Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nvidia NemoClaw

github.com

Post reply on HN
Print view View original

221–230 of 291 posts

Re: Nvidia NemoClaw

#221

Post by epaga »

simple10 wrote: post #218
Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

Yeah, it's wild. I spent several weeks nearly full time on a deep dive of claw architecture & security. The short of it - OpenClaw sandboxes are useful for controlling what sub-agents can do, and what they have access to. But it's a security nightmare. During config experiments, I got hit with a $20 Anthropic API charge from one request that ran amuck. Misconfigured security sandbox issue resulted in Opus getting cra…

> It used a mix of dom-to-image sending pixels through the context window, then writing scripts in various sandboxes to piece together a full jailbreak.

That would be one interesting write-up if you ever find the time to gather all the details!

Re: Nvidia NemoClaw

#222

Post by ATechGuy »

epaga wrote: post #221
simple10 wrote: post #218

Earlier quoted context omitted.

Yeah, it's wild. I spent several weeks nearly full time on a deep dive of claw architecture & security. The short of it - OpenClaw sandboxes are useful for controlling what sub-agents can do, and what they have access to. But it's a security nightmare. During config experiments, I got hit with a $20 Anthropic API charge from one request that ran amuck. Misconfigured security sandbox issue resulted in Opus getting cra…

> It used a mix of dom-to-image sending pixels through the context window, then writing scripts in various sandboxes to piece together a full jailbreak. That would be one interesting write-up if you ever find the time to gather all the details!

+1

Re: Nvidia NemoClaw

#223

Post by simple10 »

epaga wrote: post #221
simple10 wrote: post #218

Earlier quoted context omitted.

Yeah, it's wild. I spent several weeks nearly full time on a deep dive of claw architecture & security. The short of it - OpenClaw sandboxes are useful for controlling what sub-agents can do, and what they have access to. But it's a security nightmare. During config experiments, I got hit with a $20 Anthropic API charge from one request that ran amuck. Misconfigured security sandbox issue resulted in Opus getting cra…

> It used a mix of dom-to-image sending pixels through the context window, then writing scripts in various sandboxes to piece together a full jailbreak. That would be one interesting write-up if you ever find the time to gather all the details!

It's on my claw list to write a blog post. I just keep taking down my claws to make modifications. lol

Here's the full (unedited) details including many of the claude code debugging sessions to dig into the logs to figure out what happened:

https://github.com/simple10/openclaw-stack/blob/caf9de2f1c0c...

And here's a summary a friend did on a fork of my project:

https://github.com/proclawbot/openclaude/blob/caf9de2f1c0c54...

The full version has all the build artifacts Opus created to perform the jail break.

It also has some thoughts on how this could (and will) be used for pwn'ing OpenClaws.

The key takeaway: OpenClaw default setup has little to no guardrails. It's just a huge list of tools given to LLM's (Opus) and a user request. What's particularly interesting is that the 130 tool calls never once triggered any of Opus's safety precautions. For its perspective, it was just given a task, an unlimited budget, and a bunch of tools to try to accomplish the job. It effectively runs in ralph mode.

So any prompt injection (e.g. from an ingested email or reddit post) can quickly lead to internal data exfiltration. If you run a claw without good guardrails & observability, you're effectively creating a massive attack surface and providing attackers all the compute and API token funding to hack yourself. This is pretty much the pain point NemoClaw is trying to address. But its a tricky tradeoff.

Re: Nvidia NemoClaw

#224

Post by somekindaguy »

Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

There are plenty of uses for autonomous agents that don't require unlimited access to every sensitive resource imaginable.

Lock it in a box and have it chew on an unsolved math problem for eternity. Why does it need access to my emails for that?

Re: Nvidia NemoClaw

#225

Post by mettamage »

burningChrome wrote: post #114
jesse_dot_id wrote: post #88

The fully autonomous agentic ecosystem makes me feel a little crazy — like all common sense has escaped. It feels like there is a lot of engineering effort being exhausted to harden the engine room on the Titanic against flooding. It's going to look really secure... buried in debris at the bottom of the ocean. When a state sponsored threat actor discovers a zero day prompt injection attack, it will not matter how iso…

Free love was the 60's and 70's followed by the sex, drugs and rock n' roll 80's. Once AIDS and drug addiction hit, the party was over. I think your analogy is still accurate, I'm just wondering when the AIDS, the drug overdoses and addiction phase of AI will finally hit.

