I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
1–10 of 63 posts
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#2OpenClaw proved demand for personal AI agents on your own hardware, but its default config listens on all network interfaces. Thousands of instances were found exposed. I spent a weekend building an alternative using Blink (OSS agent orchestration), Tailscale (WireGuard-based private networking), and a Mac Mini M4. Two isolated agents, no public exposure, built-in UI, ~10W idle power draw.
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#3OpenClaw proved demand for personal AI agents on your own hardware, but its default config listens on all network interfaces. Thousands of instances were found exposed. I spent a weekend building an alternative using Blink (OSS agent orchestration), Tailscale (WireGuard-based private networking), and a Mac Mini M4. Two isolated agents, no public exposure, built-in UI, ~10W idle power draw.
>but its default config listens on all network interfaces
The default config listens on only localhost which is why it tells you to forward the port using ssh to your own machine to access it from a different machine.
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#4OpenClaw is not insecure because it has ports open to the internet. This is an easily solved problem in one line of code (if indeed it even has that bug, which I don’t think it does). Furthermore you’re probably behind NAT.
OpenClaw, as well as the author’s solution, is insecure because it sends the full content of all of your private documents and data to a remote inference API which is logging everything forever (and is legally obligated to provide it to DHS/ICE/FBI/et al without a warrant or probable cause). Better engineering of the agent framework will not solve this. Only better models and asstons of local VRAM will solve this.
You still then have the “agent flipped out and emailed a hallucinated suicide note to all my coworkers and then formatted my drives” problem but that’s less of a real risk and one most people are willing to accept. Frontier models are pretty famously well-behaved these days 99.9% of the time and the utility provided is well worth the 0.1% risk to most people.
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#5OpenClaw is not insecure because it has ports open to the internet. This is an easily solved problem in one line of code (if indeed it even has that bug, which I don’t think it does). Furthermore you’re probably behind NAT. OpenClaw, as well as the author’s solution, is insecure because it sends the full content of all of your private documents and data to a remote inference API which is logging everything forever (a…
It‘s not just that - but I complete agree on not using a Personal AI assistant with some cloud service LLM provider.
Anyway, by interacting with the world, the LLM can be manipulated or even hacked by the data it encounters.
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#6For those interested, you can get the base config Mac Mini (in the US) for $400 from Micro Center [0]. They don’t seem to ship to where I live, but BestBuy was happy to price match in the support chat.
Just received mine and planned on experimenting with something like OP this weekend.
[0] https://www.microcenter.com/product/688173/apple-mac-mini-mu...
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#7"more secure AI agent" is like "most secure version of Windows yet"
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#8OpenClaw proved demand for personal AI agents on your own hardware, but its default config listens on all network interfaces. Thousands of instances were found exposed. I spent a weekend building an alternative using Blink (OSS agent orchestration), Tailscale (WireGuard-based private networking), and a Mac Mini M4. Two isolated agents, no public exposure, built-in UI, ~10W idle power draw.
Don't most ISP routers block ports unless you port forward them though?
I wouldn't say that the vulnerability in that case was in OpenClaw, but with the router, nowadays it's expected that ports are blocked unless explicitly allowed in the router.
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#9OpenClaw is not insecure because it has ports open to the internet. This is an easily solved problem in one line of code (if indeed it even has that bug, which I don’t think it does). Furthermore you’re probably behind NAT. OpenClaw, as well as the author’s solution, is insecure because it sends the full content of all of your private documents and data to a remote inference API which is logging everything forever (a…
Isn't the wasteful sending of every data and their mother the reason why OpenClaw is so useful for many people? I heard something about excessively big context-windows on every single request. So making it more secure, while still using remote LLMs, would mean making it less useful?
Re: I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
#10so, ignoring the the fact that you yourself didn't actually write this (based on commit history), and the fact that your claims about better security are dubious at best, the most interesting thing I find about this whole situation is - how did you get this to the hackernews front page so fast?
that's the real (not-so) secret sauce here :)