Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

21–30 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#21

Post by latexr »

simonw wrote: post #13

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)

> I hope people don't do that, but I expect they probably do.

How about the corporate vice president of Microsoft Word?

https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assis...

https://www.linkedin.com/in/omarshahine

It’s not going to be amusing when he gets hacked. Zero sense of responsibility.

Re: Sandboxes won't save you from OpenClaw

#22

Post by downsplat »

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that.

Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it can't read $HOME or access my ssh keys. And even there, you have to make sure you don't give the bot write access to files you'll be executing outside the sandbox.

Re: Sandboxes won't save you from OpenClaw

#23

Post by ramoz »

g_delgado14 wrote: post #19
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> meta lead fail, Google award show fail Can I get some links / context on this please

Meta: https://x.com/summeryue0/status/2025774069124399363 context: meta alignment lead made rookie mistakes (their words) in instructing openclaw and lost their inbox to it.

Goog: https://deadline.com/2026/02/google-apologizes-bafta-news-al... *

Ant: https://time.com/7380854/exclusive-anthropic-drops-flagship-...

* There is now a clarification in the press saying it was not ai-generated.

Alignment as a solution to all of this has a rough long road ahead is my point.

Re: Sandboxes won't save you from OpenClaw

#24

Post by notenlish »

g_delgado14 wrote: post #19
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> meta lead fail, Google award show fail Can I get some links / context on this please

I think the google award fail is this: https://www.forbes.com/sites/maryroeloffs/2026/02/24/google-...

meta lead fail: https://techcrunch.com/2026/02/23/a-meta-ai-security-researc...

Re: Sandboxes won't save you from OpenClaw

#25

Post by imiric »

edf13 wrote: post #3

Agree, that’s why we’re building grith.ai Sandboxing alone isn’t the right approach… a multi-faceted approach is what works. What we’ve found that does work is automation on the approval process but only with very strong guards in place… approval fatigue is another growing problem - users simply clicking approve on all requests.

Was grift.ai too expensive?

Re: Sandboxes won't save you from OpenClaw

#26

Post by giancarlostoro »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> literally go deploy it in a VM on any cloud

Sure, but now you're adding extra cost, vs just running it locally. RAM is also heavily inflated thanks to Sam Altman investment magic.

Re: Sandboxes won't save you from OpenClaw

#27

Post by jejeyyy77 »

simonw wrote: post #13

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)

eh, the point of the Mac is so that it can have its own iMessage and iCloud account

Re: Sandboxes won't save you from OpenClaw

#28

Post by dbl000 »

g_delgado14 wrote: post #19
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> meta lead fail, Google award show fail Can I get some links / context on this please

The meta lead is probably a reference to Summer Yue having OpenClaw delete all the emails in her inbox despite being told not to.

https://x.com/summeryue0/status/2025774069124399363

Re: Sandboxes won't save you from OpenClaw

#29

Post by paxys »

cheriot wrote: post #9

This is a general thing with agent orchestration. A good sandbox does something for your local environment, but nothing for remote machines/APIs. I can't say this loudly enough, "an LLM with untrusted input produces untrusted output (especially tool calls)." Tracking sources of untrusted input with LLMs will be much harder than traditional [SQL] injection. Read the logs of something exposed to a malicious user and yo…

Given the "random" nature of language models even fully trusted input can produce untrusted output.

"Find emails that are okay to delete, and check with me before deleting them" can easily turn into "okay deleting all your emails", as so many examples posted online are showing.

I have found this myself with coding agents. I can put "don't auto commit any changes" in the readme, in model instructions files, at the start of every prompt, but as soon as the context window gets large enough the directive will be forgotten, and there's a high chance the agent will push the commit without my explicit permission.

Re: Sandboxes won't save you from OpenClaw

#30

Post by giancarlostoro »

andrewflnr wrote: post #11
simonw wrote: post #8

Earlier quoted context omitted.

That's not overly cautious, that's smart. I do not think most OpenClaw users are taking the same sensible measures as you are.

In the other hand, the AI hit piece guy seems to have put similar "sensible measures" in place, at least giving the claw its own accounts. Look what that got them.

He shared his prompt. He basically prompted that model to be the Kanye of science tool coding (ego wise, not the racism).
Post reply on HN