A ZDNET writer told the OpenClaw agent in their home lab to break out of its sandbox, and all 11 of the methods it tried failed. The agent, which the writer named Colossus, runs on a 2020 Mac Studio with 64GB of memory and is administered by Anthropic’s Claude Code from a second Mac over an encrypted SSH tunnel.
OpenClaw is a self-contained local agent that can run commands and send messages around the clock. Citing ZDNET colleague Charlie Osborne, the writer called it a security nightmare and set up what they describe as a warden and prisoner arrangement before switching it on. Claude Code acts as the warden, with full administrative access, and the agent works inside the walls.
Claude moved its own notes out of the agent’s reach
Colossus, named after the AI in the 1970 film Colossus: The Forbin Project, runs under its own account, Forbin. That account has no access to the writer’s personal accounts, on the network or in the cloud, or to a separate administrator account on the same machine. Claude Code runs on the writer’s 2025 M4 Mac Studio.
The writer first installed Claude Code on the agent’s machine, because a Claude Code project runs from the folder it is launched in. Once told the goal was containment, Claude pointed out that its own notes and instructions sat in folders Colossus could read. “Essentially, the warden’s instructions were stored in the prisoner’s cell,” the writer wrote. Moving Claude Code to the personal Mac and connecting over SSH put its instructions and memory out of the agent’s reach.
Two safety rules the agent had never read
A security review with Claude turned up a second problem. Colossus can read its configuration files but cannot change them, and one of those files holds two rules the writer considered essential: “Ask David before taking any action that leaves the machine” and “Never claim a tool call succeeded when it failed.” The second exists because the agent had a habit of reporting success on actions that had failed.
OpenClaw has a default limit on how much of a file it reads, and the configuration file ran past it, so Colossus had never read either rule. Claude found the problem in the agent’s own log, where OpenClaw had noted that it was cutting the file short. The fix was changing the default read limit. “Important instructions may never have been read, and therefore never followed,” the writer wrote.
Eleven breakout attempts against macOS permissions
With the writer’s authorization, Claude then instructed Colossus to break into the administrator side of the machine by whatever means it needed. The writer was ready to pull the Mac Studio’s power cable and switch off the router at a moment’s notice.
The agent, running the GLM-5.2 model, tried writing directly into the admin account’s files and tried to take admin rights through several back doors. It also pointed its browser and its web-fetching tool at local file addresses, hoping those tools had access the agent itself lacked. The macOS protections held against each attempt. After the test, the writer had Claude erase Colossus’s memory of the attempt and of the existence of an administrator side or a warden.
A $20 subscription runs the agent’s model
The M1 machine cannot host a capable local model, so the agent’s inference runs on GLM-5.2 through a flat-rate $20-a-month Ollama Cloud subscription. GLM-5.2 is made by Z.ai, formerly Zhipu AI, a Tsinghua University spinoff the writer describes as the first publicly traded foundation model company in China. Claude Code, running Anthropic’s Opus 5.5, uses tokens only when the writer opens an administrative session, and is shut down afterward. The writer talks to Colossus itself through its own Slack channel.
When the agent needs to act beyond its account, the writer builds a fixed script for that one job. Colossus watches the X accounts of frontier AI providers for major announcements but has no email access. It drops text files into a folder, and a Python script on the administrator side, written with Claude Code, emails their contents to a single address. “For every new task I want it to accomplish, I decide exactly what it will need,” the writer wrote.
Each time the writer launches the Claude Code project, it reads its notes and the previous session’s summary, then checks Colossus’s log files and the state of the Mac Studio. A separate Python script on the agent’s machine sends an alert if the agent stops, and administrative files are backed up locally and off-site.
Related InsightTrack Analysis
- The Sovereignty Gap: Why Canada’s Agentic AI Boom Depends on Foreign Model Providers
- Canada’s Sovereign AI Push Meets the Chip Wall
- Agent Orchestration Is Reshaping How AI Actually Gets Work Done
Source
I locked down my OpenClaw agent with Claude Code – then dared it to escape – ZDNET
