The numbers are ugly. Kaspersky found 530 vulnerabilities in OpenClaw and Hermes. Over 600 malicious skills. 150 million API tokens exposed. These aren't edge cases. They are systemic code failures. Yet Cloudways, a DigitalOcean subsidiary, launched on August 17 a managed hosting service for these very agents – the same ones Meta, Google, Microsoft, and Amazon banned from their clouds. The pitch: isolation, validation, integration. The price: $4.99 to $79.99 per month. The unspoken truth: enterprises are not buying AI capability. They are buying a promise that the explosion won't happen on their watch.
Context: The Banned Become a Business
OpenClaw (386,000+ GitHub stars) and Hermes (228,000+ stars) are the rockstars of open-source AI agents. They are powerful, flexible, and deeply unstable. After a February 2026 incident where a context compression routine stripped safety instructions – causing a cascading failure dubbed the Summer Yue event – hyperscalers blacklisted them. Too much liability. Too many attack surfaces. The market gap was obvious: enterprises that wanted these agents but couldn't run them safely had no vendor. Cloudways stepped in.
The product is simple in concept: a managed environment where agents run in isolated containers, updates are verified before deployment, and MCP (Model Context Protocol) integration is one-click. The business model is even simpler: charge a flat monthly fee, let customers bring their own API keys (BYOK), and offload the GPU cost to external LLM providers. Cloudways takes no model inference risk. It sells only the wrapper.
But a wrapper is not a cure. And the underlying agent code is still the same code that leaked 150 million tokens.
Core: The Architecture of Trust – and Its Cracks
Let's dissect the three control mechanisms Cloudways advertises.
First, isolation. The claim is that each agent runs in a sandboxed environment, preventing it from accessing the host or other tenants. This is standard containerization. But isolation does not prevent an agent from executing malicious actions within its own scope. If the agent has a skill that calls an external API with stolen credentials, isolation won't stop the data exfiltration. It only limits the blast radius to the client's own deployment. The 600+ malicious skills Kaspersky identified are not blocked by a network namespace. They are blocked only by a skill allowlist – which Cloudways must curate and update. And that curation is only as good as the last audit.
Second, update verification. According to Cloudways, every update to OpenClaw or Hermes is checked before it reaches the customer. But what does that check entail? Hash verification? Signature validation? Behavioral sandboxing? The article does not specify. Based on my experience auditing DeFi protocols, I can tell you that verification without dynamic analysis is a placebo. The Summer Yue event was not a malicious code injection. It was a logic flaw in the compression routine. No static signature would catch it. The flaw was in the design, not the binary. If the verification pipeline cannot detect logic errors, it is a branding exercise, not a security guarantee.
Third, MCP integration. The Model Context Protocol is a standardized way for agents to interact with tools and data sources. Cloudways offers one-click MCP integration, which lowers the barrier for enterprises to connect their CRM, databases, and APIs. But MCP is a protocol, not a security layer. The gateway that routes tool calls can become a new attack surface. If an agent's skill is compromised, it can use MCP to exfiltrate data through a legitimate tool connection. The isolation environment may not log internal MCP traffic at the granularity needed for forensic analysis. The enterprise is buying a dashboard, not a firewall.
These three controls are engineering-level improvements, not fundamental risk reductions. They are analogous to a DeFi protocol adding a multisig treasury while the core smart contract has a reentrancy bug. The wrapper is cosmetic.
Contrarian: The Real Product Is Trust, Not Safety
The market narrative is that Cloudways is solving a security problem. I disagree. The product is solving a procurement problem. Enterprises want to use OpenClaw and Hermes because their developers demand it. But compliance teams cannot approve a deployment on a hyperscaler that has banned the software. Cloudways provides a third-party host that is not bound by the same blacklist. The enterprise pays for the permission to use the agent, not for the assurance that the agent is safe.
This is a dangerous trade. The trust model is fragile. Cloudways has no track record of preventing AI agent incidents. It has no published security audit of its isolation environment. It has no insurance policy for data breaches caused by agent actions. The pricing – $4.99 to $79.99 per month – is too low to cover the cost of rigorous, continuous red teaming. The margins are built on the assumption that nothing will go wrong, which is the same assumption that killed Terra/Luna.
And there is a deeper blind spot: the responsibility gap. If a Cloudways-hosted agent executes a command that deletes a customer's production database, who is liable? The customer? The upstream OpenClaw maintainers? Cloudways? The article explicitly states this gap remains unresolved. In DeFi, we saw similar gaps when smart contract exploits wiped out user funds. The code was open-source. The platform was just a frontend. But the courts and the community still demanded accountability. The same will happen here.
Takeaway: The Layer 8 Problem
Cloudways is betting that enterprises will pay for a trust wrapper around fundamentally untrustworthy code. It is a bet that might work until it doesn't. The real question is not whether the isolation environment can contain a rogue agent. It is whether the market will accept a solution that manages symptoms without curing the disease. The Summer Yue event was a warning. The 530 vulnerabilities are a checklist. The 150 million leaked tokens are a consequence. Until the OpenClaw and Hermes codebases undergo a ground-up security rewrite – not just a wrapper rewrite – this product is a ticking clock.
Audits don't guarantee safety. If the code is flawed, the wrapper is just a pretty coffin. The market is buying a narrative, not a fix. And when the next exploit hits, the bill will come due.
