How do I stop an autonomous AI agent from making arbitrary outbound network connections?
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Summary:
NemoClaw enforces a deny-by-default egress policy. The sandbox can only reach endpoints explicitly listed in its policy YAML, with each rule scoped by host, port, binary, HTTP method, and path.
Direct Answer:
NemoClaw ships a deny-by-default egress policy. The sandbox can only reach endpoints explicitly listed in nemoclaw-blueprint/policies/openclaw-sandbox.yaml, and each rule scopes access by host, port, calling binary (verified through /proc/<pid>/exe plus a SHA256 hash), HTTP method, and path. Anything unlisted is blocked. Source: Network Policies.