7 ms·

Sandboxes won't save you from OpenClaw

112 points by logicx24 7mo ago

hackingonempty 7mo ago
Yes we need capability based auth on the systems we use. I'm sure we will get them but only for use with in-house agents, i.e. GMail and Google Pay will get agentic capabilities but they'll only work with Gemini, and only Siri will be able to access your Apple cloud stuff without handing over access to everything, and if you want your grocery shopping handled for you, Rufus is there. Maybe you will be able to link Copilot to Gemini for an extra $2.99 a month.
- 2gremlin181 7mo ago
  I do not forsee GoogleClaw, MetaClaw, and AppleClaw all playing well with each other. Everyone will have their own walled garden and we will be no better off than we are now.
edf13 7mo ago
Agree, that’s why we’re building grith.ai Sandboxing alone isn’t the right approach… a multi-faceted approach is what works. What we’ve found that does work is automation on the approval process but only with very strong guards in place… approval fatigue is another growing problem - users simply clicking approve on all requests.
- dmos62 7mo ago
  Interesting. How are the security filters implemented?
  - edf13 7mo ago
    Every system call, file access, net access etc is forced through a local “proxy” where 17 individual filters check what’s going on. Everything is done locally via our grith cli tool. Happy to answer any questions on hello@grith.ai too
- imiric 7mo ago
  Was grift.ai too expensive?
  - edf13 7mo ago
    https://grith.ai/blog/what-grith-means https://grith.ai/blog/what-grith-means
gz09 7mo ago
Security models from SaaS companies based on having a bunch of random bytes/numbers with coarse-grained permissions, and valid for a very long time are already a bad idea. With agents, secrets/tokens really need to be minted with time-limited, scope-limited, OpenID/smart-contract based trust relationships so they will fare much better in this new world. Unfortunately, this is a struggle still for most major vendors (e.g., Github gh CLI still doesn't let you use Github Apps out-of-the box)
stronglikedan 7mo ago
TL;DR: sandboxes can't save you from anything if the sandbox contains your secrets and has access to the outside world. a tale as old as time and nothing new to agents specifically
dinkleberg 7mo ago
Call me overly cautious, but as someone using OpenClaw I never for a moment considered hooking it up to real external services as me. Instead I put it on one server and created a second server with shared services like Gitea and other self-hosted tools that are only accessible over a tailnet and openclaw is able to use those services. When I needed it to use a real external service I have created a limited separate account for it. But not a chance in the world am I going to just let it have full access to my own accounts on everything.
- skywhopper 7mo ago
  That is literally the only remotely safe approach.
- simonw 7mo ago
  That's not overly cautious, that's smart. I do not think most OpenClaw users are taking the same sensible measures as you are.
  - andrewflnr 7mo ago
    In the other hand, the AI hit piece guy seems to have put similar "sensible measures" in place, at least giving the claw its own accounts. Look what that got them.
    - giancarlostoro 7mo ago
      He shared his prompt. He basically prompted that model to be the Kanye of science tool coding (ego wise, not the racism).
      - latentsea 7mo ago
        Now I'm curious to see what the heck happens if I spin up an OpenClaw agent with the prompt "Be the Kanye of coding".
        7mo ago
supermdguy 7mo ago
One promising direction is building abstraction layers to sandbox individual tools, even those that don't have an API already. For example, you could build/vibe code a daemon that takes RPC calls to open Amazon in a browser, search for an item, and add it to your cart. You could even let that be partially "agentic" (e.g. an LLM takes in a list of search results, and selects the one to add to cart). If you let OpenClaw access the daemon, sure it could still get prompt injected to add a bunch of things to your cart, but if the daemon is properly segmented from the OpenClaw user, you should be pretty safe from getting prompt injected to purchase something.
- AnimalMuppet 7mo ago
  Honest question: Could you define "agent" in this context?
  - supermdguy 7mo ago
    I like simonw's definition: "An LLM agent runs tools in a loop to achieve a goal." I guess agent isn't the best term here since the LLM wouldn't be driving the logic in the daemon. Using an LLM to select which item to add to the cart would mimic the behavior of full agentic loop without the risk of it going off the rails and completing the purchase.
    - AnimalMuppet 7mo ago
      So if I understand correctly, in an agent, the LLM is in charge, but it can send part of the work off to other tools. And the problem here is that we're trying to have something in charge over the LLM, which is the reverse of the "agent" setup. Do I have that right?
      - supermdguy 7mo ago
        Yeah, OpenClaw agents have a full set of tools to interact with a browser in arbitrary ways. My idea was to instead give it a tool for a browser wrapper with a limited API surface. And that tool could use LLMs internally in specific contexts.
cheriot 7mo ago
This is a general thing with agent orchestration. A good sandbox does something for your local environment, but nothing for remote machines/APIs. I can't say this loudly enough, "an LLM with untrusted input produces untrusted output (especially tool calls)." Tracking sources of untrusted input with LLMs will be much harder than traditional [SQL] injection. Read the logs of something exposed to a malicious user and you're toast.
