NanoClaw and Echo Partner to Protect AI Agents From Software Vulnerabilities

The partnership hardens the browser, tools, and libraries AI agents rely on, closing a software attack surface that isolating an agent does not address

TEL AVIV, Israel, July 29, 2026 /PRNewswire/ -- NanoClaw, the secure open source AI agent framework, and Echo, the leader in vulnerability-free application infrastructure, today announced a partnership to harden the software environment where AI agents work. With Echo's hardened version of the NanoClaw agent runtime, NanoClaw becomes the first open source agent framework to give its community a hardened agent environment, secured all the way down to the software it runs on. NanoClaw has more than 30,000 GitHub stars and 250,000 downloads since its open source launch, and is used by practitioners at companies including Amazon, Gap, Google, Meta, SentinelOne and Accenture.

AI agents are becoming trusted personal assistants to individuals and working members of the team for businesses. They browse the web, open files, run code, and use software tools on behalf of the people and teams they work for. To do that, every agent works inside their own computer: a software environment with a browser, parsers, system libraries, and language runtimes, and that software carries thousands of known vulnerabilities that often sit unpatched. Isolating an agent limits what it can reach, but it does nothing to protect the agent from vulnerabilities in the software inside. If the agent is hacked, its memories, sensitive data in its environment, or accounts it has access to can be accessed by attackers.

"For years the industry has tolerated known vulnerabilities sitting unpatched, because exploiting them took a serious attacker and most systems were never worth the effort," said Gavriel Cohen, co-founder and CEO of NanoCo, the company behind NanoClaw. " A modern prompt injection is like a social engineering attack: it lures the agent to an innocent-looking page, and a known hole in the browser turns that visit into a compromise. Or it hands the agent a file, and a vulnerable parser turns opening it into code execution. NanoClaw tackled agent isolation, access control, and human approval on sensitive actions, allowing hundreds of thousands of people to use agents for real work. We're now making sure the software the agents use carries no known holes, the same way you keep an employee's laptop and browser patched."

NanoClaw and Echo built the hardened runtime together. NanoClaw defines the agent environment and the isolation and policy layer around it. Echo rebuilds the software in that environment from scratch with only the essential components, cutting the known vulnerability count from thousands to near zero. The result is a fully hardened agent runtime with the components an agent actually uses baked in, including the chromium browser, node, bun, pnpm, corepack, git, curl and unzip. Echo hosts and maintains it as the single source of truth, and NanoClaw users opt in to the hardened runtime, which is free and simply requires a login during setup. The unauthenticated path of building your own agent runtime locally remains available.

"An agent reaches the world through a browser, a set of parsers, and dozens of libraries, which can all carry known vulnerabilities," said Eylam Milner, co-founder and CTO of Echo. "The standard software agents are built on carries thousands, and most come from the underlying layers, not the application code. We rebuild that whole environment as a drop-in replacement so it starts secure, and our agents keep it that way as new vulnerabilities appear."

Echo's approach is powered by purpose-built AI agents. When a new vulnerability is discovered anywhere in the world, Echo's agents research it, identify affected software, find or develop a fix from unstructured sources, run compatibility testing, and open a pull request for human review. This lets Echo's team maintain thousands of secure containers, libraries, OS packages, and more.

The hardened NanoClaw runtime is available to the community today at github.com/nanocoai/nanoclaw

About NanoClaw

NanoClaw is the secure open source AI agent framework created by NanoCo, with more than 250,000 downloads and 30,000 GitHub stars. NanoCo delivers a professional assistant to every employee inside the tools they already use, with each agent running in its own sandbox, credentials injected at runtime through a policy-enforcing gateway, human approval on sensitive actions, and full auditability. Based in Tel Aviv, NanoCo was founded in 2026 and is backed by Valley Capital Partners, Docker, Vercel, Monday.com, Slow Ventures and others.

About Echo

Echo is building the trusted source for secure software. Its AI-powered platform continuously rebuilds and maintains secure artifacts, eliminating known vulnerabilities before they reach production. By providing organizations with a trusted source for the software they already depend on, Echo helps customers including Varonis, EDB, Webflow, and UiPath reduce software supply chain risk without slowing development. Founded by Eilon Elhadad and Eylam Milner, veterans of Israel's Unit 8200 and the IAF's Ofek unit, who previously sold their software supply chain security company Argon to Aqua Security, Echo raised $50 million within 10 months of founding.

Media Contact:
Ali Goldberg
[email protected]

SOURCE NanoClaw