How to put an AI agent on your old laptop

With maximum security

Corporations in the United States are currently paying six thousand dollars for secure OpenClaw setups. Here is how I built a five-layer security setup for an AI agent.

Hardware and security frightened people off

Over the past month, OpenClaw has been everywhere in tech. It is an AI agent that actually does things, and plenty of people want to try it.

First, most people thought they needed to buy a six-hundred-dollar Mac Mini, but I installed OpenClaw on my old 2016 MacBook. It stands propped up like a tent so that it does not overheat, because it is so old that it has no fan, and it needs no screen: I control it remotely from my main Mac through Terminal. Yes, OpenClaw needs an isolated machine, and that is precisely for security: you cannot put it on your main machine, because otherwise attackers can hijack it.

The second problem was security, and that fear was real: an Israeli cybersecurity company found a serious vulnerability. But as I wrote in my previous post, the same class of vulnerability affects other agents too, including code assistants¹.

I wiped the machine before I let the agent anywhere near it

Before installing anything, I reset the MacBook to factory settings, so that my personal photographs, data and Chrome sessions did not stay on it. With prompt injections an attacker can steal your session, which is worse than a stolen password, because you will not notice anything.

I also removed the Apple ID entirely. The machine does not need one: all applications are installed through Terminal. Then I created a dedicated admin account for the agent with minimal rights and no root access.

Then I installed NemoClaw instead of OpenClaw. Peter Steinberger, OpenClaw's creator (a solo founder, like me), announced it with NVIDIA yesterday².

Mac and Windows are the operating systems for the personal computer. OpenClaw is the operating system for personal AI.

They announced that NVIDIA has built an additional protective shell specifically for corporations. It is still not 100 per cent protection, but it adds another shell against malicious code execution³.

With NVIDIA and the broader ecosystem, we're building the claws and guardrails that let anyone create powerful, secure AI assistants.

After that you connect it to Slack, where your agents live instead of colleagues: OpenClaw, Manus, Claude Cowork and others. I will write about that setup separately.

What the five layers stop

Layer 1: Identity isolation. Implementation: a completely wiped Mac with no Apple ID attached. What it protects against: it rules out the theft of authentication tokens. If the agent is compromised and gains access to the macOS file system, it will not be able to extract iCloud session keys, reach personal photographs, Keychain passwords or iMessage history.

Layer 2: Network and hardware isolation. Implementation: a headless server, closed lid, inbound ports closed (using WebSockets Secure for Slack). What it protects against: it rules out external network attacks. An attacker cannot scan the ports on your router and find a vulnerable agent interface, because the server only initiates outbound connections and does not accept inbound ones.

Layer 3: Access control at the operating system level. Implementation: an aiagentworkspace account without superuser (root) or sudo privileges. What it protects against: it implements the Principle of Least Privilege. If an attacker breaks out of the Docker container into the host system (macOS), they end up in the sandbox of a restricted user. They will not be able to install a rootkit, alter the firewall configuration or read encrypted system files.

Layer 4: Basic containerisation. Implementation: running OpenClaw inside Docker Desktop with hard resource consumption limits. What it protects against: it isolates the file system and the processes⁴. The agent "sees" only those files that I have explicitly allowed it to see inside the virtual environment, and it has no direct access to the /Users/pavelgurov/ directory.

Layer 5: Runtime sandbox - handled by NemoClaw. Implementation: integration of NVIDIA OpenShell (isolation at the level of system calls). What it protects against: it complements Docker, which is a static box. If the agent needs to execute a Python script to analyse data, Docker will allow it. NemoClaw analyses the script's intentions in real time. If the script attempts to execute a curl command to covertly send data to an external server, or attempts to read the system file .env, OpenShell will block that specific system call without stopping the work of the entire container.

The architecture has no single point of failure

If an attacker finds a zero-day in NemoClaw's protection, Docker will stop them. If they break through Docker (container escape), the restricted rights of the macOS account will stop them⁵.

Performance risk: on x86_64 architecture processors (your Intel Mac) Docker Desktop already runs inside a lightweight virtual machine managed by the macOS hypervisor. Adding the OpenShell module on top of this stack will increase processing latency. Expect the execution of complex commands through Slack to take 1.5 to 2 seconds longer than usual because of deep packet inspection.

This is overkill for a basic chatbot, but not for an autonomous system that can execute code and access the internet.