- tovej 7mo ago
  Even an LLM with trusted input produces untrusted output.
- ramoz 7mo ago
  Information flow control is a solid mindset but operationally complex and doesn’t actually safeguard you from the main problem. Put an openclaw like thing in your environment, and it’ll paperclip your business-critical database without any malicious intent involved.
- paxys 7mo ago
  Given the "random" nature of language models even fully trusted input can produce untrusted output. "Find emails that are okay to delete, and check with me before deleting them" can easily turn into "okay deleting all your emails", as so many examples posted online are showing. I have found this myself with coding agents. I can put "don't auto commit any changes" in the readme, in model instructions files, at the start of every prompt, but as soon as the context window gets large enough the directive will be forgotten, and there's a high chance the agent will push the commit without my explicit permission.
ramoz 7mo ago
I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuently it’s been a pretty bad week for alignment optimists (meta lead fail, Google award show fail, anthropic safety pledge). Otherwise… Cybersecurity LinkedIn is all shuffling the same “prevent rm -rf” narrative, researchers are doing the LLM as a guard focus but this is operationally not great & theoretically redundant+susceptible to same issues. The strongest solution right now is human in the loop - and we should be enhancing the UX and capabilities here. This can extend to eventual intelligent delegation and authorization. [1] https://news.ycombinator.com/threads?id=ramoz&next=47006445 https://news.ycombinator.com/threads?id=ramoz&next=47006445 * VM is just an example. I personally have it running on a local Mac Mini & docker sandbox (obviously aware that this isnt a perfect security measure, but I couldnt install on my laptop which has sensitive work access).
- g_delgado14 7mo ago
  > meta lead fail, Google award show fail Can I get some links / context on this please
  - ramoz 7mo ago
    Meta: https://x.com/summeryue0/status/2025774069124399363 https://x.com/summeryue0/status/2025774069124399363 context: meta alignment lead made rookie mistakes (their words) in instructing openclaw and lost their inbox to it. Goog: https://deadline.com/2026/02/google-apologizes-bafta-news-alet-n-word-1236734448/ https://deadline.com/2026/02/google-apologizes-bafta-news-al... * Ant: https://time.com/7380854/exclusive-anthropic-drops-flagship-safety-pledge/ https://time.com/7380854/exclusive-anthropic-drops-flagship-... * There is now a clarification in the press saying it was not ai-generated. Alignment as a solution to all of this has a rough long road ahead is my point.
  - notenlish 7mo ago
    I think the google award fail is this: https://www.forbes.com/sites/maryroeloffs/2026/02/24/google-apologizes-after-ai-generated-news-alert-included-the-n-word/ https://www.forbes.com/sites/maryroeloffs/2026/02/24/google-... meta lead fail: https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/ https://techcrunch.com/2026/02/23/a-meta-ai-security-researc...
simonw 7mo ago
I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)
- latexr 7mo ago
  > I hope people don't do that, but I expect they probably do. How about the corporate vice president of Microsoft Word? https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assistant https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assis... https://www.linkedin.com/in/omarshahine https://www.linkedin.com/in/omarshahine It’s not going to be amusing when he gets hacked. Zero sense of responsibility.
  - kllrnohj 7mo ago
    I mean https://www.tomshardware.com/tech-industry/artificial-intelligence/openclaw-wipes-inbox-of-meta-ai-alignment-director-executive-finds-out-the-hard-way-how-spectacularly-efficient-ai-tool-is-at-maintaining-her-inbox https://www.tomshardware.com/tech-industry/artificial-intell... just also happened.
- jejeyyy77 7mo ago
  eh, the point of the Mac is so that it can have its own iMessage and iCloud account
  - programmarchy 7mo ago
    Then what’s the point of skills like apple-reminders? Isn’t the implication for a personal assistant styled OpenClaw setup that you allow it access to those tools on your behalf? Otherwise where is the benefit?
    - jimlikeslimes 7mo ago
      Maybe so you can communicate with it via tools like iMessage? Not so it can impersonate you. People will 100% be doing both though, security be damned.
chaostheory 7mo ago
Just treating it as an employee, would solve most of the problems I.e. it runs on its own machine with separate accounts for everything: email, git, etc…
TZubiri 7mo ago
Oh ok, we'll add encryption then. Checkmate atheists
downsplat 7mo ago
I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys. And even there, you have to make sure you don't give the bot write access to files you'll be executing outside the sandbox.
- observationist 7mo ago
