NVIDIA NemoClaw 0.0.94 Tightens Agent Sandboxes

Meta description: What changed in NVIDIA NemoClaw 0.0.94: safer sandbox restores, redacted JSONL onboarding events, policy previews, security evidence, and faster Hermes builds.

Primary keyword: NVIDIA NemoClaw 0.0.94

Secondary keywords: NemoClaw release notes, AI agent sandbox security, OpenShell, JSONL onboarding, sandbox restore, Hermes BuildKit

Research window: July 24–25, 2026 (UTC) · Author context: Essa Mamdani, AI and full-stack developer

Introduction

NVIDIA’s NemoClaw 0.0.94 is a small version bump with a very practical theme: make agent sandboxes easier to recover, inspect, and operate safely. The July 24 release notes focus less on flashy model capability and more on the seams that make always-on agents risky in production—state restoration, gateway pairing, policy drift, onboarding telemetry, credential-shaped output, and build reproducibility.

NemoClaw is NVIDIA’s open-source reference stack for running OpenClaw, Hermes, and LangChain Deep Agents inside NVIDIA OpenShell sandboxes. Version 0.0.94 is not a compliance boundary by itself, but it improves lifecycle evidence before an agent reaches proprietary code, credentials, or networked tools.

Courtesy: NVIDIA. Source: https://docs.nvidia.com/nemoclaw/user-guide/openclaw/release-notes/2026/7/24. Accessed: 2026-07-25.

This screenshot proves the scope of the official v0.0.94 release notes. It does not independently validate NVIDIA’s hosted build-time comparison or guarantee that every deployment will see the same result.

The release is about lifecycle correctness

Agent security is not only about what commands a model may run. It is also about whether the system can restore the right state, report what happened, and avoid silently carrying stale or unreviewed configuration into the next run. That is where this release is most interesting.

Snapshot restore now clears stale contents only from state directories declared by the snapshot manifest. Target-only directories and directories whose backup failed are preserved.

Cross-sandbox OpenClaw restores also re-establish gateway pairing and verify it with an authenticated agent run. This matters because a restored filesystem is not necessarily a restored control plane. A sandbox that looks healthy but is paired to the wrong gateway is a security and operational failure, not a minor setup inconvenience.

The practical lesson is to treat restore as a tested state transition. Keep the snapshot manifest, restore logs, pairing result, and authenticated verification event together as one evidence bundle. If your team cannot answer which gateway a restored agent reached, the restore is not finished.

Read-only checks reduce upgrade surprises

The new nemoclaw upgrade-sandboxes --check behavior reads sandbox state without starting, recovering, or selecting a gateway. When registered sandboxes resolve to one recorded gateway, the command queries that gateway instead of whatever gateway the current environment happens to select.

This read-only preflight lets an operator ask “what would this environment upgrade?” without triggering lifecycle actions. It also separates inventory from mutation, making CI checks and approvals less ambiguous.

An upgrade gate can therefore be structured around three records:

1. the state discovered by --check;
2. the intended version and policy change;
3. the post-change health and authenticated agent verification.

Do not confuse a clean preflight with a safe upgrade. The command reduces surprise actions; it does not prove that an agent’s tools, prompts, network policy, or model endpoint are safe for your workload.

Policy previews and redacted evidence are the real security features

policy-add now compares an already-applied catalog preset with the live policy. If the content matches, it exits without mutation. If the preset changed, it previews the update. That idempotent behavior is valuable in automation because repeated reconciliation should not create needless writes or hide meaningful drift.

The network-policy guidance also explains when an endpoint requires tls: skip raw TLS passthrough, along with the controls that are lost: Layer 7 inspection and credential resolution. This is a useful warning because “the connection works” is not equivalent to “the policy still provides the intended inspection boundary.” Teams should record the exception, its owner, and the compensating control.

Onboarding now supports --events=jsonl, a versioned and redacted stream of canonical state-machine events. The human-readable progress stream stays on standard error, and closing or slowing the event stream does not cancel onboarding. That gives CI and internal tooling a machine-readable audit surface without making log consumers part of the operation’s control path.

Likewise, sandbox doctor --json redacts token-shaped values at both machine-readable output boundaries while preserving the original report’s exit status. Reviewed npm audits retain scanner, registry, timing, package, advisory, report-path, and failure provenance. A read-only advisory correlation tool can identify exact package and range matches before a reviewed audit record appears; ambiguous matches remain informational instead of blocking a release.

