AI agents are becoming trusted personal assistants to individuals and working members of the team for businesses. They browse the web, open files, run code, and use software tools on behalf of the people and teams they work for. To do that, every agent works inside their own computer: a software environment with a browser, parsers, system libraries, and language runtimes, and that software carries thousands of known vulnerabilities that often sit unpatched. Isolating an agent limits what it can reach, but it does nothing to protect the agent from vulnerabilities in the software inside. If the agent is hacked, its memories, sensitive data in its environment, or accounts it has access to can be accessed by attackers.
“For years the industry has tolerated known vulnerabilities sitting unpatched, because exploiting them took a serious attacker and most systems were never worth the effort,” said Gavriel Cohen, co-founder and CEO of NanoCo, the company behind NanoClaw. ” A modern prompt injection is like a social engineering attack: it lures the agent to an innocent-looking page, and a known hole in the browser turns that visit into a compromise.
Or it hands the agent a file, and a vulnerable parser turns opening it into code execution. NanoClaw tackled agent isolation, access control, and human approval on sensitive actions, allowing hundreds of thousands of people to use agents for real work. We’re now making sure the software the agents use carries no known holes, the same way you keep an employee’s laptop and browser patched.”
NanoClaw and Echo built the hardened runtime together. NanoClaw defines the agent environment and the isolation and policy layer around it. Echo rebuilds the software in that environment from scratch with only the essential components, cutting the known vulnerability count from thousands to near zero. The result is a fully hardened agent runtime with the components an agent actually uses baked in, including the chromium browser, node, bun, pnpm, corepack, git, curl and unzip. Echo hosts and maintains it as the single source of truth, and NanoClaw users opt in to the hardened runtime, which is free and simply requires a login during setup. The unauthenticated path of building your own agent runtime locally remains available.
“An agent reaches the world through a browser, a set of parsers, and dozens of libraries, which can all carry known vulnerabilities,” said Eylam Milner, co-founder and CTO of Echo. “The standard software agents are built on carries thousands, and most come from the underlying layers, not the application code. We rebuild that whole environment as a drop-in replacement, so it starts secure, and our agents keep it that way as new vulnerabilities appear.”
Echo’s approach is powered by purpose-built AI agents. When a new vulnerability is discovered anywhere in the world, Echo’s agents research it, identify affected software, find or develop a fix from unstructured sources, run compatibility testing, and open a pull request for human review. This lets Echo’s team maintain thousands of secure containers, libraries, OS packages, and more.
