What happened
NVIDIA shipped NemoClaw v0.0.109 (Aug 14, 2026) with credential-free time-bounded launch-readiness leases, stale-evidence fencing, final-identity lifecycle binding, security-aware inference credential validation, and exact-identity managed-MCP mutation recovery for agent sandboxes running Hermes/OpenClaw agents.
Why it matters
Addresses stale-authority, confused-deputy, and cross-process ownership risks in agent sandbox lifecycle management — a concrete technical response to agentic runtime authorization failure modes flagged across recent CVE disclosures (e.g., UFO, Prompty).
Applicability
Teams running NVIDIA Nemo Agent Toolkit / NemoClaw-based agent sandboxes should upgrade after change review and validate authority rotation and recovery paths in non-production first.