OpenClaw is an open-source personal assistant whose tools run on your own machine unless you configure sandboxing, and it treats inbound messages as untrusted. Kortix is the open-source AI Operating System: every session runs in its own isolated sandbox, and connector credentials never enter the machine.
connectors: - slug: billing-api name: Billing API provider: openapi spec: https://api.example.com/openapi.json policies: - match: "get_*" action: always_run - match: "*" action: require_approvalActions are always_run, require_approval, block, shown as Allow, Ask, Block; approval holds the call until a person approves it.
OpenClaw is a personal AI assistant that runs as one Gateway on your own computer. Its own repository says tools run on the host for the main session unless you configure sandboxing, and that state, memory and credentials live on your hardware (OpenClaw's repository). It treats inbound messages as untrusted input and pairs unknown senders by default on DM-capable channels.
Those are sensible defaults for one person running an assistant on a machine they control. They are also policy a team has to assemble and maintain, because sandboxing, sender pairing and host hardening stay settings the team owns.
Kortix makes isolation part of every run instead of a setting. One isolated sandbox per session. Each session has its own isolated machine and branch. What an agent installs, runs or breaks stays in that sandbox, and only what it commits survives. Thousands of agents in parallel on one config, each on its own cloud computer.
Connector credentials are brokered server-side and never enter the machine. Secrets are encrypted at rest with a key per project. Per-resource permissions for people and agents. Roles, groups, and an audit trail.
An environment secret that a session is granted does reach that session's sandbox, so the claim that holds is the narrow one about connector credentials. Environment is the default exposure. Egress-enforced is experimental, and for it the sandbox holds a handle: Kortix substitutes the real value outside the sandbox, only on approved HTTPS hosts. An echoed value comes back as [REDACTED].
Kortix routes finished work through a review. Session work reaches main through a change request. Merge is default-deny for agents. A person reads the diff before anything lands, and a session can never merge a change request it opened itself.
Approval gates you set. Off until you set them. A team that wants every risky call to wait turns them on, and a connector policy can hold or refuse one action, down to the arguments of each call. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan.
OpenClaw is safe for the job it is built for, one person's assistant on hardware they own. Its repository describes the design as a trusted gateway with untrusted execution, and leaves sandboxing and sender pairing as settings you own.
The team question is broader, because agents end up acting across a company's tools and data. Kortix makes the boundary the default, with an isolated sandbox per session, connector credentials that never enter the machine, per-resource permissions for people and agents, an audit log of every action, and a person's approval before a change reaches main.
For the two projects side by side, the Kortix vs OpenClaw comparison and the OpenClaw alternatives guide map the same decision, and you can read the blog for the write-up. A team that needs the whole control plane inside its own network starts with self-hosting Kortix.
For one person on hardware they control, yes. OpenClaw's repository says it treats inbound messages as untrusted input, pairs unknown senders by default on DM-capable channels, and runs tools on the host unless you configure sandboxing.
Your prompts go to the model provider and the chat platforms you configure. OpenClaw's repository says it phones home for nothing but a daily version check, and that anonymous feature statistics are opt-in; update.checkOnStart: false disables both.
One isolated sandbox per session. Each session has its own isolated machine and branch. Only what the agent commits survives.
No by default. Session work reaches main through a change request. Merge is default-deny for agents. A session can never merge a change request it opened itself.
Yes. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.
next
Kortix is open source. Self-host free, or start on Kortix Cloud.
Open source · Any model, your keys · Self-host, VPC, or on-prem