Isolating an AI agent like OpenClaw in its own VM

Why isolate the agent

An agent with shell, browser and messaging access acts with whatever permissions its host has. If a prompt injection in a web page or message convinces it to do something unexpected, the damage is limited to what that machine can reach. A dedicated VM keeps your files, SSH keys, browser sessions and other services out of that blast radius. Be clear about the limit, though: the VM cannot protect anything the agent can still reach through the accounts, API keys or network access you grant it, so those need their own controls.

The VM we use

On Proxmox VE, the agent gets its own VM: 4 vCPUs, 10 GB of memory and a 128 GB virtual disk on ZFS-backed SSD storage with discard and an I/O thread enabled. The QEMU guest agent is installed so Proxmox can shut the VM down cleanly and freeze its filesystem during backups. That is plenty for the agent, its runtime and a headless browser.

Network and access

• Enable the Proxmox firewall on the VM's network interface and allow only what the agent needs
• Keep the agent's control or gateway port off the public internet, and still require its gateway authentication and device pairing: a VPN or tunnel is a route, not access control
• Restrict which tools and commands the agent may run, and run the security checks in OpenClaw's own documentation after each change
• Do not mount shared drives or give it credentials to your other servers
• Prefer a separate network segment from your production workloads

Secrets and accounts

Give the agent its own API keys with spending limits, and its own accounts for any messaging or email it uses, so you can revoke them without touching anything else. Keep the keys in the VM's configuration, not in prompts or chat history.

Snapshots and downtime

Take a VM snapshot before every upgrade or configuration change, so a bad update is quick to roll back. Snapshots are not backups, so keep separate backups and test a restore. And when you are not using the agent, shut the VM down: an agent that is off cannot be tricked into anything.