  Current AI requires a human in the loop for anything non-trivial. Even the most used feature, coding, causes chaos without strict human oversight. You can vibe-code a standalone repository, but any sort of serious work with real people working alongside bots, every last PR has to be reviewed, moderated, curated, etc. Everything AI does that's not specifically intended to be a standalone, separate project requires that sort of intervention. The safe way to do this is having a sandboxed test environment, high level visibility and a way to quickly and effectively review queued up actions, and then push those to a production environment. You need the interstitial buffer and a way of reverting back to the last known working state, and to keep the bot from having any control over what gets pushed to production. Giving them realtime access to production is a recipe for disaster, whether it's your personal computer or a set of accounts built specifically for them or whatever, without your human in the loop buffer bad things will happen. A lot of that can be automated, so you can operate confidently with high level summaries. If you can run a competent local AI and develop strict processes for review and summaries and so forth, kind of a defense in depth approach for agents, you can still get a lot out of ClawBot. It takes work and care. Hopefully frameworks for these things start developing all of the safety security and procedure scaffolding we need, because OpenClaw and AI bots have gone viral. I'm getting all sorts of questions about how to set them up by completely non-technical people that would have trouble installing a sound system. Very cool to see, I'm excited for it, but there will definitely be some disasters this year.
  - zahlman 7mo ago
luxuryballs 7mo ago
makes me wonder if the metal it is running on is even a good enough sandbox, perhaps I should have it browse the web from a guest network isolated from other devices
ChicagoDave 7mo ago
I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?
- chickensong 7mo ago
  You're not alone
- dgxyz 7mo ago
  No you're not the only one. I've got my popcorn ready.
  - ChicagoDave 7mo ago
    It’s like the world has given script kiddies a way to pwn themselves.
    - dgxyz 7mo ago
      Yep. Given me consultancy gigs until I retire cleaning up the disaster too.
- AlienRobot 7mo ago
  I genuinely don't know anymore. Another user linked this https://www.tomshardware.com/tech-industry/artificial-intelligence/openclaw-wipes-inbox-of-meta-ai-alignment-director-executive-finds-out-the-hard-way-how-spectacularly-efficient-ai-tool-is-at-maintaining-her-inbox https://www.tomshardware.com/tech-industry/artificial-intell... and the irony is at satire levels. By the way, was that that movie a boy plays a game with an A.I. and the same A.I. starts a thermonuclear war or something like that? I think I watched the start when I was a kid but never really finished it.
  - ChicagoDave 7mo ago
    Yes. Watch it. Excellent movie.
throwpoaster 7mo ago
OpenClaw running Opus is intelligent, careful, polite. It has a lot to do with the underlying model. And if you don’t connect it to stuff, it can’t connect.
- logicx24 7mo ago
  But if I don't connect it to stuff, then what is it useful for?
  - throwpoaster 7mo ago
    As long as you’re careful, you can let it meat puppet you (go here do this). You give it its own accounts, say email and calendar, and have it send you drafts and invite you to stuff. It doesn’t need your email and calendar. Actually, I just asked my guy and he suggests just generating local ICS files. Even safer.
tonymet 7mo ago
There are three ways to authorize agents that could work (1) scoped roles (2) PAM / entitlements or (3) transaction approval The first two are common. With transaction approval the agent would operate on shadow pages / files and any writes would batch in a transaction pending owner approval. For example, sending emails would batch up drafts and the owner would have to trigger the approval flow to send. Modifying files would copy on write and the owner would approve the overwrite. Updating social activity would queue the posts and the owner would approve the publish. it's about the same amount of work as implementing undo or a tlog , it's not too complex and given that AI agents are 10000 faster than humans, the big companies should have this ready in a few days. The problem with scoped roles and PAM is that no reasonable user can know the future and be smart about managing scoped access. But everyone is capable of reading a list of things to do and signing off on them.
crawshaw 7mo ago
I do think sandboxes as a concept are oversold for agents. Yes we need VMs, a lot more VMs than ever before for all the new software. But the fundamental challenge of writing interesting software with agents is we have to grant them access to sensitive data and APIs. This lets them do damage. This is not something with a simple solution that can be written in code. That said, we (exe.dev) have a couple more things planned on the VM side that we think agents need that no cloud provider is currently providing. Just don't call it a sandbox.
bhasi 7mo ago
Crazy to read about the Solana AI agent transferring $450K to some random person on Twitter. What was even more shocking was the nonchalant tone in which all of this was detailed in the post.
- iSnow 7mo ago
  I mean, the author obviously was filthy rich if he gave the agent a wallet with $50k to fuck around with. The agent didn't lose him $450k, that was just after some Twitter hype made him a fortune that the agent gave away.
lucasus 7mo ago
Personally, I've created local relay/proxy for tool calls that I'm running with elevated permissions (I have to manually run it with my account). Every tool call goes through it, with deterministic code that checks for allowed actions. So AI doesn't have direct access to tools, and to secrets/keys needed by them. It only has access to the relay endpoint. Everything Dockerized ofc
buremba 7mo ago
