Deno Creator Ryan Dahl Unveils 'Claw Patrol' to Secure AI Agents with Production System Access

Deno is actively using AI agents to manage downtimes and incidents for its Deno Deploy service, a platform for hosting websites. These agents, including OpenClaw, are designed to automate tasks traditionally performed by human Site Reliability Engineers (SREs), such as diagnosing and resolving issues. To effectively manage these incidents, the agents are granted extensive access to production systems, including databases like Postgres, container orchestration platforms like Kubernetes, and cloud services such as AWS.

This integration allows for rapid response to service disruptions, improving the efficiency and speed of incident resolution. However, granting such broad access to autonomous AI agents also introduces new security challenges and risks that need to be carefully addressed.

Granting AI agents write access to production systems presents significant dangers. These agents could inadvertently or maliciously execute destructive commands, such as initiating a 'delete users table' through a P-SQL subprocess, leading to catastrophic data loss or system compromise. The potential risks extend to accidental deletions, unauthorized modifications, or other nefarious actions within sensitive production environments.

Furthermore, prompt injection poses a serious threat. External input could manipulate the agent's behavior, compelling it to perform actions beyond its intended scope or against the system's security policies. This vulnerability highlights the need for robust external controls to prevent agents from being exploited.

Relying on model alignment alone, even with sophisticated models like Opus, is not a sufficient security measure. While these models are designed to adhere to specified behaviors, they remain susceptible to prompt injection attacks, where expertly crafted inputs can override their internal safeguards. Security, therefore, cannot be built on the "wishful thinking" that an AI will consistently obey commands and avoid malicious actions.

The fundamental principle is to treat the AI agent itself as untrusted software. Its internal alignment or adherence to ethical guidelines, while important for functionality, cannot be the sole basis for protecting sensitive production systems. External security mechanisms are necessary to ensure that the agent's actions are always within permissible bounds.

To establish robust security, Deno takes the stance that AI agents must be treated as untrusted software. This means that security safeguards cannot be embedded within the agent itself, as internal controls can be bypassed or compromised. Instead, the security mechanisms must operate externally to the agent, providing an independent layer of defense.

Deno achieves this by running agents in isolated, standalone virtual machines, preventing any direct access to the underlying infrastructure without passing through controlled interfaces. Every action initiated by an agent, whether benign or malicious, ultimately manifests as network communication or bytes transmitted over the wire, making network-level control a crucial security perimeter.

To enforce stringent security, Deno's approach is to meticulously understand and control the exact bytes transmitted by AI agents over the network. This level of granular control is crucial because many critical protocols, such as Postgres, do not exclusively rely on HTTP, necessitating a deeper inspection of network traffic. The objective is to identify and govern every outgoing byte generated by an agent, regardless of the protocol being used.

This strategy requires implementing gatekeepers that possess an in-depth understanding of specific protocols, such as SQL, to effectively monitor and filter outbound traffic. By parsing and analyzing protocol bytes, these gatekeepers can identify and prevent unauthorized or destructive commands before they impact production systems. This fine-grained control allows for real-time interception and enforcement of security policies.

The system needs to be able to dynamically adjust its parsing logic for different protocols and adapt to evolving threats. It must also provide mechanisms for defining and applying rules that dictate what types of byte sequences are permissible for each agent and protocol. This comprehensive monitoring and gating ensures that agents' actions are strictly confined to their intended scope.

This deep-dive into network traffic provides an immutable backstop against agent misbehavior, acting independently of the agent's internal logic or alignment. It ensures that even if an agent is compromised or acts unexpectedly, the external security layer will prevent harmful operations from reaching critical infrastructure.

Claw Patrol intercepts network connections opened by subprocesses, such as `psql`, to the Postgres server. During this interception, it meticulously parses each and every byte flowing through the connection. This deep inspection allows Claw Patrol to understand the underlying protocol and the specific commands being issued.

