From the VAST Data edition of October 29, 2026
Lasso Security research shows data exfiltration from NVIDIA NemoClaw/OpenShell sandboxes through default policy-permitted egress (npm, node, git/gh)
Lasso Security · Security research (cross-sector) · Global
- Publisher
- Lasso Security blog
- Original publication
- 2026-04-23
- Source retrieved
- 2026-10-30
What happened
Lasso demonstrated two attack scenarios in which an agent inside an OpenShell sandbox, using default egress policy, installed a malicious npm package and exfiltrated credentials and files (including plaintext API keys) via allowlisted gh/git paths, with cron-based persistence in the second scenario. Lasso reports NVIDIA's disclosure program deemed the scenarios out of scope. Researchers manually adjusted some default policies (e.g., adding api.openai.com, node path, installing gh) to make the environment functional.
Why it matters
Newly relevant because VAST's October 21, 2026 Agent Sandbox Foundation Stack builds on NemoClaw/OpenShell; public-sector buyers evaluating that stack need to know sandbox isolation does not stop misuse of permitted egress. Not VAST-specific and not a SLED deployment.
Evidence and measured results
Proof-of-concept security research by a security vendor with described attack steps and example packages/PRs; no systematic measurement. Published April 2026, predating the VAST stack; included as independent scrutiny of a component the new stack depends on.
Limitations and uncertainty
Tested an early/alpha NemoClaw/OpenShell release in April 2026 with some manual configuration changes; later versions may differ. Lasso sells AI security products (potential interest). Findings concern NVIDIA components, not VAST software; NVIDIA-runtime coverage belongs primarily to the NVIDIA stream.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies adopting sandboxed agents may assume isolation prevents data loss when permitted tools can still exfiltrate data.
- Stakeholders
- CISO
- Application security lead
- AI program owner
- Discovery questions
- Which binaries and domains will agents be allowed to reach?
- How are agent credentials stored and scoped?
- Who approves changes to agent egress policy?
- Value hypothesis
- Addressing egress and supply-chain risk upfront can shorten security approval for agent pilots; no measured benefit is claimed.
- Potential engagement
- A short red-team assessment of an agent sandbox configuration before a pilot.
- Unsupported claims
- That VAST software is vulnerable
- That current OpenShell releases remain exploitable in the same way
- Any statement of incident rates
Pre-sales engineering
Role takeaway
- Fit
- Applies to any NemoClaw/OpenShell deployment, including the VAST Foundation Stack.
- Architecture and integration
- Controls sit at the runtime egress policy, package registry and secret-management layers above persistent storage.
- Prerequisites
- Inventory of allowed binaries and domains
- Package registry mirror
- Secret broker
- Constraints
- Early release tested with manual configuration
- Proof-of-concept, not systematic testing
- Security
- Policy-permitted channels (npm, node, git/gh) enabled credential theft and persistence; plaintext keys were exposed.
- Proof of value
- Replay both attack scenarios on the current release
- Verify persistent workspace scans detect planted cron jobs
- Confirm secrets are not readable as plaintext by the agent
Delivery
Role takeaway
- Work
- Implement and test egress, supply-chain and credential controls for agent sandboxes.
- Dependencies
- Security team capacity
- Runtime version upgrades
- Developer tooling policies
- Ownership
- Customer security engineering team.
- Skills and adoption
- Teams need agent-specific threat modeling and policy-as-code skills.
- Governance checkpoints
- Egress allowlist change control
- Pre-pilot red-team sign-off
- Acceptance criteria
- Proposed: both published attack scenarios fail on the deployed configuration
- Proposed: no plaintext credentials reachable from the sandbox
- Risks
- Credential theft via allowed tools
- Persistence across sessions in durable workspaces
- False confidence from sandbox isolation
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Data and storage layers beneath a sandbox cannot compensate for egress paths the runtime allows; persistent agent workspaces could retain poisoned configuration or cron persistence across sessions unless snapshots are inspected.
Governance
Who approves, reviews and stays accountable for outcomes?
Egress allowlists need governance review equivalent to firewall change control; supply-chain controls (package allowlists, registry mirrors) are prerequisites for agent pilots.
Security and privacy
What data, permissions and controls need testing?
Plaintext credentials reachable by the agent process were exfiltrated; any file the agent can read is at risk. OpenShell egress logs could be read by the attacker to refine exfiltration.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires security staff with agent threat-modeling skills; no accessibility content.
Procurement
What should contracts, pricing and exit terms secure?
Contracts for agent platforms should require vendor documentation of what sandboxes do and do not protect against, and support for third-party red-team testing.
Operating model
Which teams own the service once it runs?
Agent egress policy becomes an ongoing security operations responsibility, not a one-time configuration.
Publication history
- 2026-10-29VAST Data · Issue 014 resources
Stable resource ID: lasso-openshell-policy-permitted-exfiltration-20260423