This project terrifies me. On the one hand it really is very cool, and a lot of people are reporting great results using it. It helped someone negotiate with car dealers to buy a car! https://aaronstuyvenberg.com/posts/clawd-bought-a-car But it's an absolute perfect storm for prompt injection and lethal trifecta attacks: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ People are hooking this thing up to Te…
If you have to mitigate the security issues but still use the product, how and what would you do about it ? to prevent prompt injection attacks and trifecta attacks. How to prevent gmail and iMessage leaks, if we cut off outbound access then it becomes useless , also it will spin up a reverse proxy like ngrok and send the data as long as it has inbound access. Once it has internet access its hard to prevent untrusted…
And like you observed, that greatly restricts the usefulness of what we can build!
The most credible path forward I've seen so far is the DeepMind CaMeL paper: https://simonwillison.net/2025/Apr/11/camel/