Redaction reduces accidental disclosure; provenance makes a result reviewable.

The cited build improvement is promising, not universal

NVIDIA says Hermes image assembly now groups repository payloads into five ownership-preserving BuildKit layers. In its first hosted comparison, the production build step fell from 205 seconds to 101 seconds, while layer export fell from 178.8 seconds to 70.4 seconds.

Courtesy: NVIDIA. Source: https://docs.nvidia.com/nemoclaw/user-guide/openclaw/release-notes/2026/7/24. Accessed: 2026-07-25.

This original chart visualizes only the four timings published in the release notes. It shows a roughly 51% reduction in the cited build step and roughly 61% in the cited export step, calculated from those values. The comparison is NVIDIA-reported and hosted; it is not a promise for every registry, cache state, runner, storage backend, or repository.

The engineering question is whether the layer boundaries preserve the right cache behavior for your own agents. Measure cold and warm builds, cache hits, file ownership, scanner ordering, and the time to recover after a failed layer export. A faster build that weakens provenance or makes a partial image harder to diagnose would be a poor trade.

What senior developers should test this week

Start with a disposable sandbox and an authorized, non-production agent. Test restore and upgrade paths before testing model quality:

• Create a snapshot with declared state directories, target-only content, and an intentionally failed backup path.
• Run upgrade-sandboxes --check in CI and verify that it performs no gateway start or recovery action.
• Consume --events=jsonl through a parser that tolerates new event fields and stores the redacted stream with the build record.
• Run sandbox doctor --json through the same log pipeline used by support tooling and confirm token-shaped values never reach the artifact store.
• Review any tls: skip policy exception as a loss of inspection and credential-resolution controls, not as a harmless syntax change.
• Compare cold and warm Hermes builds on the actual runner and registry you will operate.

Keep production credentials and write-capable tools outside this first evaluation. Our secure AI container supply-chain guide covers SBOM and provenance controls that complement sandbox lifecycle checks. For the tool boundary itself, see the MCP security threat-modeling guide. The broader AI agent stacks guide explains where sandboxing sits among skills, tools, memory, and deployment permissions.

Frequently asked questions

What is NemoClaw 0.0.94?

It is a July 24, 2026 NemoClaw release that improves sandbox restore and update behavior, onboarding events, policy reconciliation, security evidence, Hermes image assembly, and live end-to-end validation.

Does the release make AI agents safe by default?

No. It improves controls and observability in the reference stack, but teams still need least-privilege tools, network restrictions, secret handling, isolation, patching, review, and workload-specific testing.

What does --events=jsonl provide?

It provides a versioned, redacted stream of canonical onboarding state-machine events for automation and audit tooling. It is evidence about onboarding progress, not proof that the resulting agent is authorized to perform every later action.

Are the build-time improvements guaranteed?

No. NVIDIA reports 205-to-101-second production build timing and 178.8-to-70.4-second layer export timing in a hosted comparison. Your cache, runner, registry, storage, and repository will change the result.

Conclusion: measure the boundary, not just the model

NemoClaw 0.0.94 is a useful infrastructure release because it addresses the unglamorous failure modes that determine whether an agent sandbox can be operated responsibly. Safer restore semantics, read-only upgrade checks, redacted machine-readable evidence, policy previews, and better provenance all make a system easier to inspect before it becomes difficult to unwind.

The next step is not to hand an autonomous agent production access. Run the restore, preflight, policy, evidence, and build tests on your own controlled runner. Keep the NVIDIA timings labeled as vendor-reported, record the exceptions, and promote only the workflows that remain understandable under failure. Follow our AI engineering coverage for more evidence-led release analysis.

Keywords: NVIDIA NemoClaw 0.0.94, NemoClaw release notes, AI agent sandbox security, NVIDIA OpenShell, JSONL onboarding, sandbox restore, Hermes BuildKit, agent security evidence

Tags: NVIDIA, NemoClaw, OpenShell, AI agents, sandbox security, DevOps, developer tools

Sources

1. NVIDIA, “NemoClaw v0.0.94 release notes” — https://docs.nvidia.com/nemoclaw/user-guide/openclaw/release-notes/2026/7/24
2. NVIDIA, “NemoClaw” GitHub repository — https://github.com/NVIDIA/NemoClaw
3. NVIDIA, “NemoClaw documentation” — https://docs.nvidia.com/nemoclaw/latest/
4. NVIDIA, “AI Agents: Built to Reason, Plan, Act” — https://www.nvidia.com/en-us/ai/