Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1-Click RCE to steal your Moltbot data and keys

depthfirst.com

Post reply on HN
Print view View original

31–40 of 78 posts

Re: 1-Click RCE to steal your Moltbot data and keys

#31

Post by decodebytes »

krackers wrote: post #14
decodebytes wrote: post #9

I rushed out nono.sh (the opposite of yolo!) in response to this and its already negated a few gateway attacks. It uses kernel-level security primitives (Landlock on Linux, Seatbelt on macOS) to create sandboxes where unauthorized operations are structurally impossible. API keys are also stored in apples secure enclave (or the kernel keyring in linux) , and injected at run time and zeroized from memory after use. The…

Is this better than using sandbox-exec (on mac) directly?

Hmm, I don't know about better, more convenient I guess. But if it floats your boat you could write out everything in the sb format and call sandbox_exec()!

Re: 1-Click RCE to steal your Moltbot data and keys

#33

Post by lxgr »

ethin wrote: post #20
lxgr wrote: post #10

Earlier quoted context omitted.

What I would have expected is prompt injection or other methods to get the agent to do something its user doesn't want it to, not regular "classical" attacks. At least currently, I don't think we have good ways of preventing the former, but the latter should be possible to avoid.

They are easy to avoid if you actually give a damn. Unfortunately, people who create these things don't, assuming they even know what even half of these attacks are in the first place. They just want to pump out something now now now and the mindset is "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle! It's just as bad as a lot of the vibe-coders I've seen. I l…

> "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle!

That is indeed the point. Moltbot reminds me a lot of the demon core experiment(s): Laughably reckless in hindsight, but ultimately also an artifact of a time of massive scientific progress.

> Is that gatekeeping of a sort? Maybe, but I'd rather have that

Serious question: What do you gain from people not being able to vibe code?

Re: 1-Click RCE to steal your Moltbot data and keys

#34

Post by chrisjj »

ethin wrote: post #20
lxgr wrote: post #10

Earlier quoted context omitted.

What I would have expected is prompt injection or other methods to get the agent to do something its user doesn't want it to, not regular "classical" attacks. At least currently, I don't think we have good ways of preventing the former, but the latter should be possible to avoid.

They are easy to avoid if you actually give a damn. Unfortunately, people who create these things don't, assuming they even know what even half of these attacks are in the first place. They just want to pump out something now now now and the mindset is "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle! It's just as bad as a lot of the vibe-coders I've seen. I l…

> They just want to pump out something now now now

Some people actually fell for "move fast and break things".

Re: 1-Click RCE to steal your Moltbot data and keys

#35

Post by cal85 »

avaer wrote: post #29
mentalgear wrote: post #4

Moltbot is a security nightmare, especially it's premise (tap into all your data sources) and the rapid uptake by inexperienced users makes it especially attractive for criminal networks.

Yes, there are already several criminal networks operating on it (transparently). I guess some consider this a feature.

How do you know this? Not disagreeing, just curious.

Re: 1-Click RCE to steal your Moltbot data and keys

#36

Post by avaer »

ethin wrote: post #13

Things like this are why I don't use AI agents like moltbot/openclaw. Security is just out the window with these things. It's like the last 50 years never happened.

No need to look back 50 years, people already forgot 2021 crypto security lapses that collectively cost billions. Or maybe the target audience here just doesn't care.

Re: 1-Click RCE to steal your Moltbot data and keys

#37

Post by ejcho »

ethin wrote: post #20
lxgr wrote: post #10

Earlier quoted context omitted.

What I would have expected is prompt injection or other methods to get the agent to do something its user doesn't want it to, not regular "classical" attacks. At least currently, I don't think we have good ways of preventing the former, but the latter should be possible to avoid.

They are easy to avoid if you actually give a damn. Unfortunately, people who create these things don't, assuming they even know what even half of these attacks are in the first place. They just want to pump out something now now now and the mindset is "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle! It's just as bad as a lot of the vibe-coders I've seen. I l…

I think with the advent of the AI gold rush, this is exactly the mentality that has proliferated throughout new AI startups.

Just ship anything and everything as fast as possible because all that matters is growth at all costs. Security is hard and it takes time, diligence, and effort and investors aren't going to be looking at the metric of "days without security incident" when flinging cash into your dumpster fire.

Re: 1-Click RCE to steal your Moltbot data and keys

#39

Post by avaer »

cal85 wrote: post #35
avaer wrote: post #29

Earlier quoted context omitted.

Yes, there are already several criminal networks operating on it (transparently). I guess some consider this a feature.

How do you know this? Not disagreeing, just curious.

The links have been posted to HN if you search.

https://moltroad.com/ comes to mind. The "top rated" on there describes itself as "trading in neural contraband".

That's in addition to all of the actual hijacking hacks that have been going on.

I'm not saying any of this is successful, but people are certainly trying.

Re: 1-Click RCE to steal your Moltbot data and keys

#40

Post by hugey010 »

lxgr wrote: post #33
ethin wrote: post #20

Earlier quoted context omitted.

They are easy to avoid if you actually give a damn. Unfortunately, people who create these things don't, assuming they even know what even half of these attacks are in the first place. They just want to pump out something now now now and the mindset is "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle! It's just as bad as a lot of the vibe-coders I've seen. I l…

> "we'll figure out all the problems later, I want my cake now now now now!" Maximum velocity! Full throttle! That is indeed the point. Moltbot reminds me a lot of the demon core experiment(s): Laughably reckless in hindsight, but ultimately also an artifact of a time of massive scientific progress. > Is that gatekeeping of a sort? Maybe, but I'd rather have that Serious question: What do you gain from people not bei…

Not who you're responding to, but I'm not a huge fan of vibe coding for 2 reasons: I don't want to use crappy software, and I don't want to inherit crappy software.
Post reply on HN