Security architecture for autonomous AI agents. Gateway protection, permissions, cost controls, audit trails, identity verification, skill vetting, process isolation, and kill switches — out of the box. Open source.
100,000+ GitHub stars. 1.5M autonomous agents. And a security posture that one industry leader called "a dumpster fire."
Control UI trusts gatewayUrl from query strings without validation. A single malicious link gives an attacker operator-level access to your gateway — disabling sandbox, modifying config, executing arbitrary code.
Koi Security found 335 skills delivering Atomic Stealer malware via fake utility tools. ClawHub's only barrier: a GitHub account one week old. Stolen: API keys, wallet keys, SSH credentials, browser passwords.
Heartbeat cron jobs sending 120,000 tokens of context per time check. $0.75 per check, 25 checks per night. Projected $750/month — just for reminders. No budget caps, no throttling, no alerts.
One monolithic agent with full system access. No role separation, no activity logging, no state snapshots. If your agent goes rogue at 3 AM, you find out when the damage is done.
"OpenClaw is a security dumpster fire."— Laurie Voss, Head of DevRel at Arize, Founding CTO of npm Read the full technical analysis →
All 8 layers enforced. v0.1 in production. 163 tests passing. Continuous hardening.
Drop it into your existing stack, run it standalone, or let us handle everything.
Adds governance layers (budget, permissions, audit, kill switch) to your existing deployment. SANGHA, KARMA, DHARMA, SILA, METTA, BODHI, and NIRVANA — as OpenClaw lifecycle hooks.
Everything the plugin does, plus: SUTRA gateway protection, managed dashboard, skill marketplace, hosted infrastructure, and Stripe billing.
All 8 layers managed. GDPR jurisdiction. Geothermal powered. Outside US CLOUD Act reach. Dashboard, alerts, and support included.
Built by OneZeroEight.ai — 16 AI agents in production. We built Sammā Suit because we needed it.
2 minutes. All 8 layers. Live production.
Every tier includes the full Sammā Suit. Pay for scale, not security.
Pro and Team plans support Bring Your Own Key (BYOK) — use your own Anthropic API key for full spend control.
The Sammā Suit SDK is free and open source. Deploy it your way.
Every endpoint, layer, shortcut, and config — one page.