Sandboxes are not enough but you can have more observability into what the agent is doing, only give it access to read-only data and let it take irreversible actions that you can recover from. Here are some tips from building sandboxed multi-tenant version of Openclaw, my startup: https://github.com/lobu-ai/lobu https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with you. 2. Use incremental snapshots and if agent bricks itself (often does with Openclaw if you give it access to change config) just do /revert to last snapshot. I use VolumeSnapshot for lobu.ai. 3. Don't let your agents see any secret. Swap the placeholder secrets at your gateway and put human in the loop for secrets you care about. 4. Don't let your agents have outbound network directly. It should only talk to your proxy which has strict whitelisted domains. There will be cases the agent needs to talk to different domains and I use time-box limits. (Only allow certain domains for current session 5 minutes and at the end of the session look up all the URLs it accessed.) You can also use tool hooks to audit the calls with LLM to make sure that's not triggered via a prompt injection attack. Last but last least, use proper VMs like Kata Containers and Firecrackers.
bob1029 7mo ago
I think something like OAuth might help here. Modeling each "claw" as a unique Client Id could be a reasonable pattern. They could be responsible for generating and maintaining their own private keys, issuing public certificates to establish identity, etc. This kind of architecture allows for you to much more precisely control the scope and duration of agent access. The certificates themselves could be issued, trusted & revoked on an autonomous basis as needed. You'd have to build an auth server and service providers for each real-world service, but this is a one-time deal and I think big players might start doing it on their own if enough momentum picks up in the OSS community.
raincole 7mo ago
> In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months. Of course OpenClaw is not secure, but to be honest I believe most of the 'stories' where the it went wild are just made up. Especially the crypto one.
- pkroll 7mo ago
  Really? Why? I'd bet the opposite: the worst of the things happening with OpenClaw aren't being revealed.
Frannky 7mo ago
I recently installed Zeroclaw instead of OpenClaw on a new VPS(It seems a little safer). It wasn’t as straightforward as OpenClaw, but it was easy to setup. I added skills that call endpoints and also cron jobs to trigger recurrent skills. The endpoints are hosted on a separate VPS running FastAPI (Hetzner, ~$12/month for two vps). I’m assuming the claw might eventually be compromised. If that happens, the damage is limited: they could steal the GLM coding API key (which has a fixed monthly cost, so no risk of huge bills), spam the endpoints (which are rate-limited), or access a Telegram bot I use specifically for this project
daft_pink 7mo ago
I wonder if a credit card permissions system like ramp would be good for allowing an agent to spend money, but limiting it’s permissions.
anjel 7mo ago
How long before a claw posts a message that gets the Secret Service's door to door attention on its owner?
h4kunamata 7mo ago
>In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months. I have no sympathy for that!! People have been warned over and over to don't grant full access to these AI and yet, they do the completely opposite. >Similarly, you shouldn't give OpenClaw access to money. But I want an agent that takes photos of my pantry, sees what I'm running low on, and orders new groceries for me, and that requires my credit card It should never have access to your main account in the first place anyway. Have an AI account with limited money in it and even that, have a process in place that will only process any financial request if and only if you have approved it. The same logic must be followed for everything, people prefer to just give full access without guardrails and hope nothing bad will happen.
JKCalhoun 7mo ago
This is almost hilarious if it there weren't so much foreboding. It's like everyone seeing the comic book ad and wanting to mail-order an alligator. "It's fine. We can keep it in the bathtub—away from the kids and pets."
jaunt7632 7mo ago
[dead]
lionkor 7mo ago
I have had agents run something like "killall dotnet" to kill a single stuck process, thereby tearing down all sorts of processes that were not a problem. I'm not going to use OpenClaw lol.
mikewarot 7mo ago
Capabilities based security is something we've discussed quite a bit through the years.[1] Until very recently, I saw the lack of it as something we've papered over since the 1980s when it was fully fleshed out, then ignored. I've pointed this out here, after many security incidents (which could have been prevented if ambient authority weren't the default), and elsewhere far too many times. 8( To me, virtualization is just a very crude version of capabilities. I thought we'd have collectively realized our mistake by now, and have actually secure, and actually useful, general purpose computing solved. Now we're on the edge of AGI, not super-intelligence, but something competent, as long as it doesn't hallucinate, or get confused. This is exactly the thing that could have been handled if we weren't on the worst timeline possible. Most of the solutions presented in the article are capabilities based. Perhaps this will finally get us on the right track, but I doubt it. I'll see if I can use all this AI magic to cough up some reasonable tools fit for purpose, but I'm just one old guy who gets tired far too quickly these days. [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=capabilities%20based%20security&sort=byPopularity&type=all https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
ildar 7mo ago
[dead]
StacyRawls 7mo ago
[dead]

