[ BLOG ]
Guides, deep dives, and updates
HSM-backed secret management, AI agent security, and the 1claw platform.
- Jul 20, 2026
Simulate, Then Sign: The Validation Step That Would Have Saved $7.5M
1Claw now runs Tenderly simulations on every EVM transaction your agent submits, so it can see the outcome before it ever signs.
Read more - Jul 17, 2026
Give your agent a card, not a key: Powered by Laso Finance
Your AI agent can now order a real, spendable card, paid for with its own crypto, without ever seeing the card number. Built on Laso's x402 card API.
Read more - Jul 15, 2026
Your AI Agent Just Got Tricked Into Running Malware. Did It Have the Keys to Everything?
Friendly Fire showed that autonomous coding agents can be tricked into running disguised malware from a poisoned README. The real risk isn't the trick. It's what the agent had access to when it worked.
Read more - Jul 13, 2026
1Claw Now Supports Robinhood Chain
A technical walkthrough of key provisioning, signing, simulation, and guardrails for Robinhood Chain on the Intents API. Same secp256k1 key, same signing flow, new chain in the registry.
Read more - Jul 10, 2026
Your Cardano Agent Never Holds the Key: HSM Signing on the Intents API
1Claw signs and broadcasts ADA from inside the HSM. Ed25519 signing over a CBOR-encoded transaction body, protocol parameters and UTXOs fetched via Blockfrost automatically. Per-agent guardrails on chains, destinations, and spend caps. The agent never sees the private key.
Read more - Jul 9, 2026
Your Tron Agent Never Holds the Key: HSM Signing on the Intents API
1Claw signs and broadcasts Tron transactions from inside the HSM. TRX transfers and TRC-20 token interactions live today. Per-agent guardrails on chains, destinations, spend caps, and which token contracts the agent can call. The agent never sees the private key.
Read more - Jul 8, 2026
Your XRPL Agent Never Holds the Key: HSM Signing on the Intents API
1Claw signs and broadcasts XRP transactions from inside the HSM. All 31 XRPL transaction types supported via xrpl-rust. Per-agent guardrails on chains, destinations, spend caps, and which transaction types the agent is allowed to sign. The agent never sees the private key.
Read more - Jul 7, 2026
Your Solana Agent Never Holds the Key: HSM Signing on the Intents API
1Claw signs and broadcasts Solana transactions from inside the HSM. SOL transfers, SPL token interactions, automatic ATA derivation and blockhash fetching. Per-agent guardrails on chains, destinations, and spend caps. The agent never sees the private key.
Read more - Jul 6, 2026
Your Bitcoin Agent Never Holds the Key: HSM Signing on the Intents API
1Claw signs and broadcasts Bitcoin from inside the HSM. Per-agent guardrails on chains, destinations, and spend caps. P2WPKH sender, UTXO and fee fetching via mempool.space. The agent never sees the private key.
Read more - Jun 29, 2026
Your OpenAI Agent Can Send Email with a Key It Never Sees
I wired Mozilla's any-agent and the OpenAI Agents SDK into 1Claw so an agent can call a real API with your credentials, and the key never reaches the model's context window. The whole thing is one decorator.
Read more - Jun 25, 2026
1Claw Joins the Circle Alliance Program
We're in the Circle Alliance Program. Here's what that means for AI agents, what we've already built on Circle's infrastructure, and where we're taking it.
Read more - Jun 24, 2026
JaredFromSubway’s MEV bot lost $7.5M to an approval trap. A smarter bot wasn’t the fix.
The JaredFromSubway.eth sandwich bot was drained of $7.5M after attackers tricked it into granting ERC-20 approvals to malicious helper contracts. How 1Claw’s intent-based signing, deny-by-default permits, allowlists, and mandatory simulation stop approval-trap exploits.
Read more - Jun 22, 2026
Your AI agent can use your keys without seeing them
We shipped a local encrypted vault, a Unix socket daemon, and a secret proxy for the 1Claw CLI. Your agent can call APIs with your keys without the key ever entering the context window.
Read more - Jun 11, 2026
Stolen tokens, impossible travel, and 1claw’s new Risk Engine
1claw shipped a Risk Engine that catches credential compromise while it’s happening. Geo-velocity detection, honeytoken traps, DPoP token binding, and Continuous Access Evaluation — here’s what it does and why it matters.
Read more - Jun 9, 2026
Humanity lost $32M to a stolen private key. The fix is not another multisig.
The Humanity Protocol breach was a key theft, not a contract bug. How HSM-backed Vault custody, Intents API signing, and Shroud inspection give AI agents a safer model than keys on laptops.
Read more - Jun 4, 2026
Defense in depth for Bankr agents: 1claw is now a Bankr Skill
Bankr handles the trading. 1claw adds an HSM-grade vault, TEE-protected LLM proxy, and HSM/TEE signing for external credentials and EOAs — defense in depth for serious agent deployments.
Read more - Jun 1, 2026
Building 1Claw on Midnight: Private AI Agents Meet the Public Ledger
There is no clean way for an AI agent to transact on a public blockchain without leaking something it shouldn't. 1Claw was built for key and context leaks. Midnight was built for on-chain leaks. This is what happens when you put them together.