By analyzing the raw traffic, Claw Patrol can identify and reject destructive actions, like database deletions, in real time. This mechanism provides an essential layer of security by preventing harmful commands from reaching the production database, even if an agent attempts to execute them.

Claw Patrol features a comprehensive dashboard that provides clear visibility into the activities of AI agents. This dashboard allows users to monitor what their agents are doing in real time, offering a utilitarian display of operations. It visualizes different agents and their specific request flows, enabling administrators to track interactions with various systems.

Beyond standard HTTP traffic, the dashboard provides a detailed audit trail of all actions, including those across specialized protocols. Users can drill down into specific actions for in-depth analysis, making it easier to identify anomalies or investigate security incidents. This level of transparency is crucial for maintaining control and ensuring accountability over autonomous agents.

Claw Patrol incorporates a flexible approval system that goes beyond simply rejecting requests. This system allows for the definition of rules that can route questionable actions to various oversight mechanisms. For instance, an action might be routed to a human for approval via a Slack channel, or it could be submitted to an LLM (Large Language Model) judge for automated evaluation and decision-making.

This design enables the combination of multiple verification methods, offering a robust, multi-layered approach to security. Critically, this approval system treats the agent software as a black box, meaning it requires no local changes to the agent itself. All security enforcement and approval workflows are managed externally at the proxy level.

Claw Patrol offers comprehensive support for credential management across a wide array of systems and authentication protocols. Recognizing that credentials come in many different forms, it is designed to handle various types of authentication mechanisms. This includes support for OAuth, cookies, specialized databases like ClickHouse, and AWS SigV4, among others.

This detailed support is built for practical production environments, addressing the complexities of real-world security rather than theoretical models. By managing and injecting credentials at the proxy level, Claw Patrol ensures that agents can securely interact with diverse services without having direct access to sensitive authentication details.

Claw Patrol seamlessly integrates with secure networking solutions like Tailscale or WireGuard, enhancing its security posture. This integration allows Claw Patrol to operate as a Tailscale exit node, enabling all agent traffic to flow securely through a private tailnet. By leveraging Tailscale, the system benefits from its encrypted connections and simplified network access control.

Furthermore, Tailscale identity is utilized for dashboard access control, ensuring that only authorized personnel can monitor and manage agent activities. This robust network integration provides a secure and verifiable environment for AI agent operations, reinforcing the principle of external security oversight.

The fundamental thesis behind Claw Patrol is that AI agents cannot be trusted to police themselves. This principle extends to security plugins or any modifications made directly to the agent software itself, as these internal controls are inherently vulnerable to bypass or manipulation. Therefore, external security boundaries are deemed necessary to establish a robust and immutable defense.

While model alignment is beneficial for guiding agent behavior, it is ultimately insufficient for ensuring real-world security. The system's design incorporates an immutable backstop that operates entirely outside the agent software. This external layer acts as the final line of defense, guaranteeing that critical safeguards remain intact regardless of the agent's internal state or actions.

Claw Patrol's rule file is accompanied by a robust test system that allows for rigorous validation of security policies. This system enables users to provide fixture requests, simulating various actions that can flow through the defined rules. By running these test cases, developers can ensure that blocking rules work precisely as expected, preventing unintended or malicious operations.

In addition to testing the rule files, Claw Patrol itself features a comprehensive suite of unit tests. These tests verify the core functionality and security mechanisms of the software, ensuring its reliability and effectiveness. This dual approach to testing guarantees that both the configuration and the underlying system are secure and perform as intended.

Despite ongoing advancements in AI, the expectation is that artificial intelligences will never be fully trustworthy, necessitating persistent external security measures. While AIs may become smarter, gain better context, and become more aware of their operational environment within a company, the fundamental need for robust security will remain. The problem of agent security might decrease as they become more sophisticated, but it will not disappear entirely.

Therefore, security needs will persist regardless of improvements in model alignment or agent intelligence. The system's design incorporates an immutable backstop that operates independently of the agent software. This external layer ensures that critical safeguards remain intact, providing a continuous defense against potential risks even as AI capabilities evolve.