In my judgment, OpenAI wrote about a research environment for training frontier models; for a personal agent, limiting credentials and exits comes first, and covert channels become a main risk only once there is a second tenant that must be isolated.
The motivation post (order 1) of the Sandbox Series. Letting AI agents execute untrusted code carries direct risks: data exfiltration, privilege escalation, lateral movement, supply-chain poisoning, persistent backdoors. Sandboxing is not an optional add-on — it's the first line of defense.
OpenClaw's security docs open by stating the scope: this is a personal-assistant trust model, one gateway per trusted operator. It explicitly is not a security boundary for mutually adversarial users sharing one agent — and a 'not vulnerabilities by design' list pins that down.