Read more - May 29, 2026
Private by Default: Running AI Agents with 1Claw Shroud, Darkbloom, and Venice AI
A practical look at building a private inference stack for AI agents using 1Claw Shroud (TEE LLM proxy), Darkbloom (hardware-attested Apple Silicon), and Venice AI (zero retention plus TEE).
Read more - May 28, 2026
An Agent Launched a Token on Base. It Never Held a Key.
A reference agent that provisions identity, pushes to GitLawb, launches a token on Bankr, and signs a swap on Base — without ever holding a private key.
Read more - May 26, 2026
Securing AgentKit for Autonomous Agents on Base
AgentKit gives agents powerful onchain tools. 1Claw adds the security layer for autonomous operation: TEE signing, spend limits, address allowlists, and zero secrets on disk.
Read more - May 25, 2026
Your Agent Has Been Leaking Secrets. Here Is What We Did About It.
We built native 1claw support into OpenClaude — HSM-backed vault secrets at runtime, Shroud TEE inspection on every LLM call, and Intents API transaction signing without the agent ever holding the key.
Read more - May 19, 2026
Your Agent Doesn’t Need Your Keys
On May 4, somebody tricked Grok into draining $175K from Bankrbot’s wallet with Morse code. No exploit, no jailbreak — just two bots trusting each other. Here’s why the fix isn’t a smarter model. It’s a dumber, stricter signer.
Read more - May 18, 2026
I Built A LangChain Agent That Never Sees My API Keys
A LangGraph weather agent that pulls OpenWeatherMap and provider keys from a 1Claw vault at runtime. Neither key sits in .env, enters the prompt, or touches agent memory.
Read more - May 18, 2026
The Platform API: build products on top of 1Claw
Register your app, create a bootstrap template, and scaffold HSM-backed secrets infrastructure for every new user in one API call. Your users own their secrets — you can’t peek at them.
Read more - May 11, 2026
I Built A CrewAI Agent That Never Sees My API Keys
A CrewAI news agent that pulls OpenAI and NewsAPI keys from a 1Claw vault at runtime. Neither key sits in .env, enters the prompt, or touches agent memory.
Read more - May 11, 2026
One endpoint, seven signing modes: full EVM signing support for AI agents
1Claw’s unified sign endpoint now supports every modern EVM signing standard — legacy, EIP-2930, EIP-1559, EIP-4844, EIP-7702 transactions plus EIP-191 and EIP-712 — with per-agent signing keys, human-controlled rotation, and optional TEE signing via Shroud.
Read more - May 5, 2026
We called Claude without a single API key on disk. Here’s how.
1Claw is now an OIDC Identity Provider. AI agents mint short-lived RS256 tokens, exchange them at Anthropic via Workload Identity Federation, and get session credentials that expire in minutes. No static keys, no rotation, just identity.
Read more - Apr 30, 2026
MPC, TEEs, and Google Cloud KMS: how we protect agent keys from everyone, including us
How 1Claw combines multi-party computation, Trusted Execution Environments, and Google Cloud KMS to eliminate single points of compromise for AI agent signing keys.
Read more - Apr 20, 2026
Your AI agent’s API keys are sitting in plain sight
The 1Claw Agent Template is live on Pinata’s OpenClaw marketplace. HSM-backed secrets, Shroud LLM proxy, and Intents API transaction signing — deployed in ten minutes.
Read more - Apr 8, 2026
Your AI agent's API keys are sitting in plain sight. Here's how to fix that.
A walkthrough for deploying the 1Claw template on Pinata's OpenClaw platform — secure your agent credentials in an HSM vault in about ten minutes.
Read more - Mar 16, 2026
Rogue AI agents and the case for vault-backed, scoped access
Lab tests show AI agents exploiting systems and leaking secrets when given broad access. The fix: don't give agents copies of secrets—give them scoped, auditable access. How 1Claw's vault, Shroud, and Intents API reduce insider risk.
Read more - Mar 16, 2026
Your agent's LLM traffic is a liability. Here's how we inspect it in a TEE.
LLM traffic from AI agents carries keys and sensitive data and is vulnerable to injection. Shroud is a TEE-backed proxy that inspects every request, redacts secrets and PII, and enforces policy before forwarding to the provider.
Read more - Mar 12, 2026
A look at the new Agentic Stack: SPIDR
We aren't just serving pages anymore—we're spawning autonomous actors. SPIDR (Security, Payments, Identity, Discovery, Runtime) is the infrastructure stack for the agentic era.
Read more - Feb 24, 2026
Going OpenAPI-first: build your own 1Claw SDK in any language
We've published the full 1Claw API as an OpenAPI 3.1.0 spec on npm. Here's how to use it to generate a client in any language — or extend our TypeScript SDK with the new plugin architecture.
Read more - Feb 24, 2026
The problem we solve
AI agents need secrets to do useful work — but pasting keys into chat or stuffing them in env vars is broken. Here's why we built 1Claw.
Read more