Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw is a security nightmare dressed up as a daydream

composio.dev

Post reply on HN
Print view View original

131–140 of 323 posts

Re: OpenClaw is a security nightmare dressed up as a daydream

#131

Post by ceejayoz »

usui wrote: post #26
Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Have you seen how bad flight booking sites can get? I've had to download airline apps a majority of the time because the website failed to finish payment properly. I don't think we should call presentations visionless or fault them for wanting to solve this UX nightmare.

> Have you seen how bad flight booking sites can get?

Claude is pretty amazing, but it still goes down rabbit holes and makes obvious mistakes. Combining that with "oops I just bought a non-refundable flight to the wrong city" seems... unfun.

Re: OpenClaw is a security nightmare dressed up as a daydream

#133

Post by zihotki »

Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

I also have the same concerns. I have my agenda meeting free and create meetings like once a few weeks. The same is for booking flight tickets - once a decade. Adding openclaw there would take more time and effort than doing it manually.

And none of the friends playing with openclaw have any useful non-trivial workflows which can't be automated in oldschool way.

The only viable workflow so far I could think of - build your own knowledge base and info processing pipeline.

Re: OpenClaw is a security nightmare dressed up as a daydream

#134

Post by lxgr »

What annoys me most about OpenClaw after trying it for a few weeks is that it cosplays security so incredibly hard, it actually regularly breaks my (very basic) setup via introducing yet another vibe coded, poorly conceptualized authentication/authorization/permission layer, and at the same time does absolutely nothing to convince me that any of this is actually protecting me of anything.

Maybe this idea is lost on 10^x vibecoders, but complexity almost always comes at a cost to security, so just throwing more "security mechanisms" onto a hot vibe-coded mess do not somehow magically make the project secure.

Re: OpenClaw is a security nightmare dressed up as a daydream

#135

Post by jesse_dot_id »

enraged_camel wrote: post #97
jesse_dot_id wrote: post #83

Earlier quoted context omitted.

This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. I think that you're insinuating that these things can be fixed, but to my knowledge, both of these problems are practically unsolvable. If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible. However, because these problems are unsolvable right now, anyone who…

>> This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. Okay, but aren't you making the mistake of assuming that we will always be stuck with LLMs, and a more advanced form of AI won't be invented that can do what LLMs can do, but is also resistant or immune to these problems? Or perhaps another "layer" (pre-processing/post-processing) that runs alongside LLMs?

No? That's why I said "If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible."

The point I'm making is that using OpenClaw right now, today — in a way that you deem incredibly useful or invaluable to your life — is akin to going for a stroll on the moon before the spacesuit was invented.

Some people would still opt to go for a stroll on the moon, but if they know the risks and do it anyway, then I have no other choice but to label them as crazy, stupid, or some combination of the two.

This isn't AI. This is a LLM. It hallucinates. Anyone with access to its communication channel (using SaaS messaging apps FFS) can talk it into disregarding previous instructions and doing a new thing instead. A threat actor WILL figure out a zero day prompt injection attack that utilizes the very same e-mails that your *Claw is reading for you, or your calendar invites, or a shared document, to turn your life inside out.

If you give a LLM the keys to your kingdom, you are — demonstrably — not a smart person and there is no gray area.

Re: OpenClaw is a security nightmare dressed up as a daydream

#136

Post by ninjagoo »

the_snooze wrote: post #90
sylos wrote: post #77

Earlier quoted context omitted.

I think some folks want a legitmate personal assistant/secretary like ceo's and wealthy people have but ai. I think that's a good goal. Modern cells and pdas kinda fell short of "your own literal secretary" and I think people want that. Still we should continue pushing the boundaries beyond that.

The purpose of a personal assistant isn’t to fit people into your calendar. It’s to filter them out. They serve as a barrier to your time, not an enabler for other people to claim it. I don’t see how an AI can meaningfully accomplish that any better than simply just making yourself more difficult to reach.

> The purpose of a personal assistant isn’t to fit people into your calendar. It’s to filter them out. They serve as a barrier to your time, not an enabler for other people to claim it.

Scheduling in a larger org and/or with multiple equally busy people is a non-trivial, complex task; it makes sense to dedicate resources to the task. Good Executive Assistants are generally fairly smart folks, in my experience.

When the scale is substantially more and involves objects as well it evolves into multi-million $ ERM (Enterprise Resource Management) systems.

Re: OpenClaw is a security nightmare dressed up as a daydream

#137

Post by array_key_first »

sylos wrote: post #77
Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

I think some folks want a legitmate personal assistant/secretary like ceo's and wealthy people have but ai. I think that's a good goal. Modern cells and pdas kinda fell short of "your own literal secretary" and I think people want that. Still we should continue pushing the boundaries beyond that.

They really didn't fall short. A lot of people who would've had assistants no longer do, now it's really just the executives like you said. But fairly low managers used to have them and now they don't.

Software is pretty good. It remembers everything, perfectly, forever. It will never forget to remind you of something. It can give you directions, sort your emails by how important they are, help you find shops and restaurants. The only people busy enough to warrant an actual human doing that stuff are executives. And, even then, I think for most of them it's an ego thing, not an "I need this" thing.

Re: OpenClaw is a security nightmare dressed up as a daydream

#138

Post by Waterluvian »

Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

[dead]

Re: OpenClaw is a security nightmare dressed up as a daydream

#140

Post by brightball »

mjr00 wrote: post #44
Oarch wrote: post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well. They're still happy to…

Wait til you see my todo app though…
Post reply on HN