11 ms·

I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)

52 points by ericpaulsen 7mo ago

ericpaulsen 7mo ago
OpenClaw proved demand for personal AI agents on your own hardware, but its default config listens on all network interfaces. Thousands of instances were found exposed. I spent a weekend building an alternative using Blink (OSS agent orchestration), Tailscale (WireGuard-based private networking), and a Mac Mini M4. Two isolated agents, no public exposure, built-in UI, ~10W idle power draw.
- charcircuit 7mo ago
  >but its default config listens on all network interfaces The default config listens on only localhost which is why it tells you to forward the port using ssh to your own machine to access it from a different machine.
- TZubiri 7mo ago
  Don't most ISP routers block ports unless you port forward them though? I wouldn't say that the vulnerability in that case was in OpenClaw, but with the router, nowadays it's expected that ports are blocked unless explicitly allowed in the router.
  - chasd00 7mo ago
    All home routers block all ports by default. How would they know which IP and port to forward traffic to if not for manual configuration? Also, "listening on all interfaces" doesn't matter on a home network, multi-homed devices don't make any sense in a home network unless you're purposely experimenting or playing with things like that yourself. Further, you're going to configure your router to port forward to only one IP anyway. Also, i think tailscale isn't doing much in these setups as well. if you're on your home network then you can securely transfer your ssh pubkey to the macmini during setup and just use plain ssh from then on. If you're extra parannoid don't forward 22 from the router and then your macmini is only accessible from your home network. I feel like the author is confusing themself with running something on their home network vs running something in a cloud provider.
    - TZubiri 7mo ago
      >All home routers block all ports by default. How would they know which IP and port to forward traffic to if not for manual configuration? I might have to recommend brushing up on your IP/TCP This is what routers do by default. IP is very different from IP. IP is what they use to know how to route, too long to fit in a post, but MAC to IPs form a local ARP table. Can be many nodes long. Ports are what identify a process in a machine, IP level routers don't care at all about the port (unless you are natting) in order to route, the port bytes are forwarded as is and only parsed by the destination (and constructed by the source)
sneak 7mo ago
OpenClaw is not insecure because it has ports open to the internet. This is an easily solved problem in one line of code (if indeed it even has that bug, which I don’t think it does). Furthermore you’re probably behind NAT. OpenClaw, as well as the author’s solution, is insecure because it sends the full content of all of your private documents and data to a remote inference API which is logging everything forever (and is legally obligated to provide it to DHS/ICE/FBI/et al without a warrant or probable cause). Better engineering of the agent framework will not solve this. Only better models and asstons of local VRAM will solve this. You still then have the “agent flipped out and emailed a hallucinated suicide note to all my coworkers and then formatted my drives” problem but that’s less of a real risk and one most people are willing to accept. Frontier models are pretty famously well-behaved these days 99.9% of the time and the utility provided is well worth the 0.1% risk to most people.
- Tepix 7mo ago
  It‘s not just that - but I complete agree on not using a Personal AI assistant with some cloud service LLM provider. Anyway, by interacting with the world, the LLM can be manipulated or even hacked by the data it encounters.
  - TZubiri 7mo ago
    Have you used OpenClaw? My experience has been that it doesn't take input from the world, unless you explicitly ask it to. But I guess that isn't too crazy, if you ask it to look at a website, maybe the website has a hidden prompt. I guess that's more of a responsibility of the LLM model in the security model. That said, I don't think the main dev is serious about security, I've listened to the whole Lex Friedman interview, and he talks about wanting to focus on security, but still dismissing security concerns whenever the arise as coming from 'haters', and there's no recognition of insecurity being possibly an inseparable tradeoff of the functional specifications of the product, I think he thinks of security as something you can slap on a product, which is a very basic misconception I see often in developers that get pwned and managers that think of security as a lever they can turn up or down through budget.
strongpigeon 7mo ago
For those interested, you can get the base config Mac Mini (in the US) for $400 from Micro Center [0]. They don’t seem to ship to where I live, but BestBuy was happy to price match in the support chat. Just received mine and planned on experimenting with something like OP this weekend. [0] https://www.microcenter.com/product/688173/apple-mac-mini-mu9d3ll-a-(late-2024)-desktop-computer https://www.microcenter.com/product/688173/apple-mac-mini-mu...
- bko 7mo ago
  I understand the need for a dedicated box, but any reason you shouldn't just use a server? What would someone recommend for cloud on something like Hetzner? https://www.hetzner.com/cloud/ https://www.hetzner.com/cloud/
  - embedding-shape 7mo ago
    In fact, seems much better you'd host something like that outside your own personal network. Given people are getting new hardware for it for "isolation", probably running it somewhere else completely would be better? I still don't understand why people don't just run it in a VM and separate VLAN instead.
    - deleted 7mo ago
      [deleted]
  - renewiltord 7mo ago
    For me it was access to Apple ecosystem of things. I used vps but it had to contact my http for reminders and iMessage etc. much nicer in Mac mini. It works better.
  - strongpigeon 7mo ago
    Like someone else said, I want to build something that has access to Apple stuff (reminders, iMessage), but also because I want to try to run some small LLM locally in front to route and do tool calling. The residential IP is also a plus.
blibble 7mo ago
"more secure AI agent" is like "most secure version of Windows yet"
suhputt 7mo ago
