Enterprise IT Is Worried About NanoClaw. That's Exactly What the Founders Wanted.

An enterprise security report published April 1 flagged NanoClaw as a shadow AI risk. More than 75% of knowledge workers are reportedly using unauthorized AI tools, and NanoClaw — the security-focused OpenClaw alternative built by Gavriel Cohen and Lazer Cohen — was specifically named as a tool CIOs need a strategy for.

It is, as security threat assessments go, a strange kind of compliment.

How NanoClaw got here

Cohen built NanoClaw in February 2026 after discovering that OpenClaw stored WhatsApp messages in plain text and had no agent isolation. When one agent is compromised, it can see everything every other agent can see. For a personal project that is annoying. For enterprise use, it is a disqualifier.

NanoClaw’s architecture is the direct response. Each agent session runs in its own Docker or Apple Container with its own filesystem and process space. The containers are isolated at the kernel level. One compromised agent cannot reach another. The entire codebase is approximately 3,900 lines across 15 files — auditable by a single developer in an afternoon, compared to OpenClaw’s 400,000-plus line codebase that would take weeks to fully review.

Andrej Karpathy endorsed it in March 2026. Docker partnered on the container integration. Stars grew to between 20,000 and 26,000.

The shadow AI paradox

The enterprise security concern about NanoClaw is that employees are installing it without IT approval. The paradox is that NanoClaw’s architecture is actually the most defensible argument for allowing employees to install an AI agent framework at all.

Enterprises that want to evaluate AI agents face a choice: approve OpenClaw and spend weeks auditing a 400K-line codebase with known security issues, or evaluate NanoClaw and spend an afternoon reviewing 3,900 auditable lines with explicit container isolation. The shadow AI concern presupposes the latter is the riskier option because it happened without approval. The technical reality is the opposite.

Docker’s Mark Cavage framed the direction plainly: AI agents are going to need more and more things — cheap, easy sandboxes that can recursively spin up in various places. NanoClaw is built for exactly that infrastructure. The Docker partnership is not just a distribution play; it is co-development of the container primitives that enterprise-grade agent deployment will eventually require.

Where it sits in the ecosystem

NanoClaw is deliberately narrow. Six to seven platform integrations versus OpenClaw’s 50+. Built on Claude’s Agent SDK, so it uses API keys natively — the Anthropic OAuth pricing change that disrupted OpenClaw does not affect NanoClaw at all. No self-improving learning loop like Hermes Agent. No edge deployment focus like ZeroClaw. The target user is a security-conscious individual or small team that wants to run capable agents without inheriting OpenClaw’s architectural debt.

What to watch

The Docker co-development relationship is the main thread. What container features get built in collaboration matters more than NanoClaw’s standalone star count. If the Docker partnership produces primitives that make isolated agent deployment standard infrastructure rather than a NanoClaw-specific feature, the security architecture wins at the ecosystem level regardless of which framework uses it.

The enterprise shadow AI framing will keep coming up. The more useful question for CIOs is not “how do we block NanoClaw” but “if employees are going to install AI agent frameworks anyway, which one do we least regret finding on our network.”