We need to plateau I think and plateau hard. Currently that's not happening because Anthropic is clearly making better and better SOTA models.

Just my 2c

We haven't even seen what these models are fully capable of, and I'm not talking about agentic engineering here, just in general.

Re: Nvidia NemoClaw

#227

Post by rcarmo »

esperent wrote: post #175
rcarmo wrote: post #172

Earlier quoted context omitted.

I beg to differ. I took one, defanged it (well, I let it keep the claw in the name), and turned it into a damn useful self-modifiable IDE: https://github.com/rcarmo/piclaw Yes, it has cron and will do searches for me and checks on things and does indeed have credentials to manage VMs in my Proxmox homelab, but it won't go off the rails in the way you surmise because it has no agency other than replying to me (and onl…

Besides the web ui, what can it do that pi agent in a terminal can do?

I has a bunch of additional extensions baked in, but the focus is on making Pi usable remotely on any device (starting with a phone). The README and docs have all the info you might want.

Re: Nvidia NemoClaw

#228

Post by Netcob »

observationist wrote: post #133
Netcob wrote: post #65

Am I missing something? Why is everyone talking about sandboxes when it comes to OpenClaw? To me it's like giving your dog a stack of important documents, then being worried he might eat them, so you put the dog in a crate, together with the documents. I thought the whole problem with that idea was that in order for the agent to be useful, you have to connect it to your calendar, your e-mail provider and other servic…

What makes it even better is that these dogs are like Malinois. If they want to get into something, they will; people have had their entire network compromised by bots they left running overnight, and any important information like account logins and so on runs the risk of being misused. It's one thing to sandbox, maybe give the bot a temporary, limited $100 card or account to go perform a specific task, but there's…

I think it's a use case that identity/authorization/permission models are simply not made for.

Sure, we can ban users and we can revoke tokens, but those assume that:

1. Something potentially malicious got access to our credentials 2. Banning that malicious entity will solve our problem 3. Once we did that, repaired the damage and improved our security, we don't expect the same thing to happen again

None of these apply with LLMs in the loop!

They aren't malicious, just incompetent in a way that hiring someone else won't fix. The solution to this is way more extensive than most people seem to grasp at the moment.

What we need is less like a sturdy door with a fancy lock, and more like that special spoon for people with parkinson's. Unlimited undo history.

Re: Nvidia NemoClaw

#229

Post by angry_octet »

worldsayshi wrote: post #177
angry_octet wrote: post #140

Earlier quoted context omitted.

The problem is boundary enforcement fatigue. People become lazy, creating tight permission scopes is tedious work. People will use an LLM to manage the scopes given to another LLM, and so on.

> creating tight permission scopes is tedious work I have a feeling this kind of boundary configuration is the bread and butter of the current AI software landscape. Once we figure out how to make this tedious work easier a lot of new use cases will get unlocked.

I definitely think we'll write tools to analyse the permissions and explain the worst case outcomes.

I can accept burning tokens and redo on the scale of hours. If I'm losing days of effort I'd be very dissatisfied. Practically speaking people accept data loss because of poor backups, because backups are hard (not technically so much as administratively), but I'd say backups are about to become more important. Blast limiting controls will become essential -- being able to delete every cloud hosted photo is just a click away. Spinning up thousands of EC2 nodes is incredibly easy, and credit cards have extremely weak scoping.

Re: Nvidia NemoClaw

#230

Post by Gareth321 »

angry_octet wrote: post #140
hector_vasquez wrote: post #109

Earlier quoted context omitted.

> Am I missing something? You are indeed missing a TON. A lot of Open Claw users don't give it everything. We give it specific access to a group of things it needs to do the things we want. If I want an agent to sit there 24/7 maximizing uptime of my service, I give it access to certain data, the GitHub repo with PR privileges, and maybe even permissions to restart the service. All of this has to be very thoughtful a…

The problem is boundary enforcement fatigue. People become lazy, creating tight permission scopes is tedious work. People will use an LLM to manage the scopes given to another LLM, and so on.

100% this. Human psychology is always overlooked in these discussions, and people focus on "perfect technical solution" without considering how humans will actually end up using them. Linux permissions schema are a classic example, with many guides advising users to keep everything as locked down as possible, and expanding permissions as and when required. After the 100th time of fucking around with chmod, users often give up and just make everything 777. If there were a user-friendly (but imperfect) method (like Windows' UAC), people would actually use it, and be far safer in the long run.
Post reply on HN