At GTC Taipei on June 1, Jensen Huang called OpenClaw “the new Linux” and said every company needs a strategy for it. Three days earlier, we documented that OpenClaw has 454 documented CVEs, a marketplace poisoned with 1,184 malicious skills, and a Gartner enterprise block advisory.

Both things are true simultaneously, and the tension between them is exactly where NVIDIA is positioning NemoClaw.


What OpenClaw Actually Is

Before getting to NemoClaw, it is worth being precise about what OpenClaw is, because the marketing around it tends to collapse its defining architectural difference.

OpenClaw is not a prompt-triggered task runner. Most AI agents today work like this: user sends prompt → agent completes task → done. OpenClaw’s model is different. A “claw” is a persistent background process that runs continuously, operating on a heartbeat: at regular intervals, it checks its task queue, evaluates what requires action, acts or waits, and surfaces only what requires a human decision.

The difference matters for builders. A heartbeat agent can:

  • Monitor a feed and act on items matching criteria, without being manually triggered
  • Maintain state across days or weeks of a multi-step project
  • Coordinate with other claws running in parallel on the same or different machines
  • Recover from interruption and resume exactly where it left off

This is meaningfully closer to how an employee works than how a chatbot works. It is also why OpenClaw crossed 250,000 GitHub stars, overtaking React’s roughly 243,000 stars to become the most-starred software project on GitHub. Jensen Huang’s “new Linux” framing is hyperbole, but it captures something real: this is infrastructure-level software, not an application.


The Problem NVIDIA Is Solving

The 454 CVEs and 1,184 malicious ClawHub packages we documented are a real problem, but they are not the only enterprise concern. Even a perfectly patched OpenClaw installation raises governance questions that enterprise IT cannot currently answer:

  • Data access: Which files can this agent read? Which directories can it write to?
  • Network access: Can it make outbound calls? To which endpoints?
  • Cloud exposure: If it routes a query to GPT-4 or Claude, does any private data leave the building?
  • Audit trail: What did this agent do, when, and why?
  • Policy enforcement: Who defines the rules, and how are they applied consistently across hundreds of agents?

OpenClaw has no built-in answers to these questions. NemoClaw is NVIDIA’s attempt to provide them.


NemoClaw: Architecture

NemoClaw is NVIDIA’s open-source reference stack — also published as an open blueprint on GitHub — that layers three components on top of a base OpenClaw installation:

1. NVIDIA OpenShell

OpenShell is the open-source runtime at NemoClaw’s core — it “governs how each agent accesses files, networks and tools, enforcing policy-based security at every layer,” wrapping each claw in an isolated sandbox conceptually similar to a Docker container but purpose-built for agentic workloads. Each sandbox has a YAML policy file that, conceptually, defines:

# Example NemoClaw agent policy
filesystem:
  read: ["/home/user/projects/current", "/tmp/agent-workspace"]
  write: ["/tmp/agent-workspace"]
  deny: ["/home/user/.ssh", "/etc", "/home/user/.config"]

network:
  allow_outbound: ["api.github.com", "api.linear.app"]
  deny_outbound: ["*"]  # default-deny for anything not listed

cloud_services:
  allow: ["claude-3-7", "gpt-4-1"]
  route_sensitive_data: false  # blocks private data from leaving the sandbox

These are administrator-defined, version-controlled, and applied at the runtime level — the agent cannot override them. This is a meaningful shift from OpenClaw’s current default behavior, where agents inherit the full permissions of the user account running them.

2. NVIDIA Nemotron Models

NemoClaw ships with Nemotron, NVIDIA’s family of open-weight models, configured to run locally by default. The practical purpose is sensitive data isolation: tasks that involve private data — internal documents, customer records, proprietary code — run on the local model. Nothing leaves the hardware.

Nemotron variants are built for long-context, long-running agentic workloads — NVIDIA’s technical report for Nemotron 3 Nano lists a native context window up to 1 million tokens, though NemoClaw’s own documentation does not publish one fixed context figure for the stack — actual usable budget depends on which Nemotron variant and local GPU you deploy.

3. Privacy Router

NVIDIA’s own announcement lists a “privacy router for cloud model access” as one of NemoClaw’s components. As NVIDIA describes it, the router decides, per query, whether to use the local Nemotron model or route to a cloud frontier model. The routing decision is policy-driven, not model-driven — the agent does not choose. Administrators define what categories of data can leave the sandbox, and the router enforces it.

For tasks that require frontier model capability — complex reasoning, multi-modal input, tasks where Nemotron’s quality is insufficient — the router sends the query to the cloud endpoint with private data fields redacted or excluded, based on the policy file.


Installation

The installation story is one command, documented as a shell one-liner rather than an npm command:

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

This installs the CLI, the OpenShell runtime, and launches a sandboxed OpenClaw instance with a default policy file you can customize. If you are running OpenClaw already, migration is additive — you install the OpenShell layer on top of your existing setup.


