Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

41–50 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#41

Post by bee_rider »

dheera wrote: post #34
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc At the same time, let's not let the perfect be the enemy of good. If you're piloting an aircraft, yeah, you should have perfection. But if you're sending 34 e-mails and 7 hours of phone calls back and forth to fight a $5500 medical bill that insurance was su…

The AI bot wouldn’t be representing you any more than your text editor would be. You would be using an AI bot to create a lot of text.

An AI bot can’t be held accountable, so isn’t able to be a responsibility-absorbing entity. The responsibility automatically falls through to the person running it.

Re: Sandboxes won't save you from OpenClaw

#42

Post by doctorwho42 »

dheera wrote: post #34
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc At the same time, let's not let the perfect be the enemy of good. If you're piloting an aircraft, yeah, you should have perfection. But if you're sending 34 e-mails and 7 hours of phone calls back and forth to fight a $5500 medical bill that insurance was su…

Is this before or after they have already implemented their own models to reply to your mountain of paper work with their own auto denial system

Re: Sandboxes won't save you from OpenClaw

#43

Post by chickensong »

ChicagoDave wrote: post #36

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

You're not alone

Re: Sandboxes won't save you from OpenClaw

#44

Post by logicx24 »

bee_rider wrote: post #41
dheera wrote: post #34

Earlier quoted context omitted.

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc At the same time, let's not let the perfect be the enemy of good. If you're piloting an aircraft, yeah, you should have perfection. But if you're sending 34 e-mails and 7 hours of phone calls back and forth to fight a $5500 medical bill that insurance was su…

The AI bot wouldn’t be representing you any more than your text editor would be. You would be using an AI bot to create a lot of text. An AI bot can’t be held accountable, so isn’t able to be a responsibility-absorbing entity. The responsibility automatically falls through to the person running it.

True. But it can help me create a lot of useful text so I can represent my self better.

I do wonder what happens when everyone is using agents for this, though. If AI produces the text and AI also reads the text, then do we even need the intermediary at all?

Re: Sandboxes won't save you from OpenClaw

#45

Post by observationist »

downsplat wrote: post #22

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c…

Current AI requires a human in the loop for anything non-trivial. Even the most used feature, coding, causes chaos without strict human oversight.

You can vibe-code a standalone repository, but any sort of serious work with real people working alongside bots, every last PR has to be reviewed, moderated, curated, etc.

Everything AI does that's not specifically intended to be a standalone, separate project requires that sort of intervention.

The safe way to do this is having a sandboxed test environment, high level visibility and a way to quickly and effectively review queued up actions, and then push those to a production environment. You need the interstitial buffer and a way of reverting back to the last known working state, and to keep the bot from having any control over what gets pushed to production.

Giving them realtime access to production is a recipe for disaster, whether it's your personal computer or a set of accounts built specifically for them or whatever, without your human in the loop buffer bad things will happen.

A lot of that can be automated, so you can operate confidently with high level summaries. If you can run a competent local AI and develop strict processes for review and summaries and so forth, kind of a defense in depth approach for agents, you can still get a lot out of ClawBot. It takes work and care.

Hopefully frameworks for these things start developing all of the safety security and procedure scaffolding we need, because OpenClaw and AI bots have gone viral. I'm getting all sorts of questions about how to set them up by completely non-technical people that would have trouble installing a sound system. Very cool to see, I'm excited for it, but there will definitely be some disasters this year.

Re: Sandboxes won't save you from OpenClaw

#47

Post by dgxyz »

ChicagoDave wrote: post #36

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

No you're not the only one.

I've got my popcorn ready.

Re: Sandboxes won't save you from OpenClaw

#48

Post by AnimalMuppet »

supermdguy wrote: post #7

One promising direction is building abstraction layers to sandbox individual tools, even those that don't have an API already. For example, you could build/vibe code a daemon that takes RPC calls to open Amazon in a browser, search for an item, and add it to your cart. You could even let that be partially "agentic" (e.g. an LLM takes in a list of search results, and selects the one to add to cart). If you let OpenCla…

Honest question: Could you define "agent" in this context?

Re: Sandboxes won't save you from OpenClaw

#49

Post by logicx24 »

supermdguy wrote: post #7

One promising direction is building abstraction layers to sandbox individual tools, even those that don't have an API already. For example, you could build/vibe code a daemon that takes RPC calls to open Amazon in a browser, search for an item, and add it to your cart. You could even let that be partially "agentic" (e.g. an LLM takes in a list of search results, and selects the one to add to cart). If you let OpenCla…

Yeah, agreed. This is probably what that middleware would look like. That's also where you'd add the human approval flow.

Re: Sandboxes won't save you from OpenClaw

#50

Post by logicx24 »

downsplat wrote: post #22

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c…

One insidious thing is whitelists. If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file, and the agent can then read that in future runs. That bit me once already.
Post reply on HN