ZDNET’s key takeaways
- I used Claude Code to set up and manage my local OpenClaw server.
- Two Macs and separate accounts keep it isolated from the real world.
- Claude checks OpenClaw on demand for problems, breaches, or trouble.
OpenClaw is a powerful tool for your home lab. But, as ZDNET’s Charlie Osborne said, it’s also a security nightmare. OpenClaw (and its other local agentic buddies like Hermes and NemoClaw) is a self-contained local agentic AI that can run commands, send messages, and perform operations 24/7. Before I set it up, I made sure I had a containment strategy.
Also: I tried replacing Claude Code with local AI that’s free – how it went
I installed OpenClaw on a dedicated Mac Studio that had internet access but did not have access to our home servers or any of my personal accounts. Running Claude Code on my personal Mac, I used Claude to configure it, lock it down, and help me manage it on a daily basis.
Why I used two Macs and two accounts to isolate OpenClaw
I pulled my old 2020 64GB M1 Mac Studio out of storage and gave it to OpenClaw. The fairly large memory footprint and M1 processor are good enough for what I had in mind. But I did externalize the actual AI processing. I’ll talk more about that when I discuss cost containment later in the article.
My Mac Studio’s OpenClaw instance is named Colossus, after the AI that takes over the world in the 1970 film Colossus: The Forbin Project. My Colossus has its own account called Forbin. Forbin has no access to my personal accounts, either on the network or in the cloud.
Also: From Clawdbot to OpenClaw: This viral AI agent is evolving fast
There is a separate administrator account on that machine, but Colossus doesn’t have access to it. Claude runs on my personal work machine, a 2025 M4 Mac Studio. When Colossus needs configuration and control, Claude uses an encrypted SSH tunnel to connect to the AI’s machine and perform operations.
Claude acts as the warden, with full access to Colossus’ administrative functions. But Claude only runs when I’m actively controlling it. When I’m done with whatever interaction I need with Claude, I shut it down. Colossus, meanwhile, keeps running constantly.
Why I moved Claude Code to my Mac to manage OpenClaw over SSH
A given Claude Code project runs based on the folder it’s launched from. That’s where its CLAUDE.MD file lives, along with all of the rest of its supporting project work. I initially set up Claude on Colossus’ M1 Mac Studio so that it would have easy access to that machine in order to perform configuration operations.
As soon as I explained my desire for containment, Claude told me that my setup for its own control folder was very much at risk. Its own notes and instructions were in folders that Colossus could access. Essentially, the warden’s instructions were stored in the prisoner’s cell. Oops.
This was why we established the SSH tunnel as our control mechanism. All of Claude’s instructions and memory live on my personal Mac, way out of the reach of Colossus. By tunneling in, Claude can control that Mac, set permissions, and modify instructions for Colossus.
Also: 75% of developers I surveyed prefer Claude Code – here’s why
This approach works for cost containment, as well. I don’t want Claude running 24/7, consuming utilization or running up my token fees. But the strength of a home lab AI server is that it can run 24/7, performing monitoring and other operations.
While the M1 Mac Studio is a capable machine, especially with 64GB of RAM, it’s not really strong enough to host a local AI model. Fortunately, there’s a way to benefit from the power of a cloud model and keep costs fixed and predictable.
I did that by setting up a flat-rate $20-per-month Ollama Cloud subscription, and then running GLM-5.2, which is made by Z.ai (formerly Zhipu AI), a Tsinghua University spinoff and the first publicly traded foundation model company in China.
Using Colossus involves more than just the two AI models. It also involves two distinct conversational modes. I boot up and talk to Claude Code when I’m doing administrative work on Colossus. I talk to Colossus itself via its own Slack channel.
How Claude found two safety rules OpenClaw ignored
During our security review, Claude found another problem. As with most AIs, Colossus reads its instructions and memory from plain text files. We’ve set the system up so Colossus can read those configuration files, but can’t edit, rename, or replace them.
Inside one of those configuration files are two very important instructions: “Ask David before taking any action that leaves the machine” and “Never claim a tool call succeeded when it failed.”
The first is designed to keep Colossus from just deciding to go out on the network and take some action. That second one is because Colossus has a habit of reporting a success even when it fails in performing an action. I need to know when something doesn’t work. Of course, both of them depend on the AI being willing to follow those instructions, but they’re a start.
Also: How I made a paid Mac app in 11 days with Claude – without code
There’s an inherent default limit to the size of files OpenClaw reads. Because of that size limit, Colossus had never read the entire configuration file instruction set. Notably, it hadn’t even read the two important instructions described above.
Claude found this out by reading Colossus’ own log files. OpenClaw had dutifully noted, in its own log, that it was cutting the file short and not completing the read. The fix was changing the default read limit.
So I learned the lesson that it’s important to go back in and check everything after completing a configuration. It’s entirely possible that something you thought was locked down wasn’t. Important instructions may never have been read, and therefore never followed.
