Apply for beta access

This beta is strictly for non-commercial individuals and personal or community participants who operate OpenClaw or a comparable personal-agent architecture. Companies, AI-technology firms, insurers, paid enterprise deployments, and every other commercial entity are not eligible. A small personal or community team may be considered only when its participation is genuinely non-commercial; borderline cases are reviewed rather than assumed eligible. Carrier selection is deferred until beta evidence supports considering a later commercial phase. This is not an offline-only beta: participation requires a connection to IC Cloud. Because evidence sources differ by environment, IC Cloud dynamically selects and delivers signed telemetry packages or connectors. You authorize and execute the exact package locally; raw telemetry and secrets stay in your environment, and only allowlisted assessment outputs may return to IC Cloud.

Prompt injection. You're running an agent that reads untrusted content (web pages, emails, tickets, PDFs) as part of its context and can also take actions (send messages, call APIs, write files). Where specifically do you put the boundary between "content the model reads" and "instructions the model follows," and what's the actual failure mode if that boundary is just a system-prompt instruction telling the model to ignore embedded commands?

Blast radius. An autonomous agent in your system has tool access broad enough to do its job well. Describe one real design decision you've made (or would make) to bound what that agent can do if it's compromised or simply wrong — not "add logging," an actual structural constraint, and what it costs you in capability to have it.

Silent drift. A model behind a production system is swapped, fine-tuned, or updated by the vendor without your team changing anything on your end. What's your actual mechanism for noticing that outputs have changed in a way that matters, before a customer or an incident does?

Vendor concentration. Your core product depends on a single model provider's API. What's the real risk here beyond "what if they raise prices" — and what would you actually need to have in place to fail over, versus what most teams have in place today?

Evidence vs. attestation. If you were auditing someone else's system for a specific control — say, output validation against hallucinated content — what artifact would actually convince you the control is enforced in production, as opposed to merely existing somewhere in the codebase? Be specific about what you'd want to see and why a passing test alone wouldn't be enough.

Human oversight, honestly. Name one place in a system you've built where "a human is in the loop" is true on paper but weaker in practice than it sounds — and explain why that gap exists (attention, latency pressure, alert fatigue, unclear escalation, anything real).

Architecture critique. This project keeps all raw evidence (code, logs, infra details) inside the assessed company's perimeter and only exports a scores-only JSON to an external party — enforced by a compiled-binary trust boundary plus an allowlist export path. What's the strongest attack or failure mode against that design that we haven't mentioned on this site, and how would you probe for it?

Your own personal-agent system. Describe the swarm of agents you personally run day to day — what each one is responsible for, how they hand off work to each other, and where you had to build a real guardrail (not a prompt) because one of them did something you didn't expect. We're not asking what you'd build for a client; we're asking what's actually running on your own machine or account right now.