so, ignoring the the fact that you yourself didn't actually write this (based on commit history), and the fact that your claims about better security are dubious at best, the most interesting thing I find about this whole situation is - how did you get this to the hackernews front page so fast? that's the real (not-so) secret sauce here :)
- rob 7mo ago
  Not saying "ericpaulsen" is a bot, but the account fits the trend I've noticed of other bots on HN recently: they're all accounts created years ago with zero activity and then suddenly a bunch of comments. Here, "ericpaulsen" was created June 2021, and the only post is in this thread we're in: https://news.ycombinator.com/threads?id=ericpaulsen https://news.ycombinator.com/threads?id=ericpaulsen --- Others caught that fit this trend: https://news.ycombinator.com/item?id=46886875 https://news.ycombinator.com/item?id=46886875 (This bot made a follow-up: https://news.ycombinator.com/item?id=46901199 https://news.ycombinator.com/item?id=46901199) https://news.ycombinator.com/item?id=46886533 https://news.ycombinator.com/item?id=46886533 Another one 5 days ago that disappeared after being downvoted: https://news.ycombinator.com/threads?id=Zakodiac https://news.ycombinator.com/threads?id=Zakodiac
  - ericpaulsen 7mo ago
    long time lurker, first time poster.
  - suhputt 7mo ago
    yup this is a daily occurrence at this point
- embedding-shape 7mo ago
  > how did you get this to the hackernews front page so fast? Fast? Posted one hour ago. Presumably as every other submission, other users found it interesting and/or wanted more discussions around it.
  - 7mo ago
sn0n 7mo ago
Yay more AI slop content… it’s comforting how they all read the same, no matter the topic.
croes 7mo ago
Strange that security still isn’t a first class feature when something new is developed. I'm slowly beginning to doubt that people can learn from the mistakes of others. Why do we keep making the same mistakes over and over again?
- skrebbel 7mo ago
  Fwiw the sensibilities of the --yolo AI-maximizing "I vibe coded a Hospital Information System this afternoon" crowd isn't really representative for the greater dev community I think
  - croes 7mo ago
    I'm thinking more about developers of tools like OpenClaw or MCP.
- deleted 7mo ago
  [deleted]
mentalgear 7mo ago
I also started on a similar quest to build an ai agent using LLMs ... and quickly had to throw about 80% of the code away because it was just unreadable and unsecure, based on flawed assumptions the LLM made in its blackbox. So I definitely won't trust something someone vibe-coded run on my computer.
makeitcount00 7mo ago
This article fails to mention the bigger security issue with openclaw/anything else like this is prompt injection, not exposed network ports. Isolating it from incoming requests is better than not, but does nothing to prevent data exfiltration via outgoing requests after being prompted to do so by a malicious email or webpage that it is reading as part of a task you've given it.
franze 7mo ago
i'm running claude code on a server in yolo mode - ssh via tailscale yeah, openclaw is tue more user friendly product (whatsapp bridge, chat interface) bit otherwise at the core they are the same. i did run moltbook for half a week - it crunched through my claude code pro token allowance in that time. needed to put claw to sleep again after that. needed some work to do.
stavros 7mo ago
There's a big security issue with OpenClaw, and it won't be fixed with network/filesystem sandvoxes. I've been thinking about what a very secure LLM agent would look like, and I've made a proof of concept where each tool is sandboxed in its own container, the LLM can call but not edit the code, the LLM doesn't have access to secrets, etc. You can't solve prompt injection now, for things like "delete all your emails", but you can minimize the damage by making the agent physically unable to perform unsanctioned actions. I still want the agent to be able to largely upgrade itself, but this should be behind unskippable confirmation prompts. Does anyone know anything like this, so I don't have to build it?
- sathish316 7mo ago
  I’ve come across dcg - destructive command guard - that claims to have a fast rust based runtime, with prehooks to audit any tool or command executed by an agent and to block them if they fall in some dangerous patterns - https://github.com/Dicklesworthstone/destructive_command_guard https://github.com/Dicklesworthstone/destructive_command_gua... Disclaimer - I have not personally used this, but it theoretically seems possible to prevent some scenarios of prompt injection attacks, if not all.
monideas 7mo ago
See also: https://github.com/qwibitai/nanoclaw https://github.com/qwibitai/nanoclaw I run this instead of openclaw, mostly because Claude Code itself is sufficient as a harness.
paxys 7mo ago
At this point this whole thing has to be a stealth marketing campaign by Apple right? Hordes of people buying new $600 Macs to jump in on the trend when a $3 VPS or $15 Pi Zero or $50 NUC or really any computer that can run a basic Linux server would do the job exactly the same or better.
- embedding-shape 7mo ago
  > Hordes of people buying new $600 Macs How big is this "hoard" of people buying things like that? I think maybe there is a very loud minority who blogs and talks about it, but how many people actually go out and spend $600 on whim for an experiment?
jaredcwhite 7mo ago
More secure…according to whom? Validated how? With what??
sathish316 7mo ago
There are several security flaws in OpenClaw: 1. Prompt injection - this is unsolvable until LLMs can differentiate command and text 2. The bot can leak secrets. The less secrets, API keys, passwords you provide the more useless it is 3. The VM on which it runs can get compromised resulting in leaking private conversations or confidential data like keys. This can be fixed with private VPNs and a security hardened VM or a MacMini like disconnected device. I’ve found an interesting solution to problems #2 and #3 using a Secure vault, but none so far for Prompt injection. It follows the principle of least privilege, giving secure key access to only the shell scripts that are executed by a skill, along with granting access to the vault for smaller intervals like 15 mins and revoking the access automatically with TTL or time-scoped vault tokens. More details here - https://x.com/sathish316/status/2019496552419717390?s=46 https://x.com/sathish316/status/2019496552419717390?s=46
koozz 7mo ago
> My Gmail inbox has 3,200 unread emails. I miss appointments because calendar invites get buried. Rules and discipline is what you need :)

