Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1-Click RCE to steal your Moltbot data and keys

depthfirst.com

Post reply on HN
Print view View original

21–30 of 78 posts

Re: 1-Click RCE to steal your Moltbot data and keys

#21

Post by mh2266 »

overgard wrote: post #6

I'm curious, outside of AI enthusiasts have people found value with using Clawdbot, and if so, what are they doing with it? From my perspective it seems like the people legitimately busy enough that they actually need an AI assistant are also people with enough responsibilities that they have to be very careful about letting something act on their behalf with minimal supervision. It seems like that sort of person cou…

The whole premise of this thing seems to be that it has access to your email, web browser, messaging, and so on. That's what makes it, in theory, useful.

The prompt injection possibilities are incredibly obvious... the entire world has write access to your agent.

???????

Re: 1-Click RCE to steal your Moltbot data and keys

#22

Post by stijnveken »

decodebytes wrote: post #9

I rushed out nono.sh (the opposite of yolo!) in response to this and its already negated a few gateway attacks. It uses kernel-level security primitives (Landlock on Linux, Seatbelt on macOS) to create sandboxes where unauthorized operations are structurally impossible. API keys are also stored in apples secure enclave (or the kernel keyring in linux) , and injected at run time and zeroized from memory after use. The…

Heads up that your url is wrong. Should be https://nono.sh

Re: 1-Click RCE to steal your Moltbot data and keys

#23

Post by chrisjj »

vulnwrecker5000 wrote: post #18

what worries me here is that the entire personal AI agent product category is built on the premise of “connect me to all your data + give me execution.” At that point, the question isn’t “did they patch this RCE,” it’s more about what does a secure autonomous agent deployment even look like when its main feature is broad authority over all of someone's connected data? Is the only real answer sandboxing + zero trust +…

We need more Windows' "Are you sure you want XXX to make changes to your computer? (no I can't tell you what changes, but trust me.)"

/i

Re: 1-Click RCE to steal your Moltbot data and keys

#24

Post by mh2266 »

vulnwrecker5000 wrote: post #18

what worries me here is that the entire personal AI agent product category is built on the premise of “connect me to all your data + give me execution.” At that point, the question isn’t “did they patch this RCE,” it’s more about what does a secure autonomous agent deployment even look like when its main feature is broad authority over all of someone's connected data? Is the only real answer sandboxing + zero trust +…

> “did they patch this RCE,”

no, they documented it

https://docs.openclaw.ai/gateway/security#node-execution-sys...

Re: 1-Click RCE to steal your Moltbot data and keys

#25

Post by chrisjj »

mentalgear wrote: post #4

Moltbot is a security nightmare, especially it's premise (tap into all your data sources) and the rapid uptake by inexperienced users makes it especially attractive for criminal networks.

It's like a bank decided to open its systems to a bunch of students it hired off Fiverr.

Re: 1-Click RCE to steal your Moltbot data and keys

#28

Post by decodebytes »

stijnveken wrote: post #22
decodebytes wrote: post #9

I rushed out nono.sh (the opposite of yolo!) in response to this and its already negated a few gateway attacks. It uses kernel-level security primitives (Landlock on Linux, Seatbelt on macOS) to create sandboxes where unauthorized operations are structurally impossible. API keys are also stored in apples secure enclave (or the kernel keyring in linux) , and injected at run time and zeroized from memory after use. The…

Heads up that your url is wrong. Should be https://nono.sh

lol thanks! seriously, I have been running the tool over and over while testing and I kept typing 'nano' and opening binaries in the text editor. Next minute I swearing my head off trying to close nano (and not vim!)

Re: 1-Click RCE to steal your Moltbot data and keys

#29

Post by avaer »

mentalgear wrote: post #4

Moltbot is a security nightmare, especially it's premise (tap into all your data sources) and the rapid uptake by inexperienced users makes it especially attractive for criminal networks.

Yes, there are already several criminal networks operating on it (transparently). I guess some consider this a feature.

Re: 1-Click RCE to steal your Moltbot data and keys

#30

Post by chrisjj »

lxgr wrote: post #10
dotancohen wrote: post #2

The real problem is that there is nothing novel here. Variants of this type of attack were clear from the beginning.

What I would have expected is prompt injection or other methods to get the agent to do something its user doesn't want it to, not regular "classical" attacks. At least currently, I don't think we have good ways of preventing the former, but the latter should be possible to avoid.

> At least currently, I don't think we have good ways of preventing the former, but the latter should be possible to avoid.

Here's the thing. People who don't see a problem with the former obviously have no interest in addressing the latter.

Post reply on HN