en.Wedoany.com Reported - The security agent framework NanoClaw has partnered with JFrog, a software supply chain management platform, enabling AI agents to fetch resources from JFrog's curated registries.
Gavriel Cohen, co-founder of NanoCo AI, announced the partnership at a JFrog event in San Francisco. Cohen explained that a key feature of the Claw agent series is its ability to self-improve by acquiring tools and resources it lacks.
Cohen noted that this approach works well when accessing known local data requires a manual approval process. However, it is not ideal for npm packages. Even with sandboxed and isolated agents like NanoClaw, malicious code within containers can still take harmful actions.
Developers may be unfamiliar with a package and need time to fully assess its legitimacy and whether it has been tampered with. To address this, NanoClaw has integrated with the JFrog registry, ensuring that when agents download new tools and libraries, the resources come from vetted sources, reducing the agents' exposure to untrusted content.
Cohen also announced the availability of the "Agent Factory." This system, developed internally by the company, uses NanoClaw agents to handle pull requests. With the rise of AI coding agents, the volume of pull requests has surged, and the Agent Factory aims to triage them. Cohen pointed out that maintainers struggle to distinguish high-quality contributions from those seeking to build reputation through automated methods.
The Agent Factory is built using NanoClaw and hosted on exe.dev, which provides virtual machines with persistent storage. When a pull request is opened, the factory launches a dedicated worker agent, posts a thread on Slack, and staff triage the changes, review diffs, and propose test plans. All actions require a human click to approve before being triggered.
Cohen believes there are risks in handling pull requests containing prompt injections or unsafe code. Anyone using and configuring AI agents in a development environment may see instructions in configuration files like Claude.md that prohibit executing dangerous operations. He emphasized that instructions help guide agents to produce valuable output but are not a security mechanism. The only way to prevent an agent from taking undesired actions is to prohibit the action itself, not merely to give instructions.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
