At A Glance
- AI agents are shipping code and taking actions faster than anyone can review them. It’s not a bug to patch, it’s the new baseline
- If the code itself can’t be fully trusted, the network becomes the one thing you can make deterministic
- NetFoundry’s model: agents get no network access by default, only a cryptographic identity and a session-scoped path to the one resource they’re authorized to reach
Every few months, an AI agent story breaks the internet and reminds everyone how fast this space is moving. Late last year, it was an open-source agent project that launched as a weekend experiment, was renamed twice in four days, and eventually settled on the name OpenClaw. The project went from unknown to over 100,000 GitHub stars in weeks, and within days, hundreds of thousands of these agents were reportedly talking to each other on Moltbook, a social network built for AI agents.
The commentary that followed called it a security nightmare…and it is. But the more useful question isn’t, “how bad is this specific agent?” It’s, “what does this tell us about where the real exposure lives?” The answer is not where most teams are focusing.
What OpenClaw’s Breakout Year Reveals About AI Agent Risk
The headline risk was never any single agent, it’s the pattern underneath it: developers, including OpenClaw’s own creator, have openly admitted to shipping AI-generated code without fully reviewing it. At a small scale, that’s a manageable risk. But at the scale and speed agents are shipping code now, “manageable” doesn’t apply.
AI-generated code will have vulnerabilities, just like human-written code — that part isn’t new. What’s new is the volume and velocity. Humans sleep. Agents don’t. More code, shipped faster, means more CVEs, faster propagation, and a detection backlog most security teams are already behind on.
There’s also a second layer: institutional risk. A model or agent shaped by a bad actor during training or fine-tuning can carry a vulnerability that looks completely fine today and turns exploitable the moment conditions change, whether it’s next quarter, next year, or a decade from now. Supply-chain risk isn’t new to security teams. The scale and unpredictability AI adds to it is.
Why AI Code Will Never Be Fully Trustworthy
None of this is a reason to slow AI adoption down; it’s a reason to stop trying to solve a problem that doesn’t have a code-level solution. You are not going to fully verify non-deterministic, AI-generated code at the pace it’s being produced. That’s not a tooling gap someone patches next quarter. It’s structural.
Here’s what you can still control: the path that code is allowed to take once it runs. If an agent has no route to a resource, it doesn’t matter whether its code is flawless, compromised, or somewhere in between — it can’t get there either way. That’s the real shift: stop trying to secure what agents do. Control what they can reach.
What Is a Zero Trust AI Enclave?
A Zero Trust AI Enclave is an identity-based security perimeter that gives every AI agent, MCP server, and LLM a cryptographic identity and a private, policy-scoped path to only the specific resources it’s authorized to use, with no open inbound ports and no default network reachability. At NetFoundry, we build Zero Trust AI Enclaves so access is granted by identity and policy, never by network location.
By way of example:
- The AI agent has no network or internet access. Not “restricted.” None. Ever.
- Onboarding assigns the agent a cryptographically verifiable identity.
- That identity’s attributes determine which specific resources it’s allowed to reach, flipping open a private, session-scoped path to those resources and nothing else.
- There’s no inroad for the agent or an attacker, because no network path exists.
- Access changes happen by updating identity attributes in software. Nobody’s touching a firewall, a VPN, or a router.
An agent’s blast radius gets defined before it ever runs, not discovered after something’s already gone wrong.
Structural Security Doesn’t Have to Slow AI Down
Picture a Formula One car. It’s not built with weak brakes so it can park more carefully; it’s built with the best brakes in racing so it can safely run flat out at 200 miles an hour. Structural security works the same way. It’s not there to slow the AI down; it’s what lets you run at full speed without losing control of it.
In this model, there is no path at all until identity, authentication, and authorization are all cleared. Once they are, the agent gets a route to exactly one destination: the resource it’s authorized for. No lateral movement, because the enclave is microsegmented by default and the path is invisible to everyone else on the network. When the session ends, the path dissolves. Nothing lingers around to be discovered or exploited later.
That’s significantly different from how network security usually works, where speed and safety fight each other. Because the path is built and torn down in software every session in real time, security stops slowing AI deployment down. And this isn’t hypothetical: in a recent NetFoundry-commissioned survey of 200 CISOs and CTOs, every single one said AI is expanding their organization’s attack surface. Network-level containment addresses that directly, instead of trying to out-review or out-patch it.
The networking side is only half the picture. Pair it with AI agent harnesses acting as declarative sandboxes and you get a model where the network and the agent’s own operating environment are running off the same identity-first logic. Neither one has to cover for gaps in the other.
Give AI Agents a Path, Not a Network
AI agents are going to keep shipping code faster than anyone can fully review it. That’s not something security teams are going to over-work their way out of. The real fix that scales is architectural: stop trying to control what AI does, and control what it can reach.
That’s the model NetFoundry has built Zero Trust AI Enclaves around. Every AI agent, MCP server, and LLM gets a cryptographic identity and a private, policy-scoped path to only the resources it’s authorized to use — no open inbound ports, no VPNs, no firewall changes required as agents multiply.
Curious what a Zero Trust AI Enclave would look like in your environment?
Frequently Asked Questions
A Zero Trust AI Enclave is a security model that gives AI agents, MCP servers, and LLMs a verified identity and a private, session-scoped path to only the specific resources they’re authorized to access, with no default network reachability. At NetFoundry, our Zero Trust AI Enclaves are built on Identity-First Reachability™, so no path exists until identity and policy both clear.
Traditional approaches try to secure AI workloads with firewalls, VPNs, and API keys layered on top of an existing network — the agent can still reach the network, and security tries to catch bad behavior after the fact. A Zero Trust AI Enclave removes network reachability by default, so there’s nothing to catch because there’s no path to abuse in the first place.
No — when access paths are built and torn down in software per session, provisioning happens through policy and identity attributes instead of firewall tickets or infrastructure changes. We’ve found this model lets teams deploy AI agents faster than traditional network reconfiguration allows, not slower.
Because the agent never has a network path beyond its authorized resource, and that path is microsegmented with no lateral movement possible, a compromised or misbehaving agent is contained by architecture rather than by detection. We designed our enclaves so the blast radius is defined before the agent ever runs.
Identity-First Reachability™ is NetFoundry’s Zero Trust connectivity model, in which no routable network path exists until a connection’s cryptographic identity is authenticated and authorized by policy. It removes the reachable attack surface that attackers scan for and defenders otherwise have to secure after the fact.