52 points by ericpaulsen 7mo ago

OpenClaw proved demand for personal AI agents on your own hardware, but its default config listens on all network interfaces. Thousands of instances were found exposed. I spent a weekend building an alternative using Blink (OSS agent orchestration), Tailscale (WireGuard-based private networking), and a Mac Mini M4. Two isolated agents, no public exposure, built-in UI, ~10W idle power draw.

charcircuit 7mo ago
>but its default config listens on all network interfaces The default config listens on only localhost which is why it tells you to forward the port using ssh to your own machine to access it from a different machine.
TZubiri 7mo ago
Don't most ISP routers block ports unless you port forward them though? I wouldn't say that the vulnerability in that case was in OpenClaw, but with the router, nowadays it's expected that ports are blocked unless explicitly allowed in the router.
- chasd00 7mo ago
  All home routers block all ports by default. How would they know which IP and port to forward traffic to if not for manual configuration? Also, "listening on all interfaces" doesn't matter on a home network, multi-homed devices don't make any sense in a home network unless you're purposely experimenting or playing with things like that yourself. Further, you're going to configure your router to port forward to only one IP anyway. Also, i think tailscale isn't doing much in these setups as well. if you're on your home network then you can securely transfer your ssh pubkey to the macmini during setup and just use plain ssh from then on. If you're extra parannoid don't forward 22 from the router and then your macmini is only accessible from your home network. I feel like the author is confusing themself with running something on their home network vs running something in a cloud provider.
  - TZubiri 7mo ago
    >All home routers block all ports by default. How would they know which IP and port to forward traffic to if not for manual configuration? I might have to recommend brushing up on your IP/TCP This is what routers do by default. IP is very different from IP. IP is what they use to know how to route, too long to fit in a post, but MAC to IPs form a local ARP table. Can be many nodes long. Ports are what identify a process in a machine, IP level routers don't care at all about the port (unless you are natting) in order to route, the port bytes are forwarded as is and only parsed by the destination (and constructed by the source)

sneak 7mo ago

OpenClaw is not insecure because it has ports open to the internet. This is an easily solved problem in one line of code (if indeed it even has that bug, which I don’t think it does). Furthermore you’re probably behind NAT. OpenClaw, as well as the author’s solution, is insecure because it sends the full content of all of your private documents and data to a remote inference API which is logging everything forever (and is legally obligated to provide it to DHS/ICE/FBI/et al without a warrant or probable cause). Better engineering of the agent framework will not solve this. Only better models and asstons of local VRAM will solve this. You still then have the “agent flipped out and emailed a hallucinated suicide note to all my coworkers and then formatted my drives” problem but that’s less of a real risk and one most people are willing to accept. Frontier models are pretty famously well-behaved these days 99.9% of the time and the utility provided is well worth the 0.1% risk to most people.