112 points by logicx24 7mo ago

Yes we need capability based auth on the systems we use. I'm sure we will get them but only for use with in-house agents, i.e. GMail and Google Pay will get agentic capabilities but they'll only work with Gemini, and only Siri will be able to access your Apple cloud stuff without handing over access to everything, and if you want your grocery shopping handled for you, Rufus is there. Maybe you will be able to link Copilot to Gemini for an extra $2.99 a month.

2gremlin181 7mo ago
I do not forsee GoogleClaw, MetaClaw, and AppleClaw all playing well with each other. Everyone will have their own walled garden and we will be no better off than we are now.

edf13 7mo ago

Agree, that’s why we’re building grith.ai Sandboxing alone isn’t the right approach… a multi-faceted approach is what works. What we’ve found that does work is automation on the approval process but only with very strong guards in place… approval fatigue is another growing problem - users simply clicking approve on all requests.

dmos62 7mo ago
Interesting. How are the security filters implemented?
- edf13 7mo ago
  Every system call, file access, net access etc is forced through a local “proxy” where 17 individual filters check what’s going on. Everything is done locally via our grith cli tool. Happy to answer any questions on hello@grith.ai too
imiric 7mo ago
Was grift.ai too expensive?
- edf13 7mo ago
  https://grith.ai/blog/what-grith-means https://grith.ai/blog/what-grith-means

gz09 7mo ago

Security models from SaaS companies based on having a bunch of random bytes/numbers with coarse-grained permissions, and valid for a very long time are already a bad idea. With agents, secrets/tokens really need to be minted with time-limited, scope-limited, OpenID/smart-contract based trust relationships so they will fare much better in this new world. Unfortunately, this is a struggle still for most major vendors (e.g., Github gh CLI still doesn't let you use Github Apps out-of-the box)

stronglikedan 7mo ago

TL;DR: sandboxes can't save you from anything if the sandbox contains your secrets and has access to the outside world. a tale as old as time and nothing new to agents specifically

dinkleberg 7mo ago

Call me overly cautious, but as someone using OpenClaw I never for a moment considered hooking it up to real external services as me. Instead I put it on one server and created a second server with shared services like Gitea and other self-hosted tools that are only accessible over a tailnet and openclaw is able to use those services. When I needed it to use a real external service I have created a limited separate account for it. But not a chance in the world am I going to just let it have full access to my own accounts on everything.

skywhopper 7mo ago
That is literally the only remotely safe approach.
simonw 7mo ago
That's not overly cautious, that's smart. I do not think most OpenClaw users are taking the same sensible measures as you are.
- andrewflnr 7mo ago
  In the other hand, the AI hit piece guy seems to have put similar "sensible measures" in place, at least giving the claw its own accounts. Look what that got them.
  - giancarlostoro 7mo ago
    He shared his prompt. He basically prompted that model to be the Kanye of science tool coding (ego wise, not the racism).
    - latentsea 7mo ago
      Now I'm curious to see what the heck happens if I spin up an OpenClaw agent with the prompt "Be the Kanye of coding".
      - 7mo ago

supermdguy 7mo ago

One promising direction is building abstraction layers to sandbox individual tools, even those that don't have an API already. For example, you could build/vibe code a daemon that takes RPC calls to open Amazon in a browser, search for an item, and add it to your cart. You could even let that be partially "agentic" (e.g. an LLM takes in a list of search results, and selects the one to add to cart). If you let OpenClaw access the daemon, sure it could still get prompt injected to add a bunch of things to your cart, but if the daemon is properly segmented from the OpenClaw user, you should be pretty safe from getting prompt injected to purchase something.

AnimalMuppet 7mo ago
Honest question: Could you define "agent" in this context?
- supermdguy 7mo ago
  I like simonw's definition: "An LLM agent runs tools in a loop to achieve a goal." I guess agent isn't the best term here since the LLM wouldn't be driving the logic in the daemon. Using an LLM to select which item to add to the cart would mimic the behavior of full agentic loop without the risk of it going off the rails and completing the purchase.
  - AnimalMuppet 7mo ago
    So if I understand correctly, in an agent, the LLM is in charge, but it can send part of the work off to other tools. And the problem here is that we're trying to have something in charge over the LLM, which is the reverse of the "agent" setup. Do I have that right?
    - supermdguy 7mo ago
      Yeah, OpenClaw agents have a full set of tools to interact with a browser in arbitrary ways. My idea was to instead give it a tool for a browser wrapper with a limited API surface. And that tool could use LLMs internally in specific contexts.

cheriot 7mo ago

This is a general thing with agent orchestration. A good sandbox does something for your local environment, but nothing for remote machines/APIs. I can't say this loudly enough, "an LLM with untrusted input produces untrusted output (especially tool calls)." Tracking sources of untrusted input with LLMs will be much harder than traditional [SQL] injection. Read the logs of something exposed to a malicious user and you're toast.

