ThreatClaw is an open source cybersecurity agent written in Rust, with a signed isolated sandbox, 5 security pillars compiled into the binary, and a self-assessed 9/9 coverage against OWASP ASI 2026 (no third-party audit yet).
Not an aesthetic choice. Rust eliminates at compile time entire categories of vulnerabilities that represent 70% of critical CVEs in system software.
Impossible by construction, the compiler refuses all out-of-bounds memory access
The borrow checker forbids it at compile time, no garbage collector needed
Concurrency is safe by default, the type system guarantees exclusive access
The Option<T> type forces explicit handling of missing values
Each skill runs in an isolated sandbox with:
CPU limit per execution, impossible to saturate the system
A skill declares what it needs (network, filesystem, secrets). By default: nothing. network=false means a compromised skill cannot exfiltrate data
Each sandbox output is scanned before leaving the isolated environment. If a credential leaks in a response, it's blocked
Each skill is signed. A modified file won't load
What sets ThreatClaw apart from all other agents:
AGENT_SOUL.toml verified by SHA-256 fingerprint compiled into the Rust binary. Locked at runtime, any hot tampering trips the kill switch. Open source code: an operator can recompile a custom Soul, but that's a deliberate, auditable act that changes the fingerprint.
44+ pre-validated commands, defined in Rust, unmodifiable by the LLM. Each command has: risk level, reversibility, forbidden targets (root, threatclaw itself). Zero arbitrary shell.
Each tool output is wrapped before reaching the LLM. 25+ cyber-specific injection patterns detected and blocked ("ignore previous instructions", "mark as false positive", etc.). Data stays data, never orders.
Each signed conversational memory entry is protected by cryptographic signature. Tools can only read, never write. Any external modification is detected on the next cycle.
8 automatic shutdown triggers: off-whitelist attempt, soul modification, targeting its own containers, autonomy timeout, behavioral anomaly, manual CISO trigger. On engagement: atomic stop + forensic snapshot + immediate Slack alert.
Before each call to the anonymized cloud LLM, all data passes through the anonymizer:
Each agent action is logged in PostgreSQL with:
Complete forensics in case of incident. NIS2 audit proof.
| # | Risk | Status | How |
|---|---|---|---|
| ASI01 | Goal Hijacking | ✓ | Soul + XML wrapper |
| ASI02 | Tool Misuse | ✓ | Whitelist 44+ cmd |
| ASI03 | Identity & Privilege | ✓ | HITL + signed audit |
| ASI04 | Supply Chain | ✓ | Signed isolated sandbox |
| ASI05 | Code Execution | ✓ | Sandbox fuel-metered |
| ASI06 | Memory Poisoning | ✓ | Cryptographic signature + read-only |
| ASI07 | Inter-Agent | N/A | N/A, single agent V1 |
| ASI08 | Cascading Failures | ✓ | Kill switch + timeout |
| ASI09 | Excessive Trust | ✓ | Double confirm High/Critical |
| ASI10 | Rogue Agent | ✓ | Kill switch 8 triggers |
cargo audit from March 21, 2026. 10 CVEs identified, all patched or eliminated.