Tepix 7mo ago
It‘s not just that - but I complete agree on not using a Personal AI assistant with some cloud service LLM provider. Anyway, by interacting with the world, the LLM can be manipulated or even hacked by the data it encounters.
- TZubiri 7mo ago
  Have you used OpenClaw? My experience has been that it doesn't take input from the world, unless you explicitly ask it to. But I guess that isn't too crazy, if you ask it to look at a website, maybe the website has a hidden prompt. I guess that's more of a responsibility of the LLM model in the security model. That said, I don't think the main dev is serious about security, I've listened to the whole Lex Friedman interview, and he talks about wanting to focus on security, but still dismissing security concerns whenever the arise as coming from 'haters', and there's no recognition of insecurity being possibly an inseparable tradeoff of the functional specifications of the product, I think he thinks of security as something you can slap on a product, which is a very basic misconception I see often in developers that get pwned and managers that think of security as a lever they can turn up or down through budget.

strongpigeon 7mo ago

For those interested, you can get the base config Mac Mini (in the US) for $400 from Micro Center [0]. They don’t seem to ship to where I live, but BestBuy was happy to price match in the support chat. Just received mine and planned on experimenting with something like OP this weekend. [0] https://www.microcenter.com/product/688173/apple-mac-mini-mu9d3ll-a-(late-2024)-desktop-computer https://www.microcenter.com/product/688173/apple-mac-mini-mu...

bko 7mo ago
I understand the need for a dedicated box, but any reason you shouldn't just use a server? What would someone recommend for cloud on something like Hetzner? https://www.hetzner.com/cloud/ https://www.hetzner.com/cloud/
- embedding-shape 7mo ago
  In fact, seems much better you'd host something like that outside your own personal network. Given people are getting new hardware for it for "isolation", probably running it somewhere else completely would be better? I still don't understand why people don't just run it in a VM and separate VLAN instead.
  - deleted 7mo ago
    [deleted]
- renewiltord 7mo ago
  For me it was access to Apple ecosystem of things. I used vps but it had to contact my http for reminders and iMessage etc. much nicer in Mac mini. It works better.
- strongpigeon 7mo ago
  Like someone else said, I want to build something that has access to Apple stuff (reminders, iMessage), but also because I want to try to run some small LLM locally in front to route and do tool calling. The residential IP is also a plus.

blibble 7mo ago

"more secure AI agent" is like "most secure version of Windows yet"

suhputt 7mo ago

so, ignoring the the fact that you yourself didn't actually write this (based on commit history), and the fact that your claims about better security are dubious at best, the most interesting thing I find about this whole situation is - how did you get this to the hackernews front page so fast? that's the real (not-so) secret sauce here :)

rob 7mo ago
Not saying "ericpaulsen" is a bot, but the account fits the trend I've noticed of other bots on HN recently: they're all accounts created years ago with zero activity and then suddenly a bunch of comments. Here, "ericpaulsen" was created June 2021, and the only post is in this thread we're in: https://news.ycombinator.com/threads?id=ericpaulsen https://news.ycombinator.com/threads?id=ericpaulsen --- Others caught that fit this trend: https://news.ycombinator.com/item?id=46886875 https://news.ycombinator.com/item?id=46886875 (This bot made a follow-up: https://news.ycombinator.com/item?id=46901199 https://news.ycombinator.com/item?id=46901199) https://news.ycombinator.com/item?id=46886533 https://news.ycombinator.com/item?id=46886533 Another one 5 days ago that disappeared after being downvoted: https://news.ycombinator.com/threads?id=Zakodiac https://news.ycombinator.com/threads?id=Zakodiac
- ericpaulsen 7mo ago
  long time lurker, first time poster.
- suhputt 7mo ago
  yup this is a daily occurrence at this point
embedding-shape 7mo ago
> how did you get this to the hackernews front page so fast? Fast? Posted one hour ago. Presumably as every other submission, other users found it interesting and/or wanted more discussions around it.
- 7mo ago

sn0n 7mo ago

Yay more AI slop content… it’s comforting how they all read the same, no matter the topic.

