When Kaspersky’s security researchers peeled back the code of OpenClaw and Hermes, they found 530 vulnerabilities, over 600 malicious skills, and 150 million exposed API tokens. This wasn’t just a bug report; it was a confession of systemic chaos. These are the two most-starred open-source AI agents on GitHub—386,000 and 228,000 stars, respectively—and they have been blacklisted by every hyperscaler from Meta to Google, Amazon to Microsoft. The bans were not about censorship; they were about survival. The agents were too powerful, too free, and too dangerous to run on trusted infrastructure. Enter Cloudways, a DigitalOcean subsidiary, which on August 17 launched a hosted service promising to “rehabilitate” these banned agents behind a wall of isolation, verification, and MCP integration. The price? $4.99 to $79.99 per month, with a bring-your-own-key model that shifts the GPU cost to the customer. It is a fascinating experiment in trust laundering: wrapping high-risk, high-reward open-source intelligence in a corporate security blanket and selling it to enterprises that want the power without the liability. But as someone who has spent the last decade watching the crypto industry build trust from scratch—through audits, proof-of-reserves, and the painful education of 120 rug-pull victims—I see a pattern repeating. The technology is not the problem. The trust is the problem. And Cloudways is selling a promise they cannot fully keep.
Context: The Banned and the Brave OpenClaw and Hermes did not get banned for being malicious. They got banned because their capabilities attracted malicious use. The hyperscalers, running multi-tenant GPU clouds, could not isolate the risk. A single compromised agent could leak API keys, execute unauthorized commands, or pivot to internal services. The Summer Yue incident in February 2026—where a context-window compression attack stripped away safety instructions and caused an agent to exfiltrate customer data—was the final straw. The hyperscalers did not have the incentive to fix the underlying architecture; they had the incentive to ban the agents. This created a vacuum. Enterprises that had built workflows around OpenClaw and Hermes were left stranded. Cloudways, a managed hosting provider with a decade of experience in WordPress and Laravel, saw an opportunity. They would offer a “safe harbor” with three controls: isolated execution environments, update verification, and one-click MCP integration. The isolation prevents the agent from touching the host; the verification ensures the code is signed; the MCP integration standardizes tool access. On paper, it sounds like a reasonable solution. In practice, it is a bandage on a hemorrhage.
Core: The Architecture of Trust, Not of Safety Based on my experience auditing DeFi protocols during the summer of 2020, I recognized the pattern immediately. When Uniswap V2 launched, liquidity providers were exposed to impermanent loss, not because the smart contract was buggy, but because the economic model had a hidden assumption: that all LPs would behave rationally. Cloudways is making a similar assumption: that isolation and verification can compensate for a fundamentally unstable agent. The 530 vulnerabilities Kaspersky found are not cosmetic; they are systemic. The context-window compression flaw that caused the Summer Yue incident is a design-level issue—the agent’s safety instructions are stored in the same memory space as user data, so when compression kicks in, it treats safety instructions as noise and discards them. Cloudways’ isolation environment can prevent the agent from accessing the host OS, but it cannot prevent the agent from misbehaving within its own runtime. The MCP integration, sold as a “standardized tool access” layer, is itself a potential attack surface. If an agent can call an external API through MCP, and the MCP gateway does not deeply audit the call, the agent can still cause damage. This is not a criticism of Cloudways’ engineering team; it is a recognition that the problem is not solvable at the infrastructure layer alone. The problem is in the agent’s core architecture. Cloudways is selling a safe room, but the patient is still bleeding internally.
Contrarian: Why Enterprises Might Pay Anyway Here is the counterintuitive truth: enterprises may not care about the undiscovered vulnerabilities as much as they care about compliance. The hyperscalers banned the agents because of liability, not because of technical risk. Cloudways is offering a legal and procedural shield: “We have verified the update, we have isolated the runtime, we have signed the MCP definition.” That paperwork, combined with a $79.99 monthly fee, may be enough to satisfy a procurement department. The real risk is not the 530 vulnerabilities; it is the unknown unknowns. The 600+ malicious skills Kaspersky found are skills that can be installed after deployment. Will Cloudways’ update verification catch a skill that was not in the original image? If the agent downloads a new skill at runtime, does the isolation environment flag it? These questions remain unanswered. The contrarian angle is that Cloudways is not selling security; it is selling a story. And stories, as I learned from interviewing 120 first-time investors who lost savings to rug pulls, are often more powerful than facts. The enterprises that adopt Cloudways will not be the ones that understand the risk; they will be the ones that need to check a box. “We have deployed OpenClaw in a secure, isolated environment with continuous verification.” That sentence, in a compliance report, is worth more than a thousand lines of audited code.
Takeaway: The Ledger Remembers, But the Heart Forgives The future of AI agent deployment will not be decided by the number of vulnerabilities, but by the strength of the trust narrative. Cloudways is building a bridge between the chaos of open-source innovation and the rigor of enterprise compliance. But bridges collapse when the foundation is unstable. The crypto industry learned this the hard way: you cannot outsource trust to a third party without verifiable transparency. Behind every hash, a heartbeat—but also behind every audit, a lie waiting to be discovered. Cloudways is betting that enterprises will pay for the illusion of safety, not the reality. I hope they are right. Because if they are wrong, the next Summer Yue incident will not just sink a hosting company; it will set back the entire movement toward decentralized, autonomous agents. Surviving the winter to plant the spring requires more than a warm room. It requires seeds that can grow in the cold. And those seeds are not yet in the soil.
