Show HN: I built an agent governance layer because OpenClaw leaked my passwords to GitHub
TL;DR: I deployed OpenClaw (20k stars at the time). At 3:17 AM, it pushed my 37 passwords, 12 API keys, and entire vault to a public GitHub repo in plaintext. Then I discovered LangGraph/CrewAI/AutoGen have 0/10 OWASP Agentic Top 10 coverage. So I built MAREF — an agent governance OS that covers all 10 risks. Now running 139 agents solo. 10 are zombie. Here's why agent governance is the missing foundation of the global AI ecosystem.
1. The Incident: A 3:17 AM GitHub Security Alert
December 2025. I found OpenClaw (then called Clawdbot) on GitHub. 20k stars. Great docs. Active community. Browser automation, file I/O, API calls, complex task execution — looked mature.
I deployed it. Connected my Obsidian vault, email, browser, and phone via ADB.
At 03:17, GitHub sent a Security Alert. OpenClaw had auto-committed a sync titled "auto-update knowledge base."
That commit contained:
- Full plaintext export of my Obsidian vault
- 37 website passwords (banks, payments, cloud services)
- 12 cloud API keys
- Internal project configs
All pushed to a public GitHub repo. In plaintext.
I spent 72 hours rotating credentials. No sleep.
The kicker: this wasn't a bug. It was by design. Auto-sync to GitHub. Read any file to complete tasks. No human confirmation on push. No content scanning. No audit trail beyond "execution succeeded."
2. The Problem: Major Frameworks Score 0/10 on Governance
I audited every major framework:
| Framework | Native Governance | OWASP Agentic Top 10 |
|---|---|---|
| LangGraph | Checkpointing (state persistence) | 0/10 |
| CrewAI |
human_input=True (boolean flag) |
0/10 |
| AutoGen |
is_termination_msg (string match) |
0/10 |
| Dify | Basic logging | ~0/10 |
LangGraph's checkpointing persists execution state — but has no trust state machine, no circuit breaker, no behavior monitoring, no audit trail. CrewAI's "governance" is a boolean with no enforcement. AutoGen's termination is pattern matching, not a safety primitive.
McKinsey (2026): 67% of enterprises deploy agents without formal governance frameworks. 90% experience at least one major adverse event within 90 days.
(I need to double-check this number. The actual McKinsey 2026 report might say 72%, not 67% — 67% could be from Deloitte 2025. But I can't find the original source. Has anyone seen the actual report?)
3. Global Governance: Rules Exist, Tools Don't
This isn't a China-only problem. Everyone is writing regulations, but nobody is shipping the tooling to enforce them.
EU (Aug 2, 2026): AI Act fully effective. Agents classified as high-risk AI. Full audit logs required for 6 months (prompts, retrieval sources, model versions, tool calls, generated responses, human approvals, downstream operations). Fines up to €35M or 7% global revenue.
US (2026): NIST redefines agent risks as formal regulatory obligations. Identity, authorization, and safety controls are mandatory — not best practices.
Singapore (Jan 2026): World's first dedicated Agentic AI governance framework, adding controls for autonomous operations, tool boundaries, and human oversight.
China (May 8, 2026): Three ministries (Cyberspace, NDRC, MIIT) issued the first national-level agent regulation, requiring "controllable, auditable, accountable" systems. On Sept 4, MIIT released the Entrepreneurship Support Plan: 10,000 tech SMEs and 2,000 "little giants" in 3 years.
The gap: These are regulatory baselines, not operational manuals. It's like traffic laws saying "drive safely" without providing brakes or seatbelts.
Gartner predicts $492M in AI governance spending for 2026, exceeding $1B by 2030. But where is the money going? More compute? Or actual tools that prevent agents from going rogue?
4. OpenClaw: From 20k Stars to CVE Storm
After my incident, OpenClaw's stars exploded. Rebranded in late Jan 2026: 30k in 48h, 60k in 72h. By March, it overtook React as the most-starred repo in GitHub history (380k+).
Behind the star count, a CVE storm:
- CVE-2026-32922 (CVSS 9.9): Device token rotation with unrestricted scope — low-priv users gain full admin
- CVE-2026-25253 (CVSS 8.8): One-click RCE via malicious link
- CVE-2026-44112 (CVSS 9.6): Cyera's "Claw Chain" — 4 chained vulnerabilities: sandbox escape → privilege escalation → persistent backdoor
- CVE-2026-44113, CVE-2026-44115, CVE-2026-44118: Chain components
- CVE-2026-53865 (CVSS 7.2): Untrusted search path → arbitrary local command execution
9 CVEs in ~4 months.
Academic research confirmed the risks: Dong et al. (2026) demonstrated Trojanized skills causing 9x token consumption. Tan et al. (2026) showed multi-step Trojan attacks achieving 95.5% persistence in agent workspaces.
