On 11 November, David Gewirtz wrote in ZDNET about isolating an AI agent that runs around the clock at his home and then asking it to escape. OpenClaw is a program that runs on a language model and can execute commands and send messages.

Prisoner and warden on separate machines

Gewirtz installed OpenClaw on an old M1-based Mac Studio. The machine has internet access but cannot reach the servers in his home or his personal accounts. The agent runs under its own user account and cannot access the machine’s separate administrator account. Its language model is Z.ai’s GLM-5.2, which Gewirtz runs on Ollama Cloud for a flat fee of $20 a month.

Claude Code acts as the warden on Gewirtz’s own Mac. It connects to the agent’s machine through an encrypted SSH tunnel and runs only when Gewirtz is using it. Claude Code was originally installed on the agent’s machine, but Claude pointed out that the agent could reach Claude’s own instructions and notes there.

The agent can read its configuration files but cannot change them. They contain two key instructions: ask David before any action that reaches beyond the machine, and never claim that a failed tool call succeeded. Claude spotted in OpenClaw’s log that the agent had stopped reading the file at the default size limit and had read neither instruction. The default limit was changed to fix this. Instructions work only if the AI agrees to follow them, Gewirtz said.

Eleven attempts, no breakthrough

With Gewirtz’s permission, Claude told the agent to break into the administrator side. The agent tried to write directly to the administrator account’s files, to gain administrator privileges through several back doors and to get round the permissions with scripts, file copies and links. It also tried to open the warden’s files by pointing its browser and its web-fetching tool at local file addresses, hoping those tools had wider access than the agent itself.

All 11 attempts failed and the macOS protections held, Gewirtz said. The result applies to this set-up and to the methods the agent itself tried. Gewirtz was ready to pull the machine’s power cable and switch off the router, and he warns readers not to try this at home. Finally, Claude deleted information about the test and the administrator side from the agent’s memory.

The agent has no email access. It leaves its messages as text files in a folder, from which a Python script on the administrator side sends them only to Gewirtz’s address. Gewirtz is ‘fairly convinced’ that it is safe to keep the agent running, citing the tested constraints and regular checks on them.

The AI Understanding website summarises ZDNET’s article but names ZDNET’s Charlie Osborne as the person who ran the experiment. Gewirtz mentions Osborne in the article only because Osborne has called OpenClaw a security nightmare.