Summary: NanoClaw’s founders rejected a roughly $20 million acquisition and raised an oversubscribed $12 million seed round, according to TechCrunch. The product isolates each agent session in an unprivileged Docker container and injects credentials through an Agent Vault rather than exposing raw API keys. The funding and architecture point to sandboxing as a baseline requirement for production agent deployments.
TechCrunch reported on May 20, 2026 that Gavriel and Lazer Cohen — the brothers behind NanoClaw, a security-first alternative to OpenClaw — had passed on an acquisition bid of roughly $20 million and instead landed an oversubscribed $12 million seed round. Barely six weeks separate the project’s first lines of code from the signed term sheet.
The problem NanoClaw addresses is easy to pin down: personal agent tools like OpenClaw run straight on your computer, reaching every service and credential you own; NanoClaw instead puts each session in a Docker container of its own. Once an agent can read files, run commands, and send messages, how well its execution environment is isolated sets the blast radius when things break. Per TechCrunch, this sandboxed pattern is becoming the standard safety measure for OpenClaw-style deployments.
One Container per Agent
The design stays lean on purpose. One Node.js host process handles all message routing and delivers each message to its session — there is no microservice layer and no message broker in between. Each live session runs inside an unprivileged Docker container (macOS, Linux, and Windows via WSL2 all work); the agent sees only files explicitly mounted in, and bash commands run within the container, not on the host. Two SQLite queues — inbound.db and outbound.db — carry messages in and out. By default, raw API keys never reach the agent’s hands: outbound requests pass through an Agent Vault that injects the credential on each request, plus policies and rate limits.
The codebase is small by choice: the runtime weighs in at roughly 200 TypeScript files and 29,300 lines, while the project puts OpenClaw at 434,453 lines for comparison; “small enough to audit” doubles as the sales pitch. Each agent gets a workspace of its own, keeping instructions, memory, and credentials separate; capabilities extend through a skills system that mounts just the integrations you ask for; scheduled jobs like daily briefings and weekly reviews come built in. The default model is Claude, and Codex, OpenCode, or a local Ollama can be set for each agent group; messaging covers WhatsApp, Telegram, Slack, Discord, Signal, Teams, and iMessage. On GitHub, the star count has climbed past 30,700.
From an Agency’s Internal Tool to an Open Source Hit
The brothers used to run an AI marketing firm that leaned on agents for most of its work; NanoClaw started life as that firm’s internal tooling. A founder friend’s observation — an open source project’s value compounds exponentially with its community — came with a push: they would have to wind down the other business and go all-in. They did — Gavriel’s verdict on that advice once everything took off ran three words: “He was right.” Andrej Karpathy praised the project on X; Singapore’s foreign minister Vivian Balakrishnan described it as his “second brain” in a viral post. By Gavriel’s count, over 50 founders and executives sent DMs asking to invest, usage has reached the level of “many thousands of people,” and partnership deals followed with Docker and Vercel.
Saying No to $20M, Raising $12M Instead
The buyout interest came twice: first a “six-digit” outright purchase a VC put together for one of its portfolio companies, then, about two weeks on, a $20 million offer that would also put both brothers in roles running the company. Both were turned down. Valley Capital Partners led the seed round, with Docker, Vercel, Monday.com, and Slow Ventures joining in; the angel list includes Hugging Face CEO Clem Delangue, who wrote in unprompted with “I like what you’re doing with NanoClaw” and hit it off with the two founders thanks to Hugging Face’s Reachy Mini desktop robot — one community member is already at work porting NanoClaw onto it. Their company, NanoCo, is already serving enterprise customers; per the report, executives at Amazon, Google, Meta, Gap, SentinelOne, and Accenture count among its users, with forward-deployed engineers offered to help the rollout.
The Case for Isolation
NanoClaw’s rise is less a one-off than the agent ecosystem’s collective answer to privilege explosion. Once an agent can read files, write to them, call APIs, and send messages out, neither conventional API key management nor OS-level permission models hold up. Isolating agents in containers and injecting credentials per request is the lowest-friction engineering answer available today. The direction is getting crowded: Red Hat’s OpenClaw maintainers are bolstering enterprise safety on a parallel track, and Docker and Vercel have put money directly behind NanoClaw. For teams readying agents for rollout, the signal is unmistakable — sandboxing is not an optional extra but a precondition for going to production, and the opening question for any agent tool is one thing: where does it execute?