Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw privilege escalation vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

291–300 of 306 posts

Re: OpenClaw privilege escalation vulnerability

#291

Post by globular-toast »

tomhow wrote: post #284
globular-toast wrote: post #272

Earlier quoted context omitted.

I can't really think of a more on topic comment. The thread is about a security issue and the comment is about the quality of the codebase.

The comment is a generic vent about the project’s codebase and development approach, not an effort to engage in curious conversation about this vulnerability. Also, I consider it to be in breach of the guidelines about fulmination, swipes/sneers, and curmudgeonliness.

The comment doesn't even seem to contain opinion. It's simply objectively true. Let's be honest, you just didn't like the way it was directly calling out the author for writing shitty software. Responsibility is a thing and the author is displaying none of it.

Re: OpenClaw privilege escalation vulnerability

#292

Post by veganmosfet »

cornholio wrote: post #281
veganmosfet wrote: post #231

Earlier quoted context omitted.

You're welcome! My main takeaway message is: models (even opus4.6) do not follow security "instructions" reliably. In OpenClaw, they added security warnings, tags, random IDs... None of these countermeasures work reliably. Even sandboxing can be escaped (not in the classical sense using vulnerabilities, but using multi-layered prompt injection payload with natural language only)[0]. As soon as untrusted content is in…

What do you think about CaMeL and similar approaches? https://simonwillison.net/2025/Apr/11/camel/

Good question.

CaMeL is imho safer, but hard to implement into modern agents like OpenClaw. Its core idea is that a privileged LLM plans from the (trusted) user request only, while a restricted interpreter executes that plan (and enforces policies). Untrusted content is parsed separately and is not fed back into the privileged LLM.

Modern agents are useful exactly because they run a feedback loop (observe, reason, adapt, use tools, repeat). CaMeL breaks that loop, which improves security but makes it a poor fit for highly general agents like OpenClaw.

Re: OpenClaw privilege escalation vulnerability

#293

Post by tomhow »

globular-toast wrote: post #291
tomhow wrote: post #284

Earlier quoted context omitted.

The comment is a generic vent about the project’s codebase and development approach, not an effort to engage in curious conversation about this vulnerability. Also, I consider it to be in breach of the guidelines about fulmination, swipes/sneers, and curmudgeonliness.

The comment doesn't even seem to contain opinion. It's simply objectively true. Let's be honest, you just didn't like the way it was directly calling out the author for writing shitty software. Responsibility is a thing and the author is displaying none of it.

I don’t know or care whether it’s “objectively true”. That style of commenting, i.e., “calling out the author” is not what HN is for, regardless of the truthfulness of the comment. You’ve been around long enough to know that. HN is for curious conversation between hackers, i.e., people who like to build things. Attacking people for building things in some kind of “wrong” way is not cool here. “Responsibility” is not mentioned in the guidelines but kindness is.

Re: OpenClaw privilege escalation vulnerability

#294

Post by shaky-carrousel »

Xunjin wrote: post #62
paulhebert wrote: post #52

Earlier quoted context omitted.

Gonna be honest. I'd rather fight climate change than have people run LLMs unsecured

Yeah... The bill is already being paid. I wonder how the life quality of my nephew (and other children) of 5 years old today will be in the near future..

Decades, decades, telling us to save energy. Removing screensavers, replacing lightbulbs with ugly CFL first and color distorted LED lamps after. Trying to save energy to save the planet. And now, all of that to the toilet because some morons decided to play with talking robots.

Yesterday I did care. Today? Not so much. Welcome climate change, we fully deserve it.

Re: OpenClaw privilege escalation vulnerability

#295

Post by maccard »

BeetleB wrote: post #289
maccard wrote: post #255

Earlier quoted context omitted.

I’m not an openclaw user or a vibe coder but - the use case of OpenClaw is “give me access to all of your data, programs and information, and I will make decisions and do stuff without asking you permission”. It’s the MO of the project. Even if it was perfectly designed, I think it would have more RCEs by the fact that the Venn diagram of use of the app and high risk areas are a perfect circle

> the use case of OpenClaw is “give me access to all of your data, programs and information, and I will make decisions and do stuff without asking you permission”. It’s the MO of the project. You say that, but you also say > I’m not an openclaw user Your first statement makes the second one rather obvious. As I said some weeks ago, I've given up pointing out on HN: "Well, you could just not give it your data" only to…

The openclaw website[0] 's headline paragraph is:

> Clears your inbox, sends emails, manages your calendar, checks you in for flights. > All from WhatsApp, Telegram, or any chat app you already use.

