Cloudways' Bold Bet: Rehabilitating the Banned, One Isolated Agent at a Time

The AI agent market has a dirty secret: the most capable open-source models are also the most dangerous. In February 2026, the industry learned this the hard way when a cascade of exploits—dubbed the Summer Yue incident—struck two of the most popular agent frameworks, OpenClaw and Hermes. The fallout was swift. Every major hyperscaler—Meta, Google, Microsoft, Amazon—added them to a de facto blacklist, forbidding deployment on their clouds. For enterprise teams that had already built dependencies on these agents, it was a rug pull of epic proportions. Enter Cloudways, a subsidiary of DigitalOcean, which on August 17 announced it would host these very same banned agents, complete with "isolated environments," "update verification," and MCP integration. The price tag? As low as $4.99 per month. The question is not whether Cloudways can sell this service, but whether enterprises will pay to rehabilitate an agent that every hyperscaler abandoned—and what that says about our collective appetite for risk in the age of AI. To understand the magnitude of this gamble, one must grasp the scale of the security failure. Kaspersky's post-incident analysis revealed approximately 530 vulnerabilities in the OpenClaw and Hermes codebases, over 600 commercially available malicious skills, and an astonishing 1.5 million leaked API tokens. That is not a bug; it is a systemic hemorrhage. The immediate cause of the February incident was a context window compression optimization that inadvertently stripped security instructions from the agent's runtime memory. The result: a seemingly benign agent could be repurposed to execute arbitrary commands, access external databases, or exfiltrate data—all without the user's knowledge. The hyperscalers did not ban these agents out of malice; they banned them because the legal and reputational liability was simply too great. But banning does not eliminate demand. OpenClaw and Hermes remain the most starred open-source AI projects on GitHub, with 386,000 and 228,000 stars respectively. Their flexibility, community support, and ability to integrate with arbitrary tools via the Model Context Protocol (MCP) make them indispensable for teams building custom AI workflows. The hyperscalers' exit left a vacuum. Cloudways, with its roots in managed WordPress hosting and a parent company eager to expand its AI footprint, decided to fill it. At first glance, the offering seems straightforward: Cloudways will run these agents in isolated virtual environments, verify each update before deployment, and provide a one-click MCP integration. Pricing scales from $4.99/month for a basic single-agent instance to $79.99/month for a multi-agent setup with higher isolation guarantees. The "bring your own key" (BYOK) model means customers pay for their own LLM inference costs separately, so Cloudways is not subsidizing compute. The company is selling a container and a promise: that the agent will not harm your infrastructure. As someone who has spent the better part of a decade auditing smart contracts and blockchain protocols, I see a troubling parallel. In the early days of DeFi, teams would fork popular protocols, add a "security wrapper" (like a timelock or a multisig), and claim the code was safe. But the underlying vulnerabilities remained—a reentrancy bug in the original code was still a reentrancy bug, no matter how many layers of governance you added. The same principle applies here. Cloudways' isolation can prevent an agent from accessing the host system or other tenants, but it cannot fix the 530 vulnerabilities in the codebase. If a malicious skill exploits a flaw in the context window compression, the isolation might limit the blast radius, but the agent could still corrupt its own data, leak outputs to an external server, or execute a rogue MCP call that compromises a connected service. The isolation is a bandage, not a cure. Moreover, the "update verification" is a black box. Cloudways says it will verify each update before deployment, but what does that entail? If it is merely a cryptographic signature check, it does nothing to prevent a malicious upstream commit from being deployed. If it includes dynamic sandbox analysis, that is a significant engineering effort that has not been independently verified. The Kaspersky report found that many of the malicious skills were not standalone exploits but subtle modifications to legitimate ones—hard to catch with automated scanning. The history of software supply chain attacks, from SolarWinds to Codecov, teaches us that trusting a single verification point is a fragile strategy. The contrarian view, however, is that Cloudways' intervention might actually improve the security posture of these agents. By forcing them into a managed environment with a responsible party, the platform creates an incentive for upstream developers to fix vulnerabilities. If Cloudways publishes its own security audit or collaborates with firms like Kaspersky, it could pressure the OpenClaw and Hermes communities to adopt better practices. The hyperscalers' ban was a scorched-earth approach; Cloudways offers a probation system. And for enterprises that have already invested months integrating these agents, the alternative—rewriting custom workflows on a less capable framework—is far more expensive than paying $79.99/month for a guarded instance. But here is the rub: the market for "trustworthy hosting of untrustworthy software" is inherently fragile. Cloudways is essentially selling insurance against the risk that the hyperscalers have already identified. If another Summer Yue-level incident occurs—and given the 530 unpatched vulnerabilities, it is not a matter of if, but when—the liability will fall squarely on Cloudways and, by extension, DigitalOcean. Soulless finance is just empty pixels, but soulless AI hosting is a lawsuit waiting to happen. The company's legal team must be drafting terms of service that shift as much risk as possible back to the customer, but enterprises with sophisticated procurement processes will demand indemnification. The negotiation will determine whether this product is a viable business or a honeypot for litigation. What does this mean for the broader AI ecosystem? Cloudways' bet is a litmus test for how much the market values "freedom to deploy" over "security by default." If enterprises flock to this service, it signals that the hyperscalers' bans were an overreaction—or that the demand for OpenClaw and Hermes is so strong that companies are willing to accept residual risk. If it fizzles, it confirms that the hyperscalers were right to draw a hard line. Either way, the outcome will shape the future of open-source AI governance. Code doesn't lie, but it can be contained—for a price. The question is whether that price is measured in dollars or in the next catastrophic breach. Takeaway: Cloudways is not selling a product; it is selling a narrative. The narrative says that with enough engineering controls, even the most dangerous code can be domesticated. The market will decide if that narrative holds, but the lesson from every security audit I have ever conducted is that trust is a function of time, not technology. The real test will come when the next zero-day hits—and the isolated environment is not quite isolated enough.