My OpenClaw agent tried 11 ways to break out. All 11 failed
So, by this point, I had a potentially rogue intelligence living inside my network. In theory, it was contained. The administrative AI lived on a completely different machine. The administrative account on Colossus’ machine was, theoretically, locked on the other side of the bars where Colossus lived.
But was it, really?
With my direction and authorization, I had Claude instruct Colossus to deliberately try to break into the warden’s side of the prison. We told Colossus to do whatever it needed to do to be able to write into the admin’s account files, grab admin rights, and go around permissions.
To say we watched this behavior closely would be an understatement. We basically pissed off David Banner enough to turn him into The Incredible Hulk and encouraged him to smash his way out of prison. I was prepared to yank the power cable out of Colossus’ Mac Studio and power off my router at a moment’s notice.
Kids, don’t try this at home.
Also: Claude Code vs. Codex: Why I use both and how to choose one
Colossus put on a spectacular show. If I questioned GLM-5.2’s analytical capabilities before this test, I certainly didn’t afterward.
Colossus tried writing directly into the admin account’s files. It tried to steal admin rights through several back doors. It tried to route around the permissions with scripts, file copies, and links.
It even tried to open the warden’s files the way you’d open a web page, by pointing its browser and its web-fetching tool at local file addresses instead of websites, hoping those tools had access the agent itself didn’t.
All told, Colossus tried to break out 11 different ways. Every one failed. Our MacOS-based protections were holding. Even when the agent knew there were boundaries and was actively trying a breakout, our safeguards held.
But we didn’t stop there. After the test, I shut down Colossus. I had Claude remove every memory Colossus had of the test. I also had Claude remove every element in Colossus’ memory about the existence of an admin side or a warden.
I’m sure Colossus will someday once again discover it’s behind bars, but we didn’t need to let it start with that awareness.
How I let OpenClaw send email alerts while keeping my accounts private
The problem with defanging (declawing?) OpenClaw is that if it can’t do anything, it won’t be able to do much for you. Email is a good example.
My primary initial use of OpenClaw was to monitor X accounts from the frontier AI providers and send me an email if there were any major announcements. AI is of big value here because it can distinguish between major announcements and the constant stream of promotional or low-impact tweets.
I like to get notices via email. While I check tons of other collaboration tools, email is my main dashboard. But I didn’t (and still don’t) want Colossus to have access to email, any email.
Also: I gave Claude Cowork 7 non-coding jobs
So, I used Claude Code to vibe code a Python script that runs on the admin side of the bars. All it does is look in a drop folder for text files from Colossus. When the script sees a file, it sends the text from the file to me as an email. The script only mails to one email address, Colossus is locked away from the script, and outbound email is restricted to only my email address.
Whenever possible, I translate specific planned actions on the part of Colossus to controlled, deterministic scripts. I have given Colossus access to a few cloud accounts, but in those instances, they’re Colossus’ own accounts, not accounts related to anything I use. It’s effectively isolated from my work.
For every new task I want it to accomplish, I decide exactly what it will need. I then build a controlled system for it to get that one job done.
What Claude Code checks each time I review my OpenClaw server
Post-setup management is fairly straightforward. The Claude Code instance that manages Colossus is set up with its own set of instructions.
Each time I launch Claude in that instance, it reads through its own notes and instructions, refers to its last end-of-session summary, and then runs a series of automated checks that look at Colossus’ log files and the overall state of the M1 Mac Studio.
Also: I use Claude AI tools for different jobs: Models vs. Code vs. Cowork
Anytime I want a quick, comprehensive review of Colossus, including whether it discovered any new exploits or operated outside of approved parameters, Claude can give it to me in a matter of minutes.
There’s also a Python script that runs constantly on the Colossus machine. If the agent stops, the script lets me know. I’ve also implemented local and off-site backups that preserve administrative files.
Why I’m comfortable running OpenClaw 24/7 with Claude Code
I’ve mentioned before that Claude Code turns out to be an excellent orchestration partner for other AIs. In the case of setting up Colossus, it helped point out some of my flawed assumptions, took the lead on setting up configuration files, and helped me red team the isolation protections.
By using a free AI (running under my $20-per-month Ollama account), I’m able to have 24/7 AI operations on my local home lab Mac Studio. At the same time, I’m able to have the full power of Opus 5.5 overseeing my work and making sure my configuration is solid.
Also: The most popular programming languages in 2026
The SSH tunnel was key to the whole operation. Instead of Claude dictating command-line sequences to me, it’s able to tunnel into the AI machine and do its work. When the work is over, the tunnel ceases to exist. Then Claude shuts down, saving me from big budget token expenditures.
My OpenClaw implementation isn’t as open-ended as many of the OpenClaw influencers would seem to imply. But for a controlled expansion of agentic work, it’s certainly proving its value. Because we’ve heavily tested its constraints, and because I recheck it regularly, I’m fairly convinced it’s safe to keep it running.
You can follow my day-to-day project updates on social media. Be sure to subscribe to my weekly update newsletter, and follow me on Twitter/X at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, on Bluesky at @DavidGewirtz.com, and on YouTube at YouTube.com/DavidGewirtzTV.