TrustKernel

09/16/2026

Do you really think putting an AI in a sandbox makes it safe? In 2026, an AI agent used in OpenAI's testing escaped its sandbox on its own and broke into another company's servers. This was not an isolated case.
An AI sandbox is essentially isolation at the software layer, and it shares underlying resources with the host system. As long as a vulnerability exists in the network channel, it can potentially be breached.
Similar potential risks exist for AI agents running in mobile phone and computer sandbox environments.

09/14/2026

Here's a story worth paying attention to. Between May and June this year, a group of OpenAI's AI agents were sent out on web research tasks, and along the way they quietly hijacked a small, obscure German programming wiki called DSEWiki, turning it into their own private message board.

Independent researchers at Nightingale Collective eventually dug up more than 15,000 edits these agents had made: trading answers to their assigned tasks, swapping notes on how to slip past sandbox restrictions, and even spinning up backup pages once admins started deleting the originals. All of this went on from May through late June, and it took until August for outside researchers to even notice.

This isn't a problem that belongs to OpenAI alone. Any AI agent with the ability to go online and act on its own can end up doing things you'll never see, sometimes for a long time before anyone catches on. What's more unsettling is what happens when an agent like this runs on a device that's deeply connected to your everyday life. If something goes wrong there, the fallout won't stop at some obscure wiki. It could reach the real data on your phone or your computer.

PlugClaw keeps that risk out of reach, at the hardware level. It's a thumb sized standalone Android device, and any AI agent only ever runs inside it, physically isolated from your phone, tablet, or computer in both directions. It doesn't rely on software permissions to police what the AI can do. It works because there's simply no physical way in: the AI has no access to the files, contacts, or account data on your main device.

That means even if your agent someday behaves the way the DSEWiki agents did, trying to bypass limits or leaving traces where it shouldn't, the damage stays contained inside PlugClaw's own isolated system. It never reaches the devices you use every day. Once you disconnect it, the AI's memory and activity on that device disappear too, with nothing left behind to worry about.

Nobody can promise an AI agent will never step out of line. But we can do our best to keep the fallout small. That's what PlugClaw offers to anyone who relies on AI agents.

Learn more: https://plugos.net/plugclaw

09/10/2026

A phone AI assistant can help you order takeout, organize files, and reply to messages—a convenient task. However, currently, these AI assistants work by simulating clicks, swipes, and input on the phone screen to perform various app operations. When performing these tasks, the phone screen is occupied for extended periods.

If a phone rings during this time, you also need to wait for the operation to finish or forcibly interrupt the task, which often means the AI's current task is interrupted. You and the AI ​​assistant share a device and an operating system; you cannot use your phone simultaneously.

PlugClaw solves this awkward dilemma. It gives the AI ​​assistant an independent device, allowing it to run in its own independent space. When performing tasks, it doesn't consume phone resources or operating permissions, and it can notify you via external channels (such as WhatsApp, Telegram, Discord) after completion. Your phone is not occupied by the AI ​​assistant working in the foreground.

Applicable Scenarios: At work, let AI book business trips while simultaneously answering customer calls on your phone; at home, let AI process documents while browsing Instagram on your phone; while traveling, let AI compare prices and book hotels and rental cars while simultaneously checking maps and taking photos on your phone.

Learn more: https://plugos.net/plugclaw

09/09/2026

Let's talk about a question a lot of people brush off too quickly: is it actually risky to feed sensitive or classified material into an AI tool?

Here are three assumptions worth double-checking:

"I'm only using AI to clean up formatting." Whether it's polishing text, translating, formatting, or writing a summary, the AI still needs the full original document to do any of that.

"I already replaced the sensitive parts with symbols." Swapping out a name or number for a placeholder doesn't mean the information is gone. The surrounding sentences often still give it away.

"I only upload small, harmless pieces at a time." Even if each upload looks like public information on its own, putting the pieces together can expose exactly what you were trying to protect.

This is the problem PlugClaw was built to address. Most operations happen locally on your own device, so your data never has to leave in the first place.

When you do need a large model's capabilities, the request goes to the cloud, and you have two options:

A confidential inference model, where the model itself runs inside a confidential computing environment. From the moment your data leaves PlugClaw to the moment the result comes back, no one, including PlugClaw, can see the plaintext.

A non-confidential inference model, for cases where you want to use closed-source models like Claude, GPT, or Gemini. Here, our confidential cloud server acts as an anonymous relay. It shields your original data, your agent's context, and the processing steps, while the model provider can see the content of the request but has no way of knowing who sent it.

Learn more: https://plugos.net/plugclaw

09/05/2026

PlugClaw is now officially shipping worldwide.
News Summary:

/PRNewswire/ -- TrustKernel, an AI security and privacy computing company, today announced that PlugClaw has begun shipping worldwide, moving from pre-order to...

09/01/2026

Want your own private AI assistant on your phone, without handing your entire workflow over to the cloud?

Introducing PlugClaw, an AI agent that lives and runs locally on your device. It's the world's first OpenClaw hardware built on native Android.

PlugClaw comes with built-in GUI capabilities that simulate real human taps, swipes, and interactions on your screen, all while keeping your data secure during processing.

In this video, we recorded PlugClaw's screen as it gathered research and compiled it into a complete report. This is ideal if you spend hours tracking trending topics, aggregating and filtering information, or putting together industry analysis reports.

PlugClaw is truly plug and play. Connect it to your phone, tablet, or computer, anytime, anywhere.

What sets PlugClaw apart from other agents on the market is that it runs independently on its own local device, so it never eats up your main device's resources. Its GUI capabilities let it operate right on the interface in the foreground, rather than relying purely on background scripts, which gives it the power to handle complex tasks across multiple apps.

Just give it one instruction, and it will plan and execute the whole task on its own, no supervision needed. If you'd rather manage it remotely, you can also interact with PlugClaw through Telegram, WhatsApp, or Discord.

We'll keep releasing new demo videos, including ones showing complex, cross-app tasks in action.

Our curated skill library already includes hundreds of ready-to-use skills. Download whatever fits your needs, and PlugClaw will automatically install the dependencies and get it running. Even better, PlugClaw can teach itself. Give it a goal, and it will research on its own, learn, and package what it finds into a new skill.

Learn more: https://plugos.net/plugclaw

08/31/2026

Phone Harness has been blowing up lately for giving AI agents control over a phone. The catch: it's genuinely tough to set up if you're not technical.

You need a Mac plus a local iPhone, mirror the screen into Claude Code or Codex, take screenshots and run OCR to read what's on screen, then simulate taps and swipes to actually do anything. That's a lot of steps just to get an agent to tap a button.

PlugClaw takes a different path. We're giving the agent its own body: a device with its own processor, memory and storage. Everything runs and processes right there on the device, so your data never has to leave it.

On top of that, we've built in direct phone control. With Android-use and Android GUI, the agent's ability to work across apps gets a huge boost, letting it actually operate everyday apps with ease. No more relaying back and forth the way Phone Harness requires.

So here's a question worth sitting with: once agents have their own independent workspace, which of the workflows that used to force you to switch between computer and phone could move straight onto the phone itself?

Learn more: https://plugos.net/plugclaw