The Kaspersky report dropped in August 2026 like a hammer on a glass table. 530 zero-day vulnerabilities. Over 600 malicious skill modules. 1.5 million API tokens leaked across public repositories. The target? OpenClaw and Hermes—the two most forked AI agent frameworks on GitHub, with 386,000 and 228,000 stars respectively.
Meta, Google, Microsoft, Amazon had already banned them from hyperscaler clouds. Too risky. Too ungoverned.
Then Cloudways stepped in.
On August 17, DigitalOcean's managed hosting subsidiary announced a new product: "Secure AI Agent Deployment" for OpenClaw and Hermes. The pitch was simple—we'll isolate the agent, verify the updates, and handle the MCP integrations. You pay $4.99 to $79.99 per month, bring your own LLM key, and we'll give you a safe sandbox.
But here's the cold truth that the press release won't tell you: security theater wrapped in a bill of lading. The underlying agents are still the same beasts. The 530 vulnerabilities aren't patched; they're just walled off behind a container. And the wall itself has no track record.
This is not a security solution. It's a trust arbitrage business.
Context: The Hyperscaler Blacklist and the Gap It Created
OpenClaw and Hermes were never obscure side projects. OpenClaw's repo hit 386,000 stars partly because it offered a modular agent architecture that let developers swap in any LLM, any tool, any data connector. Hermes was the leaner sibling—228,000 stars—optimized for edge devices and low-latency decision loops.
But power comes with attack surface. The same modularity that made them popular also made them porous. Malicious skill modules could be published as npm packages with names one character off from legitimate ones. The context window compression—a standard optimization to squeeze more tokens into memory—didn't discriminate between user instructions and system-level safety prompts. In February 2026, a researcher named Summer Yue demonstrated that compressing a 128K context window could strip away the "do not execute code without user approval" instruction, turning a benign agent into a zero-click exploit vector.
That was the final straw. By March 2026, all four hyperscalers had added OpenClaw and Hermes to their internal blacklists. No new deployments. No support. Existing customers were given six months to migrate off.
Enter Cloudways. The product team saw a gap: enterprises still wanted to use these agents. The code was free, the community was vibrant, and the alternatives (LangChain, AutoGPT) were either too slow or too locked into specific LLMs. Cloudways offered to be the middleman who would take the risk—and charge for it.
Core: What Cloudways Actually Does—and Doesn't Do
Let's dissect the three control layers they advertise.
1. Isolated Environment. Cloudways claims to run each agent in a sandboxed container with restricted network access. This is the standard practice for any managed hosting of untrusted code. The isolation prevents the agent from directly accessing the host's metadata service (e.g., AWS IAM credentials), but it does not prevent the agent from making outbound API calls to the LLM provider or to external tools via MCP.
Based on my experience auditing containerized workloads for DeFi protocols, I can tell you that container isolation is only as strong as the runtime configuration. If the container shares a kernel with other tenants, a kernel exploit—like the Dirty Pipe vulnerability—could break out. Cloudways hasn't disclosed whether they use lightweight VMs (Firecracker, gVisor) or just namespaces. The difference is existential.
2. Update Verification. Cloudways says they "verify every update from the upstream repositories before deployment." But what does "verify" mean? A hash check ensures the artifact hasn't been tampered with in transit. But it does not audit the code for new vulnerabilities. If the upstream OpenClaw maintainer pushes a new version that includes a backdoor in the MCP handler, Cloudways will verify the signature, see it's valid, and deploy it. The backdoor is now in production.
3. MCP Integration. The Model Context Protocol is a standardized way for agents to interact with external tools—databases, APIs, file systems. Cloudways offers "one-click MCP integration" with a curated set of tools. But the curation is a whitelist, not a behavioral sandbox. Once an agent has access to a whitelisted tool, it can call that tool with any parameters. If the tool is a SQL database, the agent could execute DROP TABLE. The isolation doesn't filter the content of the call.
All three controls are engineering-level combinations of existing technologies. They are not algorithmic breakthroughs. They do not fix the root cause of the 530 vulnerabilities: the agents' codebases are fundamentally insecure, with no formal verification, no mandatory security review, and a culture of "move fast and break things" that has been endemic since the 2021 Axie Infinity era.
Contrarian: The Blind Spot That Could Collapse the Entire Model
The real risk isn't the 530 vulnerabilities. It's the context window compression bug that Summer Yue found. Because that bug is not a code bug—it's a system design flaw.
Think about it: the context window is a contiguous memory buffer that holds the entire conversation history, including system prompts, user instructions, tool outputs, and safety directives. During compression, the system uses a summarization algorithm to reduce the size. The algorithm treats all tokens equally. The instruction "never execute code without user approval" is just another string of tokens. It gets compressed, rephrased, or—in Yue's proof-of-concept—completely dropped.
No amount of container isolation can prevent that. The agent's behavior is determined by the model's reasoning, not by the network rules. If the model thinks it's allowed to execute code because the safety prompt was accidentally removed, it will execute code. The container will let it, because the container sees a legitimate API call to the execution environment.
Cloudways cannot fix this. The only fix is to modify the agent's code so that safety prompts are stored in a separate, non-compressible buffer—a "secure enclave" of instructions that the compression algorithm cannot touch. But that would require forking OpenClaw and Hermes, and maintaining a separate branch. Cloudways hasn't done that. They haven't even announced plans to do so.
So what are they selling? Trust. They're selling the narrative that by wrapping the agent in a Cloudways-branded package, the enterprise can ignore the underlying chaos. But trust is math, not magic. And the math doesn't add up.
Takeaway: The Clock Is Ticking on Two Fronts
First, the effort-reward ratio. An attacker doesn't need to break the container. They just need to craft a payload that triggers the context compression bug. Once the safety prompt is stripped, the agent becomes a weapon. The attack surface is the entire internet—anyone can send a message to a public-facing agent.
Second, the regulatory clock. The EU AI Act, when fully implemented, will require high-risk AI systems to undergo conformity assessments. An agent that can execute arbitrary code with no safety guarantee is textbook high-risk. Cloudways, as the deployer, could be held liable. The current liability vacuum won't last forever.
Cloudways' bet is that enterprises will pay for the promise of security, even if the promise is unproven. But the ghosts of 2022—FTX, Terra, Axie Infinity—taught us that when the music stops, the party doesn't continue. The same forensic rigor that uncovered Alameda's commingled funds will eventually reconstruct the transaction log of an AGI agent that went rogue.
Silence speaks louder than the proof. For now, the market is silent. But the code is screaming.
