Explanation of the VirusTotal Sandbox Behavior Report for LongClaw

We noticed that LongClaw is not flagged as malicious by security vendors in VirusTotal's static engine detection. However, the sandbox behavior page may still show several MITRE behavior tags, such as registry queries, system information discovery, process discovery, and network communication.

To avoid misunderstanding, we would like to explain these behaviors transparently.

The detailed sandbox report can be viewed in the VirusTotal scan report linked for each version on the download page: https://longclaw.cc/download. We do not hide the original report source, so users can verify the detection results and sandbox behavior records directly.

WebView2 / Edge Runtime Behavior

LongClaw is a local desktop agent application. Its user interface is rendered through Microsoft Edge WebView2.

When the application starts, Windows and the WebView2 / Edge runtime perform several normal initialization actions, including:

• Querying COM / CLSID registry entries;
• Starting msedgewebview2.exe child processes;
• Initializing GPU, network, storage, and Crashpad services;
• Creating WebView2 user data, cache, and BrowserMetrics files;
• Performing certificate, update, or runtime checks related to Edge WebView2.

These behaviors are normal WebView2 / Edge runtime activities. They are not risky operations actively performed by LongClaw's business logic.

Registry Access Performed by LongClaw

LongClaw itself does perform a small number of registry accesses, but they are limited and clearly scoped:

• Read-only access to CPU model and Windows version for the system overview page;
• Read-only access to Windows MachineGuid for local security identification;
• Writing the per-user longclaw:// protocol handler so system notifications can return the user to LongClaw when clicked.

These actions do not involve browser cookies, passwords, SSH private keys, security software settings, firewall policies, startup persistence, privilege escalation, disabling security software, or destructive system operations.

Local Service and Network Communication

The 127.0.0.1:18080 address shown in the sandbox report is LongClaw's local Web UI service. By default, it only listens on the local loopback interface and is not exposed to the public internet.

Certificate revocation checks, Edge-related domains, and WebView2 child processes shown in the report mainly come from the Windows / Edge WebView2 runtime environment.

Our Principles

LongClaw will continue to follow a transparent, restrained, and security-first development approach:

• Run locally by default;
• Require user authorization for sensitive actions;
• Require secondary confirmation for high-risk actions;
• Clearly explain what LongClaw does locally and why.

User trust matters more than any feature. We will keep doing our part on safety and transparency, and leave the final choice to users.