On May 20, 2026, TechCrunch reported that the brothers behind NanoClaw — Gavriel and Lazer Cohen — had turned down a roughly $20 million acquisition offer and instead closed an oversubscribed $12 million seed round. The project, a security-focused alternative to OpenClaw, went from the first lines of code to a signed term sheet in under six weeks.
The pain point NanoClaw targets is concrete. Personal agent tools like OpenClaw run directly on your computer with access to all your services and credentials. NanoClaw runs each session inside its own Docker container. Once an agent can read files, execute commands, and send messages, the isolation of its execution environment determines the blast radius when something goes wrong. TechCrunch notes this sandboxed approach is becoming the common method for safer OpenClaw-style setups.
Agents in a Container
The architecture is deliberately minimal. A single Node.js host process routes messages to the right session — no microservices, no message broker in the middle. Each active session runs in its own unprivileged Docker container on macOS, Linux, or Windows under WSL2; agents only see files explicitly mounted into them, and bash commands execute inside the container rather than on the host. Messages flow through two SQLite queues (inbound.db and outbound.db), and by default agents never hold raw API keys: outbound requests route through an Agent Vault that injects credentials per request, with policies and rate limits attached.
The codebase is kept intentionally small — roughly 200 TypeScript files and 29,300 lines at runtime, against the 434,453 lines the project cites for OpenClaw — and “small enough to audit” is the pitch. Each agent gets its own workspace with separate instructions, memory, and credentials; extension works through a skills system, so you mount only the integrations you want; scheduled tasks like daily briefings and weekly reviews are built in. Claude is the default model, with Codex, OpenCode, or a local Ollama configurable per agent group, and channels include WhatsApp, Telegram, Slack, Discord, Signal, Teams, and iMessage. The repo has passed 30,700 GitHub stars.
From Internal Tool to Viral Project
The Cohens previously ran an AI marketing firm where agents did most of the work, and NanoClaw began as its internal tooling. A founder friend advised them that open source projects gain value exponentially with their communities and that they would have to shut down the other business and commit fully. They did — Gavriel’s verdict on the advice, after everything took off: “He was right.” Andrej Karpathy praised it on X, and Singapore’s foreign minister Vivian Balakrishnan called it his “second brain” in a viral post. Gavriel estimates more than 50 founders and executives DM’d asking to invest, usage has grown to “many thousands of people,” and Docker and Vercel signed partnerships.
Turning Down $20M, Taking $12M
The buyout offers came twice: first a “six-digit” outright purchase from a VC on behalf of a portfolio company, then roughly two weeks later a $20 million offer that included jobs running the company for both brothers. They declined both. The seed round was led by Valley Capital Partners with participation from Docker, Vercel, Monday.com, and Slow Ventures; angels include Hugging Face CEO Clem Delangue, who reached out with the note “I like what you’re doing with NanoClaw” and bonded with the founders over Hugging Face’s Reachy Mini desktop robot — a community member is already porting NanoClaw to it. The company, NanoCo, now books enterprise customers — executives at Amazon, Google, Meta, Gap, SentinelOne, and Accenture are reportedly users — and offers forward-deployed engineers to help with rollout.
Why Sandboxing Matters
NanoClaw’s rise is not an isolated story; it is the agent ecosystem’s collective response to privilege explosion. When agents can read and write files, call APIs, and send messages, neither traditional API key management nor OS-level permissions are adequate. Container isolation plus per-request credential injection is currently the lowest-friction engineering answer. The same direction is crowded now: Red Hat’s OpenClaw maintainers are hardening enterprise safety in parallel, and Docker and Vercel have put money behind NanoClaw directly. For teams preparing to deploy agents, the signal is clear — a sandbox is not an add-on but a precondition for production. The first question to ask when buying an agent tool is simply: where does it execute?
Sources
- NanoClaw creator turns down $20M buyout offer, raises $12M seed instead — TechCrunch
- NanoClaw — nanoclaw.dev
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.