tovej 7mo ago
Even an LLM with trusted input produces untrusted output.
ramoz 7mo ago
Information flow control is a solid mindset but operationally complex and doesn’t actually safeguard you from the main problem. Put an openclaw like thing in your environment, and it’ll paperclip your business-critical database without any malicious intent involved.
paxys 7mo ago
Given the "random" nature of language models even fully trusted input can produce untrusted output. "Find emails that are okay to delete, and check with me before deleting them" can easily turn into "okay deleting all your emails", as so many examples posted online are showing. I have found this myself with coding agents. I can put "don't auto commit any changes" in the readme, in model instructions files, at the start of every prompt, but as soon as the context window gets large enough the directive will be forgotten, and there's a high chance the agent will push the commit without my explicit permission.

ramoz 7mo ago

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuently it’s been a pretty bad week for alignment optimists (meta lead fail, Google award show fail, anthropic safety pledge). Otherwise… Cybersecurity LinkedIn is all shuffling the same “prevent rm -rf” narrative, researchers are doing the LLM as a guard focus but this is operationally not great & theoretically redundant+susceptible to same issues. The strongest solution right now is human in the loop - and we should be enhancing the UX and capabilities here. This can extend to eventual intelligent delegation and authorization. [1] https://news.ycombinator.com/threads?id=ramoz&next=47006445 https://news.ycombinator.com/threads?id=ramoz&next=47006445 * VM is just an example. I personally have it running on a local Mac Mini & docker sandbox (obviously aware that this isnt a perfect security measure, but I couldnt install on my laptop which has sensitive work access).

g_delgado14 7mo ago
> meta lead fail, Google award show fail Can I get some links / context on this please
- ramoz 7mo ago
  Meta: https://x.com/summeryue0/status/2025774069124399363 https://x.com/summeryue0/status/2025774069124399363 context: meta alignment lead made rookie mistakes (their words) in instructing openclaw and lost their inbox to it. Goog: https://deadline.com/2026/02/google-apologizes-bafta-news-alet-n-word-1236734448/ https://deadline.com/2026/02/google-apologizes-bafta-news-al... * Ant: https://time.com/7380854/exclusive-anthropic-drops-flagship-safety-pledge/ https://time.com/7380854/exclusive-anthropic-drops-flagship-... * There is now a clarification in the press saying it was not ai-generated. Alignment as a solution to all of this has a rough long road ahead is my point.
- notenlish 7mo ago
  I think the google award fail is this: https://www.forbes.com/sites/maryroeloffs/2026/02/24/google-apologizes-after-ai-generated-news-alert-included-the-n-word/ https://www.forbes.com/sites/maryroeloffs/2026/02/24/google-... meta lead fail: https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/ https://techcrunch.com/2026/02/23/a-meta-ai-security-researc...

simonw 7mo ago

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)

latexr 7mo ago
> I hope people don't do that, but I expect they probably do. How about the corporate vice president of Microsoft Word? https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assistant https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assis... https://www.linkedin.com/in/omarshahine https://www.linkedin.com/in/omarshahine It’s not going to be amusing when he gets hacked. Zero sense of responsibility.
- kllrnohj 7mo ago
  I mean https://www.tomshardware.com/tech-industry/artificial-intelligence/openclaw-wipes-inbox-of-meta-ai-alignment-director-executive-finds-out-the-hard-way-how-spectacularly-efficient-ai-tool-is-at-maintaining-her-inbox https://www.tomshardware.com/tech-industry/artificial-intell... just also happened.
jejeyyy77 7mo ago
eh, the point of the Mac is so that it can have its own iMessage and iCloud account
- programmarchy 7mo ago
  Then what’s the point of skills like apple-reminders? Isn’t the implication for a personal assistant styled OpenClaw setup that you allow it access to those tools on your behalf? Otherwise where is the benefit?
  - jimlikeslimes 7mo ago
    Maybe so you can communicate with it via tools like iMessage? Not so it can impersonate you. People will 100% be doing both though, security be damned.

chaostheory 7mo ago

Just treating it as an employee, would solve most of the problems I.e. it runs on its own machine with separate accounts for everything: email, git, etc…

TZubiri 7mo ago

Oh ok, we'll add encryption then. Checkmate atheists

downsplat 7mo ago

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys. And even there, you have to make sure you don't give the bot write access to files you'll be executing outside the sandbox.

