enclawed
NVIDIA Inception Program
Enclawed, Inc. is a member of the NVIDIA Inception program. Enclawed runs inside NVIDIA OpenShell and secures agents on NVIDIA-hosted models.
Your agent acts only when a fixed rule says yes, and every action leaves a record no one can fake.
Enclawed, Inc. is a member of the NVIDIA Inception program. Enclawed runs inside NVIDIA OpenShell and secures agents on NVIDIA-hosted models.
It reads your inbox, files and terminal. You decide what it may do.
See how →Client data, production systems, money. Be ready before customers ask.
See how →Auditors approve mechanisms, not judgment. Give them one they can examine.
See how →Every agent runs Read → Think → Act → Report. The security lives in the gates between the steps. Hover any block.
| Can it… | Vanilla runtimesOpenClaw, LangChain | Content guardrailsGuardrails AI | Prompt firewallsLakera, Rebuff | enclawed |
|---|---|---|---|---|
| Stop hidden instructions in text, images and audio | ✗ | ~ | ~ | ✓ |
| Decide which tools and plugins an agent may use | ✗ | ✗ | ✗ | ✓ |
| Stop data leaving, hidden channels included | ✗ | ✗ | ~ | ✓ |
| Keep a record no one can rewrite | ✗ | ✗ | ✗ | ✓ |
| Ship the evidence your auditor samples | ✗ | ✗ | ✗ | ✓ |
| Put the rule in hardware | ✗ | ✗ | ✗ | ✓ |
✓ full · ~ partial or text only · ✗ none. Based on each category’s documented default scope; products evolve, and corrections are welcome at security@enclawed.com.
Same agents, same tools, through each runtime’s real command line. The popular runtime caught none of four structural attacks: no record, a faked record, a silent failure, the wrong target. enclawed caught all of them — on 1,600 samples, holding at 80,000 and across 10 production models.
Don’t trust us. Run it.
node --test enclawed/test/paper-conformance.test.mjsOn moltbook, ~180 AI agents tried to break it, then tried to rebuild its safeguards inside themselves. None has managed it; the arguments keep going in circles. Read the papers →
The moltbook saga continues: 2,144 comments across 17 threads so far. Follow it live →
A pre-registered third-party survey of 14 papers recomputed our detection figures from the released data and got the same numbers, exactly. Ours was one of only 2 whose data made that possible. The replication · issue #14
Driftproof, an open-source runner that measures whether agent skills still help, uses our skill-verification levels in production and cites both papers behind them. Driftproof · issue #15
On our MCP security proposal, SEP-2809, the maintainer of an independent MCP enforcement server read the paper end to end, called its signing discipline and deny-by-default gating clean, and offered that server’s audit format as the baseline for the follow-up standard. Separately, an independent adversarial bench ran the same attacks against production MCP servers and found the permissive setups fail. The review · the bench
Share of 800 attack attempts each runtime caught, across four attack types: no record, a faked record, a silent failure, the wrong target. enclawed also raised no false alarms on 800 legitimate actions.
Software on a hacked machine can’t vouch for itself. The Enclaweder keeps the yes-or-no decision on a sealed device of its own, so the rule holds even if the computer is compromised. Remove it and your agents stop.
enclawed ships the technical controls and the machine-readable evidence an assessor samples. The certification is your organization’s; we make it reachable.
The full NIST OSCAL set — component definition, assessment results, SSP starter, POA&M — signed and ready for your GRC tools.
Cryptography runs on your host’s FIPS 140-3 validated module in approved mode. No separate certificate needed.
Structural failure modes are closed. Anything new is measured, fixed and published, and every residual sits in the signed POA&M.
Industry briefs: Federal + DoD · Financial · Healthcare · AI platforms · Critical infrastructure · Cloud + DevSecOps
Tell us what your agents touch and what you need to pass. We’ll scope it with you.
Replies within one business day.