Self-hosted computer-use agents (SHCUAs), such as OpenClaw, combine natural-language interaction with direct access to host-side resources, including browsers, files, scripts, system commands, and external communication channels. While useful for automating real tasks, this capability also creates a host-level abuse surface: a legitimately deployed agent may be steered toward unsafe operations through malicious messages, indirect prompt injection, unsafe skills, or tampering along the host-side control path. We argue that such risks cannot be addressed by ad hoc blocking rules alone, because the security criticality of an operation depends jointly on its action type, target object, execution context, and potential effect. This paper presents an operation-centric model for risk-based confinement of SHCUA operations. The proposed design keeps ordinary functionality on the constrained REE path, while protecting security-critical classification, authorization, binding, evidence generation, and selected execution-control decisions inside a cloud-native TEE-backed trusted operation plane. We instantiate the architecture on OpenClaw using Intel TDX as the primary trusted backend, with remote terminal-side trusted components verifying TDX-audited commands before constrained local execution. The evaluation shows that the design can block unsafe or policy-disallowed operations before execution, preserve ordinary functionality for allowed workloads, and provide auditable evidence with deployment-dependent overhead.

翻译：自主托管计算机使用代理（SHCUA），如OpenClaw，将自然语言交互与对主机端资源的直接访问相结合，包括浏览器、文件、脚本、系统命令和外部通信渠道。虽然此类代理在自动化真实任务方面具有实用性，但同时也引入了主机级滥用风险：通过恶意消息、间接提示注入、不安全的技能或沿着主机端控制路径的篡改，合法部署的代理可能被引导执行不安全操作。我们认为，此类风险无法仅通过临时阻断规则来解决，因为操作的安全关键性取决于其动作类型、目标对象、执行上下文和潜在影响的共同作用。本文提出了一种以操作为中心的风险约束模型，用于限制SHCUA操作。所提出的设计保持普通功能运行在受限的REE路径上，同时将安全关键的分类、授权、绑定、证据生成以及选定的执行控制决策保护在云原生TEE支持的可信操作平面内。我们以Intel TDX为主要可信后端的OpenClaw上实现了该架构，远程终端侧的可信组件在受限本地执行前对TDX审计的指令进行验证。评估表明，该设计能在执行前阻断不安全或不符合策略的操作，维持允许工作负载的常规功能，并提供可审计的证据，且部署相关开销可控。