notes still describe NemoClaw as an early preview and record frequent changes to credentials, inference, recovery and images.[3]
• VentureBeat's March analysis noted that the policy model requires operational maturity and that a sandbox cannot answer every governance question raised by self-modifying agents.[6]
• Support for a provider or host in onboarding does not guarantee that every model, networking path or hardware configuration has completed the same validation.[2][3]

Frequently asked questions

• Is NemoClaw a replacement for Hermes Agent? No. NVIDIA describes Hermes as a supported harness inside a NemoClaw blueprint.[1]
• Does NemoClaw require an NVIDIA GPU? The project supports hosted providers and ordinary Linux or WSL paths as well as NVIDIA systems, but local model choices and validated configurations depend on the host.[2][3]
• Can it use models other than Nemotron? Yes. The documented onboarding paths include NVIDIA Endpoints, OpenRouter, OpenAI, Anthropic, Gemini, compatible endpoints and local options, with different support conditions.[2]
• Does OpenShell make an agent safe? It enforces technical boundaries, but teams still need correct policy, scoped credentials, review, monitoring and recovery tests.[4]
• Is NemoClaw production-ready? NVIDIA calls the project an early preview. Treat production use as an engineering and risk decision that requires your own validation.[3][5]
• What is new on October 30? NVIDIA published a unified blueprint model across Hermes, OpenClaw and LangChain Deep Agents. NemoClaw itself first appeared in March.[1][5]