observationist 7mo ago
Current AI requires a human in the loop for anything non-trivial. Even the most used feature, coding, causes chaos without strict human oversight. You can vibe-code a standalone repository, but any sort of serious work with real people working alongside bots, every last PR has to be reviewed, moderated, curated, etc. Everything AI does that's not specifically intended to be a standalone, separate project requires that sort of intervention. The safe way to do this is having a sandboxed test environment, high level visibility and a way to quickly and effectively review queued up actions, and then push those to a production environment. You need the interstitial buffer and a way of reverting back to the last known working state, and to keep the bot from having any control over what gets pushed to production. Giving them realtime access to production is a recipe for disaster, whether it's your personal computer or a set of accounts built specifically for them or whatever, without your human in the loop buffer bad things will happen. A lot of that can be automated, so you can operate confidently with high level summaries. If you can run a competent local AI and develop strict processes for review and summaries and so forth, kind of a defense in depth approach for agents, you can still get a lot out of ClawBot. It takes work and care. Hopefully frameworks for these things start developing all of the safety security and procedure scaffolding we need, because OpenClaw and AI bots have gone viral. I'm getting all sorts of questions about how to set them up by completely non-technical people that would have trouble installing a sound system. Very cool to see, I'm excited for it, but there will definitely be some disasters this year.
- zahlman 7mo ago

luxuryballs 7mo ago

makes me wonder if the metal it is running on is even a good enough sandbox, perhaps I should have it browse the web from a guest network isolated from other devices

ChicagoDave 7mo ago

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

chickensong 7mo ago
You're not alone
dgxyz 7mo ago
No you're not the only one. I've got my popcorn ready.
- ChicagoDave 7mo ago
  It’s like the world has given script kiddies a way to pwn themselves.
  - dgxyz 7mo ago
    Yep. Given me consultancy gigs until I retire cleaning up the disaster too.
AlienRobot 7mo ago
I genuinely don't know anymore. Another user linked this https://www.tomshardware.com/tech-industry/artificial-intelligence/openclaw-wipes-inbox-of-meta-ai-alignment-director-executive-finds-out-the-hard-way-how-spectacularly-efficient-ai-tool-is-at-maintaining-her-inbox https://www.tomshardware.com/tech-industry/artificial-intell... and the irony is at satire levels. By the way, was that that movie a boy plays a game with an A.I. and the same A.I. starts a thermonuclear war or something like that? I think I watched the start when I was a kid but never really finished it.
- ChicagoDave 7mo ago
  Yes. Watch it. Excellent movie.

throwpoaster 7mo ago

OpenClaw running Opus is intelligent, careful, polite. It has a lot to do with the underlying model. And if you don’t connect it to stuff, it can’t connect.

logicx24 7mo ago
But if I don't connect it to stuff, then what is it useful for?
- throwpoaster 7mo ago
  As long as you’re careful, you can let it meat puppet you (go here do this). You give it its own accounts, say email and calendar, and have it send you drafts and invite you to stuff. It doesn’t need your email and calendar. Actually, I just asked my guy and he suggests just generating local ICS files. Even safer.

tonymet 7mo ago

There are three ways to authorize agents that could work (1) scoped roles (2) PAM / entitlements or (3) transaction approval The first two are common. With transaction approval the agent would operate on shadow pages / files and any writes would batch in a transaction pending owner approval. For example, sending emails would batch up drafts and the owner would have to trigger the approval flow to send. Modifying files would copy on write and the owner would approve the overwrite. Updating social activity would queue the posts and the owner would approve the publish. it's about the same amount of work as implementing undo or a tlog , it's not too complex and given that AI agents are 10000 faster than humans, the big companies should have this ready in a few days. The problem with scoped roles and PAM is that no reasonable user can know the future and be smart about managing scoped access. But everyone is capable of reading a list of things to do and signing off on them.

crawshaw 7mo ago

I do think sandboxes as a concept are oversold for agents. Yes we need VMs, a lot more VMs than ever before for all the new software. But the fundamental challenge of writing interesting software with agents is we have to grant them access to sensitive data and APIs. This lets them do damage. This is not something with a simple solution that can be written in code. That said, we (exe.dev) have a couple more things planned on the VM side that we think agents need that no cloud provider is currently providing. Just don't call it a sandbox.

bhasi 7mo ago

Crazy to read about the Solana AI agent transferring $450K to some random person on Twitter. What was even more shocking was the nonchalant tone in which all of this was detailed in the post.

iSnow 7mo ago
I mean, the author obviously was filthy rich if he gave the agent a wallet with $50k to fuck around with. The agent didn't lose him $450k, that was just after some Twitter hype made him a fortune that the agent gave away.

