Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

11–20 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#11

Post by andrewflnr »

simonw wrote: post #8
dinkleberg wrote: post #6

Call me overly cautious, but as someone using OpenClaw I never for a moment considered hooking it up to real external services as me . Instead I put it on one server and created a second server with shared services like Gitea and other self-hosted tools that are only accessible over a tailnet and openclaw is able to use those services. When I needed it to use a real external service I have created a limited separate…

That's not overly cautious, that's smart. I do not think most OpenClaw users are taking the same sensible measures as you are.

In the other hand, the AI hit piece guy seems to have put similar "sensible measures" in place, at least giving the claw its own accounts. Look what that got them.

Re: Sandboxes won't save you from OpenClaw

#12

Post by ramoz »

I’ve said similar in another thread[1]:

Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc

——-

Unfortuently it’s been a pretty bad week for alignment optimists (meta lead fail, Google award show fail, anthropic safety pledge). Otherwise… Cybersecurity LinkedIn is all shuffling the same “prevent rm -rf” narrative, researchers are doing the LLM as a guard focus but this is operationally not great & theoretically redundant+susceptible to same issues.

The strongest solution right now is human in the loop - and we should be enhancing the UX and capabilities here. This can extend to eventual intelligent delegation and authorization.

[1] https://news.ycombinator.com/threads?id=ramoz&next=47006445

* VM is just an example. I personally have it running on a local Mac Mini & docker sandbox (obviously aware that this isnt a perfect security measure, but I couldnt install on my laptop which has sensitive work access).

Re: Sandboxes won't save you from OpenClaw

#13

Post by simonw »

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike.

(I hope people don't do that, but I expect they probably do.)

Re: Sandboxes won't save you from OpenClaw

#15

Post by edf13 »

dmos62 wrote: post #10
edf13 wrote: post #3

Agree, that’s why we’re building grith.ai Sandboxing alone isn’t the right approach… a multi-faceted approach is what works. What we’ve found that does work is automation on the approval process but only with very strong guards in place… approval fatigue is another growing problem - users simply clicking approve on all requests.

Interesting. How are the security filters implemented?

Every system call, file access, net access etc is forced through a local “proxy” where 17 individual filters check what’s going on.

Everything is done locally via our grith cli tool.

Happy to answer any questions on hello@grith.ai too

Re: Sandboxes won't save you from OpenClaw

#17

Post by skywhopper »

dinkleberg wrote: post #6

Call me overly cautious, but as someone using OpenClaw I never for a moment considered hooking it up to real external services as me . Instead I put it on one server and created a second server with shared services like Gitea and other self-hosted tools that are only accessible over a tailnet and openclaw is able to use those services. When I needed it to use a real external service I have created a limited separate…

That is literally the only remotely safe approach.

Re: Sandboxes won't save you from OpenClaw

#18

Post by tovej »

cheriot wrote: post #9

This is a general thing with agent orchestration. A good sandbox does something for your local environment, but nothing for remote machines/APIs. I can't say this loudly enough, "an LLM with untrusted input produces untrusted output (especially tool calls)." Tracking sources of untrusted input with LLMs will be much harder than traditional [SQL] injection. Read the logs of something exposed to a malicious user and yo…

Even an LLM with trusted input produces untrusted output.

Re: Sandboxes won't save you from OpenClaw

#19

Post by g_delgado14 »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> meta lead fail, Google award show fail

Can I get some links / context on this please

Re: Sandboxes won't save you from OpenClaw

#20

Post by ramoz »

cheriot wrote: post #9

This is a general thing with agent orchestration. A good sandbox does something for your local environment, but nothing for remote machines/APIs. I can't say this loudly enough, "an LLM with untrusted input produces untrusted output (especially tool calls)." Tracking sources of untrusted input with LLMs will be much harder than traditional [SQL] injection. Read the logs of something exposed to a malicious user and yo…

Information flow control is a solid mindset but operationally complex and doesn’t actually safeguard you from the main problem.

Put an openclaw like thing in your environment, and it’ll paperclip your business-critical database without any malicious intent involved.

Post reply on HN