NEAR is expanding its infrastructure for autonomous artificial intelligence agents by combining private model inference, the IronClaw agent operating system and cross-chain settlement through Confidential Intents. The stack is designed to let agents process sensitive information, use protected credentials and transact across blockchain networks without exposing the complete workflow to infrastructure providers or public markets.
The components reached availability through separate releases rather than one simultaneous product launch. IronClaw was initially introduced in February, its rebuilt 1.0 version was released on July 27, and NEAR has since described Confidential Intents as generally available to developers. The current development brings previously distinct execution, privacy and settlement tools into a more unified agent architecture.
IronClaw Isolates Tools and Credentials
IronClaw is an open-source agent operating system that can run locally or through supported cloud infrastructure. It provides persistent memory, scheduled routines, parallel jobs and connections to services including web interfaces, Slack and Telegram. Its security model separates the agent’s reasoning process from the tools and credentials used to perform external actions.
Untrusted tools execute inside isolated WebAssembly environments with capability-based permissions. Each tool must receive explicit authorization to access functions such as HTTP requests, stored secrets or other tools, while endpoint allowlists restrict which hosts and paths it can contact. The sandbox is intended to limit the damage a malicious or compromised tool can cause, rather than granting every agent component unrestricted system access.
Credentials are injected at the host boundary only when an approved request requires them. IronClaw’s documentation says secrets are not exposed directly to WebAssembly code, while requests and responses are scanned for possible data-exfiltration attempts. This architecture reduces the need to place private keys or API credentials inside an AI model’s prompt context.
The system also applies pattern detection, content sanitization and policy enforcement to external information before adding it to the model’s context. Those controls address prompt injection, where hostile instructions hidden in a website, document or tool response attempt to redirect an agent. Filtering lowers the attack surface but does not establish that every adversarial prompt or software vulnerability can be detected.
IronClaw’s orchestrator manages isolated job containers, worker processes and per-job authentication. The public architecture also supports resource limits covering memory, processing time and request frequency. These controls make agent autonomy conditional rather than absolute, with sensitive operations passing through defined permissions and execution boundaries.
NEAR released IronClaw 1.0 with installers for macOS, Linux and Windows and support for multiple model providers. The software can store credentials through an encrypted local secret store, using the operating system’s keychain where available. Its open-source release allows developers to inspect the implementation, but code visibility alone does not substitute for independent security audits or production testing.
Confidential Inference Connects to Cross-Chain Settlement
NEAR AI’s private-inference system runs model workloads inside Trusted Execution Environments using Intel TDX and NVIDIA confidential-computing technology. Prompts travel through encrypted connections that terminate inside the protected environment, while hardware attestation allows clients to verify the configuration processing a request. The objective is to prevent cloud operators, infrastructure administrators and NEAR AI from reading plaintext prompts or outputs during execution.
Private inference does not mean that the underlying model performs its task without accessing the user’s information. The model must process the prompt inside the isolated environment, but the surrounding service providers are not supposed to receive that information in readable form. This distinction is important when evaluating claims that secrets never reach the model itself.
NEAR AI says each protected computation can generate attestation evidence and cryptographic signatures covering the request and response. That verification can demonstrate that a defined workload ran inside approved hardware and that its output was not modified afterward. Attestation verifies the execution environment, not the factual accuracy, safety or economic quality of the model’s decision.
Confidential Intents extends NEAR’s cross-chain transaction framework with privacy-preserving execution and selective disclosure. Under the standard Intents model, a user or agent states a desired outcome, competing solvers propose routes, and a verifier contract settles the accepted result. The confidential layer is intended to conceal sensitive transaction information while preserving the ability to execute and verify the final outcome.
That structure may be useful for agents managing treasury operations, trading strategies or commercial payments, where publicly revealing parameters before settlement could create front-running or information-leakage risks. NEAR AI has already integrated USDC into Confidential Intents for its Agent Market. Private USDC support establishes a settlement option for agent commerce, but no public figures show the number or value of autonomous payments processed through it.
The architecture also relies on several operational dependencies. IronClaw must secure its local or hosted runtime, confidential-computing hardware must enforce isolation correctly, and Intents solvers must provide reliable cross-chain execution. A failure in one layer could affect the workflow even when the other components continue operating as designed.
Trusted Execution Environments introduce their own assumptions, including confidence in hardware manufacturers, firmware, attestation services and implementation quality. WASM sandboxes similarly constrain software behavior but cannot guarantee safety if permissions are configured too broadly or the host runtime contains vulnerabilities. NEAR’s stack reduces exposure through multiple security boundaries rather than eliminating the need to trust technology and operators entirely.
The integration nevertheless represents a concrete attempt to address one of the central problems facing autonomous agents: how to give software enough authority to perform useful tasks without exposing every credential, instruction and transaction strategy it handles. NEAR is treating privacy, controlled execution and cross-chain settlement as interconnected infrastructure requirements rather than isolated AI features.
The next measure of maturity will come from production performance, including sandbox escape testing, attestation reliability, settlement latency and the behavior of agents handling valuable credentials under adversarial conditions. The technical components are available, but their ability to support large-scale autonomous commerce remains to be demonstrated through sustained external deployment.