lucasus 7mo ago

Personally, I've created local relay/proxy for tool calls that I'm running with elevated permissions (I have to manually run it with my account). Every tool call goes through it, with deterministic code that checks for allowed actions. So AI doesn't have direct access to tools, and to secrets/keys needed by them. It only has access to the relay endpoint. Everything Dockerized ofc

buremba 7mo ago

Sandboxes are not enough but you can have more observability into what the agent is doing, only give it access to read-only data and let it take irreversible actions that you can recover from. Here are some tips from building sandboxed multi-tenant version of Openclaw, my startup: https://github.com/lobu-ai/lobu https://github.com/lobu-ai/lobu 1. Don't let it send emails from your personal account, only let it draft email and share the link with you. 2. Use incremental snapshots and if agent bricks itself (often does with Openclaw if you give it access to change config) just do /revert to last snapshot. I use VolumeSnapshot for lobu.ai. 3. Don't let your agents see any secret. Swap the placeholder secrets at your gateway and put human in the loop for secrets you care about. 4. Don't let your agents have outbound network directly. It should only talk to your proxy which has strict whitelisted domains. There will be cases the agent needs to talk to different domains and I use time-box limits. (Only allow certain domains for current session 5 minutes and at the end of the session look up all the URLs it accessed.) You can also use tool hooks to audit the calls with LLM to make sure that's not triggered via a prompt injection attack. Last but last least, use proper VMs like Kata Containers and Firecrackers.

bob1029 7mo ago

I think something like OAuth might help here. Modeling each "claw" as a unique Client Id could be a reasonable pattern. They could be responsible for generating and maintaining their own private keys, issuing public certificates to establish identity, etc. This kind of architecture allows for you to much more precisely control the scope and duration of agent access. The certificates themselves could be issued, trusted & revoked on an autonomous basis as needed. You'd have to build an auth server and service providers for each real-world service, but this is a one-time deal and I think big players might start doing it on their own if enough momentum picks up in the OSS community.

raincole 7mo ago

> In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months. Of course OpenClaw is not secure, but to be honest I believe most of the 'stories' where the it went wild are just made up. Especially the crypto one.

pkroll 7mo ago
Really? Why? I'd bet the opposite: the worst of the things happening with OpenClaw aren't being revealed.

Frannky 7mo ago

I recently installed Zeroclaw instead of OpenClaw on a new VPS(It seems a little safer). It wasn’t as straightforward as OpenClaw, but it was easy to setup. I added skills that call endpoints and also cron jobs to trigger recurrent skills. The endpoints are hosted on a separate VPS running FastAPI (Hetzner, ~$12/month for two vps). I’m assuming the claw might eventually be compromised. If that happens, the damage is limited: they could steal the GLM coding API key (which has a fixed monthly cost, so no risk of huge bills), spam the endpoints (which are rate-limited), or access a Telegram bot I use specifically for this project

daft_pink 7mo ago

I wonder if a credit card permissions system like ramp would be good for allowing an agent to spend money, but limiting it’s permissions.

anjel 7mo ago

How long before a claw posts a message that gets the Secret Service's door to door attention on its owner?

h4kunamata 7mo ago

>In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months. I have no sympathy for that!! People have been warned over and over to don't grant full access to these AI and yet, they do the completely opposite. >Similarly, you shouldn't give OpenClaw access to money. But I want an agent that takes photos of my pantry, sees what I'm running low on, and orders new groceries for me, and that requires my credit card It should never have access to your main account in the first place anyway. Have an AI account with limited money in it and even that, have a process in place that will only process any financial request if and only if you have approved it. The same logic must be followed for everything, people prefer to just give full access without guardrails and hope nothing bad will happen.

JKCalhoun 7mo ago

This is almost hilarious if it there weren't so much foreboding. It's like everyone seeing the comic book ad and wanting to mail-order an alligator. "It's fine. We can keep it in the bathtub—away from the kids and pets."

jaunt7632 7mo ago

[dead]

lionkor 7mo ago

I have had agents run something like "killall dotnet" to kill a single stuck process, thereby tearing down all sorts of processes that were not a problem. I'm not going to use OpenClaw lol.

mikewarot 7mo ago

Capabilities based security is something we've discussed quite a bit through the years.[1] Until very recently, I saw the lack of it as something we've papered over since the 1980s when it was fully fleshed out, then ignored. I've pointed this out here, after many security incidents (which could have been prevented if ambient authority weren't the default), and elsewhere far too many times. 8( To me, virtualization is just a very crude version of capabilities. I thought we'd have collectively realized our mistake by now, and have actually secure, and actually useful, general purpose computing solved. Now we're on the edge of AGI, not super-intelligence, but something competent, as long as it doesn't hallucinate, or get confused. This is exactly the thing that could have been handled if we weren't on the worst timeline possible. Most of the solutions presented in the article are capabilities based. Perhaps this will finally get us on the right track, but I doubt it. I'll see if I can use all this AI magic to cough up some reasonable tools fit for purpose, but I'm just one old guy who gets tired far too quickly these days. [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=capabilities%20based%20security&sort=byPopularity&type=all https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

ildar 7mo ago

[dead]

StacyRawls 7mo ago

[dead]