Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

51–60 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#51

Post by programmarchy »

jejeyyy77 wrote: post #27
simonw wrote: post #13

I do find it amusing when I consider people buying a Mac Mini for OpenClaw to run on as a security measure... and then granting OpenClaw on that Mac Mini access to their email and iMessage and suchlike. (I hope people don't do that, but I expect they probably do.)

eh, the point of the Mac is so that it can have its own iMessage and iCloud account

Then what’s the point of skills like apple-reminders? Isn’t the implication for a personal assistant styled OpenClaw setup that you allow it access to those tools on your behalf? Otherwise where is the benefit?

Re: Sandboxes won't save you from OpenClaw

#53

Post by dgxyz »

logicx24 wrote: post #50
downsplat wrote: post #22

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c…

One insidious thing is whitelists. If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file, and the agent can then read that in future runs. That bit me once already.

That's a shit show in a shit show there!

Re: Sandboxes won't save you from OpenClaw

#54

Post by beepbooptheory »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

What could "human in the loop" be here but just literally reading your own emails?

Re: Sandboxes won't save you from OpenClaw

#55

Post by AlienRobot »

ChicagoDave wrote: post #36

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

I genuinely don't know anymore. Another user linked this https://www.tomshardware.com/tech-industry/artificial-intell... and the irony is at satire levels.

By the way, was that that movie a boy plays a game with an A.I. and the same A.I. starts a thermonuclear war or something like that? I think I watched the start when I was a kid but never really finished it.

Re: Sandboxes won't save you from OpenClaw

#56

Post by throwpoaster »

logicx24 wrote: post #52
throwpoaster wrote: post #46

OpenClaw running Opus is intelligent, careful, polite. It has a lot to do with the underlying model. And if you don’t connect it to stuff, it can’t connect.

But if I don't connect it to stuff, then what is it useful for?

As long as you’re careful, you can let it meat puppet you (go here do this).

You give it its own accounts, say email and calendar, and have it send you drafts and invite you to stuff. It doesn’t need your email and calendar.

Actually, I just asked my guy and he suggests just generating local ICS files. Even safer.

Re: Sandboxes won't save you from OpenClaw

#57

Post by tonymet »

There are three ways to authorize agents that could work (1) scoped roles (2) PAM / entitlements or (3) transaction approval

The first two are common. With transaction approval the agent would operate on shadow pages / files and any writes would batch in a transaction pending owner approval.

For example, sending emails would batch up drafts and the owner would have to trigger the approval flow to send. Modifying files would copy on write and the owner would approve the overwrite. Updating social activity would queue the posts and the owner would approve the publish.

it's about the same amount of work as implementing undo or a tlog , it's not too complex and given that AI agents are 10000 faster than humans, the big companies should have this ready in a few days.

The problem with scoped roles and PAM is that no reasonable user can know the future and be smart about managing scoped access. But everyone is capable of reading a list of things to do and signing off on them.

Re: Sandboxes won't save you from OpenClaw

#58

Post by b112 »

ramoz wrote: post #40
bee_rider wrote: post #37

Earlier quoted context omitted.

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc Isn’t this the whole point of the Claw experiment? They gave the LLMs permission to send emails on their behalf. LLMs can not be responsibility-bearing structures, because they are impossible to actually hold accountable. The responsibility must fall through…

I'm not too sure what you're asking, but that last part, I think, is very key to the eventual delegation. Where we can verify the lineage of the user's intent originally captured and validated throughout the execution process - eventually used as an authorization mechanism. Google has a good thought model around this for payments (see verifiable mandates): https://cloud.google.com/blog/products/ai-machine-learning/a.…

I see a lot of discussion on that page about APIs and sign offs, but the real sign-off is installing anything on your computer, and then doing things.

The liability is yours.

Claude messes up? So sad, too bad, you pay.

That's where the liability need sit.

And one point on this is, every act of vibe coding is a lawsuit waiting to happen. But even every act by a company is too.

An example is therac-25:

https://en.wikipedia.org/wiki/Therac-25

Vibe coding is still coding. You're giving instructions on program flow, logic, etc. My rant here is, I feel people think that if the code is bad, it's someone else's fault.

But is it?

Re: Sandboxes won't save you from OpenClaw

#59

Post by 2gremlin181 »

hackingonempty wrote: post #2

Yes we need capability based auth on the systems we use. I'm sure we will get them but only for use with in-house agents, i.e. GMail and Google Pay will get agentic capabilities but they'll only work with Gemini, and only Siri will be able to access your Apple cloud stuff without handing over access to everything, and if you want your grocery shopping handled for you, Rufus is there. Maybe you will be able to link Co…

I do not forsee GoogleClaw, MetaClaw, and AppleClaw all playing well with each other. Everyone will have their own walled garden and we will be no better off than we are now.

Re: Sandboxes won't save you from OpenClaw

#60

Post by zahlman »

logicx24 wrote: post #50
downsplat wrote: post #22

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c…

One insidious thing is whitelists. If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file, and the agent can then read that in future runs. That bit me once already.

> If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file

It wouldn't be inherently. Is this something that Docker does? Or perhaps something that was done by the code that was run? (Shouldn't it have stayed within that container?)

But also, if it's not okay for the agent to know the API key permanently, why is it okay for the agent to have one-off use of something that requires the same key? Did it actually craft a Bash command line with the API key set and request to run it; or was it just using a tool that ends up with that command?

Post reply on HN