What Hardware You Need

NemoClaw is designed to run on GeForce RTX PCs and laptops, RTX PRO workstations, DGX Station, and DGX Spark — hardware NVIDIA already sells:

Platform Status
RTX 4090 / 5090 desktop Supported now
RTX PRO workstations Supported now
DGX Spark (desktop AI supercomputer) Supported now
DGX Station Supported now
N1X laptops (launched at Computex as RTX Spark) Fall/holiday 2026

The N1X/RTX Spark chip is relevant here specifically because it brings CUDA and the full NVIDIA developer toolchain — including the NemoClaw stack — to a portable device. NVIDIA describes it as a 20-core Grace CPU paired with a Blackwell RTX GPU, and independent reporting on the Computex reveal puts the GPU at 6,144 CUDA cores with up to 128 GB of unified LPDDR5X memory on a TSMC 3nm process. Nemotron running locally on a laptop with that much unified memory is a different product category than Nemotron running on a desktop workstation. Field agents, remote workers, and executives who travel with sensitive data are the target users.


What NemoClaw Does Not Fix

NemoClaw addresses the governance gap — it does not fix ClawHub.

The 1,184 malicious skills in the OpenClaw marketplace are still there. NemoClaw’s YAML policy system limits what a malicious skill can do if it runs inside your sandbox, but it does not prevent the skill from running at all. If a developer or automated process installs a compromised skill and grants it network access in the policy file, the sandbox becomes less useful.

The defense here is the same as in any software supply chain context: audit your skill dependencies, pin versions, and do not grant network access by default. NemoClaw gives you the enforcement mechanism; you still have to write the policies correctly.

There is also no ClawHub equivalent inside the NemoClaw ecosystem. NVIDIA provides Nemotron models and the OpenShell runtime. Verified skills are available through the NVIDIA Agent Toolkit, but the catalog is far smaller than ClawHub. If you depend on the breadth of the ClawHub ecosystem, you are still making trust decisions that NemoClaw cannot make for you.


What This Costs

NemoClaw itself is open source. There is no licensing cost.

The cost model shifts to:

For small teams, the RTX desktop + NemoClaw combination is a plausible alternative to paying per-token for every agentic call. For enterprises with compliance requirements around data residency, the local-by-default model has value independent of cost.


Builder Action Items

If you are not running OpenClaw yet:

  1. Read the OpenClaw security brief we published three days ago before starting any evaluation. Understand the CVE landscape before you adopt.
  2. Start with NemoClaw rather than base OpenClaw. Installing the security layer from the beginning is easier than retrofitting it.
  3. Write your YAML policy file before deploying your first agent. Define the minimum necessary access. Default-deny for network. Explicit allow-list for filesystem paths.

If you are running OpenClaw already:

  1. Inventory your current skill dependencies and audit against the ClawHub malicious packages list.
  2. Install OpenShell alongside your existing setup. This is additive and does not require migrating agent configurations.
  3. Migrate agent configs to YAML policies one agent at a time. Start with agents that handle sensitive data.

If you are in enterprise IT evaluating OpenClaw:

  1. Do not evaluate base OpenClaw for enterprise deployment. Evaluate NemoClaw specifically.
  2. Map your data classification policy to the YAML policy schema before piloting. If you cannot define what data can leave the sandbox, the privacy router cannot enforce it.
  3. Treat ClawHub skills as untrusted third-party dependencies. Apply the same review process you use for npm or PyPI packages.

The GTC Taipei Context

NemoClaw was not the only announcement at GTC Taipei on June 1. Jensen Huang also formally revealed:

For builders, the NemoClaw story is the most immediately actionable. N1X and Vera Rubin affect your infrastructure options on a 6–18 month horizon. NemoClaw is deployable today if you have RTX hardware.


The Bottom Line

OpenClaw is real infrastructure. The growth numbers are not hype — 250,000 GitHub stars, past React’s decade-long total, reflects genuine adoption driven by a genuinely different agent architecture. The security problems are also real and documented.

NemoClaw is the first credible answer to the question: how do you run OpenClaw in a context where data governance matters? It does not fix every problem — ClawHub supply chain risk remains — but it gives IT a policy lever, gives agents a data boundary, and gives builders a path to production that does not require accepting “insecure by default” as the answer.

The one-command install and open-source licensing mean the barrier to evaluating it is low. Given what we know about the base OpenClaw security posture, evaluating NemoClaw before deploying any persistent agent is worth the hour it takes to read the documentation.


ChatForest tracks builder-relevant AI infrastructure developments. Previous coverage: OpenClaw 454 CVEs and 1,184 malicious marketplace skills · NVIDIA GTC Taipei preview · NVIDIA N1X preview