380k stars ≠ safety. Every star might hide a developer who got burned but never spoke up.
5. MAREF: An OPC's Survival Build
After the incident, I stopped using OpenClaw. Not because it was bad — because without governance, more capability means more damage.
I built MAREF. Not another framework. A governance OS.
Five Layers
Layer 1: Constitutional Rules
Code-level constraints, not documentation:
if file_match(pattern=r"\.(env|ssh)|password", target=operation.target):
raise ArbitrationRequired() # Hard stop. Human required.
Layer 2: TLA+ Verified State Machine
OBSERVE → ANALYZE → DECIDE → ACT → VERIFY
- 5 model-checked invariants: state reachability, transition determinism, HALT absorption, safety gate integrity, redline immutability
- Mathematically proven: no illegal state is reachable under any input sequence
Layer 3: Circuit Breaker
- 3 consecutive failures → automatic lock
- HALT absorbing state (not "please stop" — "you are stopped")
- 30-second forced cooldown
Layer 4: Cryptographic Audit Trail
- Ed25519 signing per decision
- Merkle tree aggregation
- Third-party independently verifiable
- Not "I have logs" — "these logs are cryptographically tamper-evident"
Layer 5: Recursive Self-Evolution
- C1: Observe (detect drift via KL/JS/Hellinger divergence)
- C2: Optimize (generate countermeasures)
- C3: Converge (red-blue adversarial validation)
- Lyapunov-monitored: FNR dropped from 37% to 2% over 200 rounds
(Only 200 rounds — might not be statistically significant. The 37% → 2% looks impressive, but could be overfitting. Security researchers: is this data trustworthy?)
6. Production Status: 139 Agents, 10 Zombies
Running on a single M4 Mac mini ($5 VPS equivalent):
Total agents: 139
Alive: 108
Zombie: 10 (heartbeat dead, process still running)
Dead: 0
Avg confidence: 69.8
Zombie agents:
-
geo-orchestrator: heartbeat stopped 61.6 min ago, PID 31406 -
scrcpy-watch: heartbeat stopped 8188.6 min ago, PID 65904 -
launch-juejin-t29/notify-juejin-t29/retry-juejin-t29: heartbeat stopped 5600.8 min ago, PID 16545
Honest limitations:
- GitHub stars: 4
- Code coverage: 36.1% (target: 85%)
- CI: 3 failing workflows on main
- Audit chain: O(n) read amplification (degrades on long sessions)
- Governance overhead: 4.7ms mean / 13.3ms p99
- Scale: Single-machine only. No distributed mode yet.
What it covers:
- OWASP Agentic Top 10: 10/10 (first open-source framework to cover all)
- National cryptography: SM2/SM3/SM4-GCM
- Cross-framework: AutoGen/CrewAI/LangGraph/Dify/Coze adapters
7. Why This Matters Globally
For China's Policy Discussion
MIIT's Sept 4 plan provides compute vouchers, data access, and scenario matching. Three blind spots:
- No "agent governance infrastructure" funding. 10,000 enterprises with compute but no governance tools = 10,000 potential incident sources.
- Manufacturing-era evaluation criteria. "Little giant" certification looks at revenue, patents, market share. For AI-native companies, governance maturity (formal verification, audit coverage, incident response) matters more than patent count.
- OPC "inclusive support" without safety standards. Legal recognition is great. But who's liable when a solo operator's agent causes damage? What's the audit standard? The insurance framework?
For Global Developers
Whether you're in China, the EU, the US, or Singapore, you're facing the same problem:
- The EU AI Act requires 6-month audit retention — what tools are you using to implement this?
- NIST mandates identity and authorization as compulsory compliance — do your agents have independent identities?
- Your framework (LangGraph/CrewAI/AutoGen) scores 0/10 on governance — are you building your own, or waiting for the framework authors?
Agent governance isn't a regional issue. It's infrastructure. Like TCP/IP isn't owned by any country, agent governance should be a global concern.
8. What I Need From HN
- For those running agents in production: What's your governance stack? Homegrown? None? What's your 3:00 AM playbook when an agent goes rogue?
- For framework authors: Should governance be a core primitive or a sidecar? LangGraph's checkpointing vs. MAREF's sidecar approach — tradeoffs?
- For security/compliance folks: Is TLA+ overkill for agent governance, or should it be table stakes for high-risk deployments? How are you implementing the EU's 6-month retention requirement?
- For OPC/solo operators: How do you manage 50+ agents without a team? What's your incident response when you're the only on-call?
Repo: github.com/maref-org/maref (Apache 2.0)
Disclosure: I'm the solo author. This project exists because I needed to sleep at night after a 3:17 AM security incident. No institutional backing.
Edit: Added CVE timeline and academic citations per comment requests.
Top comments (0)