croes 7mo ago

Strange that security still isn’t a first class feature when something new is developed. I'm slowly beginning to doubt that people can learn from the mistakes of others. Why do we keep making the same mistakes over and over again?

skrebbel 7mo ago
Fwiw the sensibilities of the --yolo AI-maximizing "I vibe coded a Hospital Information System this afternoon" crowd isn't really representative for the greater dev community I think
- croes 7mo ago
  I'm thinking more about developers of tools like OpenClaw or MCP.
deleted 7mo ago
[deleted]

mentalgear 7mo ago

I also started on a similar quest to build an ai agent using LLMs ... and quickly had to throw about 80% of the code away because it was just unreadable and unsecure, based on flawed assumptions the LLM made in its blackbox. So I definitely won't trust something someone vibe-coded run on my computer.

makeitcount00 7mo ago

This article fails to mention the bigger security issue with openclaw/anything else like this is prompt injection, not exposed network ports. Isolating it from incoming requests is better than not, but does nothing to prevent data exfiltration via outgoing requests after being prompted to do so by a malicious email or webpage that it is reading as part of a task you've given it.

franze 7mo ago

i'm running claude code on a server in yolo mode - ssh via tailscale yeah, openclaw is tue more user friendly product (whatsapp bridge, chat interface) bit otherwise at the core they are the same. i did run moltbook for half a week - it crunched through my claude code pro token allowance in that time. needed to put claw to sleep again after that. needed some work to do.

stavros 7mo ago

There's a big security issue with OpenClaw, and it won't be fixed with network/filesystem sandvoxes. I've been thinking about what a very secure LLM agent would look like, and I've made a proof of concept where each tool is sandboxed in its own container, the LLM can call but not edit the code, the LLM doesn't have access to secrets, etc. You can't solve prompt injection now, for things like "delete all your emails", but you can minimize the damage by making the agent physically unable to perform unsanctioned actions. I still want the agent to be able to largely upgrade itself, but this should be behind unskippable confirmation prompts. Does anyone know anything like this, so I don't have to build it?

sathish316 7mo ago
I’ve come across dcg - destructive command guard - that claims to have a fast rust based runtime, with prehooks to audit any tool or command executed by an agent and to block them if they fall in some dangerous patterns - https://github.com/Dicklesworthstone/destructive_command_guard https://github.com/Dicklesworthstone/destructive_command_gua... Disclaimer - I have not personally used this, but it theoretically seems possible to prevent some scenarios of prompt injection attacks, if not all.

monideas 7mo ago

See also: https://github.com/qwibitai/nanoclaw https://github.com/qwibitai/nanoclaw I run this instead of openclaw, mostly because Claude Code itself is sufficient as a harness.

paxys 7mo ago

At this point this whole thing has to be a stealth marketing campaign by Apple right? Hordes of people buying new $600 Macs to jump in on the trend when a $3 VPS or $15 Pi Zero or $50 NUC or really any computer that can run a basic Linux server would do the job exactly the same or better.

embedding-shape 7mo ago
> Hordes of people buying new $600 Macs How big is this "hoard" of people buying things like that? I think maybe there is a very loud minority who blogs and talks about it, but how many people actually go out and spend $600 on whim for an experiment?

jaredcwhite 7mo ago

More secure…according to whom? Validated how? With what??

sathish316 7mo ago

There are several security flaws in OpenClaw: 1. Prompt injection - this is unsolvable until LLMs can differentiate command and text 2. The bot can leak secrets. The less secrets, API keys, passwords you provide the more useless it is 3. The VM on which it runs can get compromised resulting in leaking private conversations or confidential data like keys. This can be fixed with private VPNs and a security hardened VM or a MacMini like disconnected device. I’ve found an interesting solution to problems #2 and #3 using a Secure vault, but none so far for Prompt injection. It follows the principle of least privilege, giving secure key access to only the shell scripts that are executed by a skill, along with granting access to the vault for smaller intervals like 15 mins and revoking the access automatically with TTL or time-scoped vault tokens. More details here - https://x.com/sathish316/status/2019496552419717390?s=46 https://x.com/sathish316/status/2019496552419717390?s=46

koozz 7mo ago

> My Gmail inbox has 3,200 unread emails. I miss appointments because calendar invites get buried. Rules and discipline is what you need :)