OpenClaw Machines: Enterprise Infrastructure for OpenClaw Agents

OpenClaw Machines is an open-source platform designed to run OpenClaw AI agents in secure, hardware-isolated sandboxes on user-owned infrastructure. By utilizing Firecracker microVMs and a centralized control plane, it allows organizations to deploy as many isolated agents as their hardware can support while maintaining full sovereignty over data and keys.

Hardware-Isolated Agent Sandboxing

OpenClaw Machines replaces process-level or container-based isolation with hardware-level isolation. Each AI agent runs within its own Firecracker microVM, which provides a dedicated guest kernel behind a KVM hardware boundary. This architecture ensures that untrusted or agent-generated code is contained, preventing it from affecting the host system or other agents.

To maintain security, the platform employs a dual-layer authentication strategy: auth is enforced at the Cloudflare edge and again inside every individual VM. Traffic is routed through Cloudflare Tunnels that terminate directly inside the VM, ensuring no host ports are exposed for user-to-VM communication.

System Architecture and Components

The platform consists of a five-layer stack ranging from the user interface to the sandbox execution environment:

Control Plane

Built with a Go API and backed by Postgres, the control plane manages accounts, machine placement, lifecycle orchestration, and host enrollment. It handles the scheduling of agents across available hosts and manages durable workflows and backups.

Host Agent (ocm-agent)

Installed on KVM-enabled Linux boxes, the host agent supervises the booting, running, and reaping of Firecracker microVMs. It manages the necessary bridge/TAP networking and rootfs staging for the VMs.

LLM Proxy

Each host includes a LiteLLM proxy. This serves as a centralized point for managing model keys and supporting "Bring Your Own Key" (BYOK) configurations. It enables per-machine usage tracking and allows agents to be routed to either third-party APIs or locally served models on the host's own GPU hardware to reduce token costs.

OpenClaw Runtime

Inside each microVM, the runtime includes an authentication proxy, a web-chat gateway, and a live terminal for interacting with the agent.

Browser Runtime

For web automation, the platform deploys separate microVMs running headful Chromium. These are driven by the agent via the Chrome DevTools Protocol (CDP) and include a live view for human monitoring.

Enterprise Features and Integrations

OpenClaw Machines extends the base OpenClaw functionality with several enterprise-grade primitives:

• Multi-tenancy: Built-in support for multi-user accounts and teams, with admin-gated host management.
• Workspace Integrations (Native MCP): The platform provides a native Model Context Protocol (MCP) facade. External tools—including GitHub, Google Workspace, OpenAPI, and GraphQL endpoints—are connected once per workspace and exposed to agents via ocm.search_tools and ocm.call_tool commands.
• Resource Management: Capacity and placement policies allow administrators to distribute agents across a fleet of servers.
• Sovereignty: Because the control plane and workers run on owned hardware, users maintain total control over their data, keys, and model traffic.

Deployment and Requirements

To run OpenClaw Machines, a KVM-enabled Linux host is required (either bare metal or a cloud VM with nested virtualization enabled). It is not compatible with macOS, Windows, or standard cloud VMs that lack nested virtualization.

Deployment typically follows a three-stage process:

1. Local Evaluation: Running the full stack and a Firecracker machine on a single KVM-capable Linux box.
2. Production Deployment: Integrating a domain, Cloudflare tunnels, and edge authentication with an enrolled host.
3. Full Workflow: Managing the complete lifecycle of machines, including backups and runtime upgrades.

Community Perspectives and Critiques

While OpenClaw Machines provides the infrastructure for scaling agents, community discussions highlight significant concerns regarding the reliability of the underlying OpenClaw agents and the security of agentic workflows in enterprise settings.

Reliability and Quality Concerns

Some users report that agent-generated code often results in "tangled messes" that require significant manual cleanup or are scrapped entirely due to quality concerns.

"Any tasks they assigned to the Claw systems would turn into tangled messes often requiring significant time investment to understand, and mostly ending in the team scraping the code changes over quality concerns."

Security and Trust

Critics argue that sandboxing the agent does not solve the primary risk of AI agents: the potential for unreliable agents to leak sensitive data or take incorrect actions on behalf of the user.

"The danger with OpenClaw IMO isn't so much that your local machine gets hacked... the danger is giving sensitive data to something horribly unreliable that can leak it or take actions on your behalf that are very dumb."

Technical Debt

Some developers have pointed to a high volume of bugs in the original OpenClaw codebase as a deterrent for enterprise adoption.

"I wouldn't want OpenClaw anywhere near a business I was running... That codebase is a nightmare. Just take a look at the hundred-plus pages of bugs on the Github repo."