Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

31–40 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#31

Post by gmueckl »

g_delgado14 wrote: post #19
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> meta lead fail, Google award show fail Can I get some links / context on this please

The Meta thing is the AI safety lead experimenting with OpenClawd on her inbox and the bloody thing deciding to follow her inbox cleanup instructions by "starting fresh" - deleting the inbox contents. It's the very first link in the linked story.

Re: Sandboxes won't save you from OpenClaw

#32

Post by ramoz »

giancarlostoro wrote: post #26
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> literally go deploy it in a VM on any cloud Sure, but now you're adding extra cost, vs just running it locally. RAM is also heavily inflated thanks to Sam Altman investment magic.

Yea just an example. I personally have it running on a local Mac Mini (obviously aware that this isnt a perfect security measure, but I couldnt install on my laptop which has sensitive work access).

Re: Sandboxes won't save you from OpenClaw

#34

Post by dheera »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc

At the same time, let's not let the perfect be the enemy of good.

If you're piloting an aircraft, yeah, you should have perfection.

But if you're sending 34 e-mails and 7 hours of phone calls back and forth to fight a $5500 medical bill that insurance was supposed to pay for, I'd love for an AI bot to represent me. I'd absolutely LOVE for the AI bot to create so much piles of paperwork for these evil medical organizations so that they learn that I will fight, I'm hard to deal with, and pay for my stuff as they're supposed to. Threaten lawyers, file complaints with the state medical board, everything needs to be done. Create a mountain of paperwork for them until they pay that $5500. The next time maybe they'll pay to begin with.

Re: Sandboxes won't save you from OpenClaw

#35

Post by edf13 »

imiric wrote: post #25
edf13 wrote: post #3

Agree, that’s why we’re building grith.ai Sandboxing alone isn’t the right approach… a multi-faceted approach is what works. What we’ve found that does work is automation on the approval process but only with very strong guards in place… approval fatigue is another growing problem - users simply clicking approve on all requests.

Was grift.ai too expensive?

https://grith.ai/blog/what-grith-means

Re: Sandboxes won't save you from OpenClaw

#37

Post by bee_rider »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc

Isn’t this the whole point of the Claw experiment? They gave the LLMs permission to send emails on their behalf.

LLMs can not be responsibility-bearing structures, because they are impossible to actually hold accountable. The responsibility must fall through to the user because there is no other sentient entity to absorb it.

The email was supposed to be sent because the user created it on purpose (via a very convoluted process but one they kicked off intentionally).

Re: Sandboxes won't save you from OpenClaw

#38

Post by Animats »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> I’ve said similar in another thread[1]

Me too, at [1].

We need fine-grained permissions at online services, especially ones that handle money. It's going to be tough. An agent which can buy stuff has to have some constraints on the buy side, because the agent itself can't be trusted. The human constraints don't work - they're not afraid of being fired and you can't prosecute them for theft.

In the B2B environment, it's a budgeting problem. People who can spend money have a budget, an approval limit, and a list of approved vendors. That can probably be made to work. In the consumer environment, few people have enough of a detailed budget, with spending categories, to make that work.

Next upcoming business area: marketing to LLMs to get them to buy stuff.

[1] https://news.ycombinator.com/item?id=47132273

Re: Sandboxes won't save you from OpenClaw

#39

Post by kllrnohj »

latexr wrote: post #21
simonw wrote: post #13

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)

> I hope people don't do that, but I expect they probably do. How about the corporate vice president of Microsoft Word? https://www.omarknows.ai/p/meet-lobster-my-personal-ai-assis... https://www.linkedin.com/in/omarshahine It’s not going to be amusing when he gets hacked. Zero sense of responsibility.

I mean https://www.tomshardware.com/tech-industry/artificial-intell... just also happened.

Re: Sandboxes won't save you from OpenClaw

#40

Post by ramoz »

bee_rider wrote: post #37
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc Isn’t this the whole point of the Claw experiment? They gave the LLMs permission to send emails on their behalf. LLMs can not be responsibility-bearing structures, because they are impossible to actually hold accountable. The responsibility must fall through…

I'm not too sure what you're asking, but that last part, I think, is very key to the eventual delegation.

Where we can verify the lineage of the user's intent originally captured and validated throughout the execution process - eventually used as an authorization mechanism.

Google has a good thought model around this for payments (see verifiable mandates): https://cloud.google.com/blog/products/ai-machine-learning/a...

Post reply on HN