The _entire point_ is "give me access to email, calendar, whatsapp, telegram, and I'll do your admin".

> "Well, you could just not give it your data"

This is the "you're holding it wrong"[1] argument

[0] https://openclaw.ai/.

[1] https://www.engadget.com/2010-06-24-apple-responds-over-ipho...

Re: OpenClaw privilege escalation vulnerability

#297

Post by tdeck »

shaky-carrousel wrote: post #294
Xunjin wrote: post #62

Earlier quoted context omitted.

Yeah... The bill is already being paid. I wonder how the life quality of my nephew (and other children) of 5 years old today will be in the near future..

Decades, decades, telling us to save energy. Removing screensavers, replacing lightbulbs with ugly CFL first and color distorted LED lamps after. Trying to save energy to save the planet. And now, all of that to the toilet because some morons decided to play with talking robots. Yesterday I did care. Today? Not so much. Welcome climate change, we fully deserve it.

You forgot cryptocurrency. At least some of this LLM stuff is genuinely useful.

Re: OpenClaw privilege escalation vulnerability

#298

Post by MarchApril »

asddubs wrote: post #223
williamstein wrote: post #94

Earlier quoted context omitted.

The current OpenClaw GitHub repo [1] contains 2.1 million lines of code, according to cloc, with 1.6M being typescript. It also has almost 26K commits. [1] https://github.com/openclaw/openclaw

wow, this repo seems to get something like 100 commits an hour based on just scrolling through the recent ones.

and none of them pass the hallucinated CI pipeline. I don't know if I want to drive flying cars if there's no guarantee of it not exploding in midair.

Re: OpenClaw privilege escalation vulnerability

#299

Post by plestik »

tomhow wrote: post #285
plestik wrote: post #220

Earlier quoted context omitted.

Thanks for explaining, is this mostly about replying directly to the person involved in the project? Compared to e.g. a comment in a thread about OpenClaw without replying directly to the creator? Just trying to figure out where the line is, I do think snark is a valid form of criticism sometimes but it's your house after all.

That comment would be a guidelines breach on HN, whether or not it was in reply to the project creator. It gives off just the kind of negativity that HN has always aimed to avoid. Even if we don't always succeed in avoiding it, the guidelines represent an ideal that we work to uphold every day. > Just trying to figure out where the line is It's not really about a line, it's about the qualitative style of discussion w…

For me I think this veers dangerously close to tone policing. I don't think you have to always be extremely civil in the face of what you consider moral bankruptcy. But I can also understand that it creates a vicious cycle so I can appreciate your position here.

Re: OpenClaw privilege escalation vulnerability

#300

Post by BeetleB »

maccard wrote: post #295
BeetleB wrote: post #289

Earlier quoted context omitted.

> the use case of OpenClaw is “give me access to all of your data, programs and information, and I will make decisions and do stuff without asking you permission”. It’s the MO of the project. You say that, but you also say > I’m not an openclaw user Your first statement makes the second one rather obvious. As I said some weeks ago, I've given up pointing out on HN: "Well, you could just not give it your data" only to…

The openclaw website[0] 's headline paragraph is: > Clears your inbox, sends emails, manages your calendar, checks you in for flights. > All from WhatsApp, Telegram, or any chat app you already use. The _entire point_ is "give me access to email, calendar, whatsapp, telegram, and I'll do your admin". > "Well, you could just not give it your data" This is the "you're holding it wrong"[1] argument [0] https://openclaw.…

> This is the "you're holding it wrong"[1] argument

But isn't that what you're doing?

Every single submission on HN has threads where people point out how it's useful to them without giving it access to much/any data. What is the benefit of pointing out what the homepage is saying other than to imply that we are holding it wrong?

And what does it say about you that you're going off based on marketing on a website rather than actual, competent tech users who actually weild the tool?

Until recently Gentoo boasted performance as a reason to use it. Yet as someone who's been in the community for over 20 years, I can assure you the majority of users didn't care about the performance and aren't optimizing their builds for it. Who cares what the site says?

Post reply on HN