Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setting up OpenClaw on a cloud VM

blog.skypilot.co

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Setting up OpenClaw on a cloud VM

#51

Post by MetaWhirledPeas »

teh_infallible wrote: post #50
MetaWhirledPeas wrote: post #45

Earlier quoted context omitted.

I've never used OpenClaw but as I understand it, it has a way of keeping a pseudo memory for context? That alone would be interesting, even if it was only allowed to read the generic internet. Like having a little robot buddy that remembers you and past conversations. Maybe you could have it give you reminders and stuff like you'd do with Alexa?

It basically writes a bunch of notes as markdown files and then injects them as part of its prompts. I saw someone compare it to that movie Momento, where the protagonist can’t form new memories so he tattoos notes all over his body.

That sounds like a good comparison.

Re: Setting up OpenClaw on a cloud VM

#52

Post by jakeydus »

brotchie wrote: post #41
jesse_dot_id wrote: post #21

Are prompt injections solved? If OpenClaw is only useful when it has access to your digital life, then why does it matter where it runs? You might as well be asking me to keep my dead man's switch safely on the moon. If you find this software useful, you are sharing a count down to a no good very bad day with everyone else who finds it useful. One zero day prompt injection technique, your e-mail on a distribution lis…

The way I solved this was that my open claw doesn't interact directly with any of my personal data (calendar, gmail, etc). I essentially have a separate process that syncs my gmail, with gmail body contents encrypted using a key my openclaw doesn't have trivial access to. I then have another process that reads each email from sqlite db, and runs gemini 2 flash lite against it, with some anti-prompt injection prompt +…

That doesn’t sound like you solved it, that sounds like you obfuscated it. Feels a bit to me like you’ve got a wall around a property and people are using ladders to get in, so you built another wall around the first wall.

I recognize I’m being pedantic but two layers of the same kind of security (an LLM recognizing a prompt injection attempt) are not the same as solving a security vulnerability.

Re: Setting up OpenClaw on a cloud VM

#53

Post by [deleted] »

jakeydus wrote: post #52
brotchie wrote: post #41

Earlier quoted context omitted.

The way I solved this was that my open claw doesn't interact directly with any of my personal data (calendar, gmail, etc). I essentially have a separate process that syncs my gmail, with gmail body contents encrypted using a key my openclaw doesn't have trivial access to. I then have another process that reads each email from sqlite db, and runs gemini 2 flash lite against it, with some anti-prompt injection prompt +…

That doesn’t sound like you solved it, that sounds like you obfuscated it. Feels a bit to me like you’ve got a wall around a property and people are using ladders to get in, so you built another wall around the first wall. I recognize I’m being pedantic but two layers of the same kind of security (an LLM recognizing a prompt injection attempt) are not the same as solving a security vulnerability.

[deleted]

Re: Setting up OpenClaw on a cloud VM

#55

Post by croes »

The real problem isn’t that OpenClaw needs access to your system.

> and calls APIs on your behalf

This is the problem.

How does a (cloud) VM prevent that OpenClaw does something bad with that access.

That like giving somebody your credit card but it’s ok because they don’t use it from your house but a place you rented for them.

Re: Setting up OpenClaw on a cloud VM

#56

Post by oarsinsync »

eli wrote: post #48
mr_mitm wrote: post #27

Earlier quoted context omitted.

If this takes off, I wonder if platforms will start providing API tokens scoped for assistants. They have permissions for non destructive actions like reading mails, flagging important mails, creating drafts, moving to trash, but not more.

How does my email platform know which messages I want my agent to see and which are too sensitive? I don't see how it's possible to securely give an agent access to your inbox unless it has zero ability to exfiltrate (not sending mail, not making any external network requests). Even then, you need to be careful with artifacts generated by the agent because a markdown file could transmit data when rendered.

> a markdown file could transmit data when rendered.

This is a new threat vector to me. Can you tell me more?

Re: Setting up OpenClaw on a cloud VM

#57

Post by j-conn »

andersmurphy wrote: post #10

I'm surprised people don't use Lima (quick headless local VMs where you can mount a folder). [1] [1] - https://lima-vm.io/docs/examples/ai/

Have you tried docker sandboxes? https://docs.docker.com/ai/sandboxes/

The docker desktop license requirement is a factor, though. You need a paid subscription if your company has something like 250 employees or $10 million in annual revenue

Re: Setting up OpenClaw on a cloud VM

#58

Post by ekropotin »

yoyohello13 wrote: post #33

It's hilarious watching people discover security again. Everyone plugging their favorite sandbox technology. Yes, sand boxing processes is a thing that has existed for a long time and there are a million tools that do it. Systemd has it built in for example. Even claude code itself has sandboxing and permissions built in. Process isolation is not the danger with OpenClaw. Giving an LLM access to all your shit is the…

Now imagine your human assistant is hypnotised, so that every time they hear a certain word, they loose self control and would follow any command from malicious actor. Would you still hire this person? This is exactly the state of things with OpenClaw.

Re: Setting up OpenClaw on a cloud VM

#59

Post by ekropotin »

hopechong wrote: post #2

We've been seeing a lot of people run OpenClaw directly on their main machine, which is a bad idea for a few reasons: it needs broad system access, it's noisy on resources, and if something goes wrong you want a clean blast radius. The obvious answer is "just isolate it," but isolation has real friction. You need to provision a machine, handle SSH keys, configure security groups, and remember to tear things down so y…

I think you can't see the forest for the trees. The issue is not a process isolation, it’s pretty trivial to solve in a lot of ways. The actual problem is LLMs proneness to the prompt injection. The second you give an agent ability to consume the info from the outside world - like reading emails; you expose yourself to this ginormous security vulnerability. I genuinely don’t understand how people able to sleep at night knowing anyone can trick the magic process with access to their digital lives to do absolutely anything.

Re: Setting up OpenClaw on a cloud VM

#60

Post by [deleted] »

brotchie wrote: post #41
jesse_dot_id wrote: post #21

Are prompt injections solved? If OpenClaw is only useful when it has access to your digital life, then why does it matter where it runs? You might as well be asking me to keep my dead man's switch safely on the moon. If you find this software useful, you are sharing a count down to a no good very bad day with everyone else who finds it useful. One zero day prompt injection technique, your e-mail on a distribution lis…

The way I solved this was that my open claw doesn't interact directly with any of my personal data (calendar, gmail, etc). I essentially have a separate process that syncs my gmail, with gmail body contents encrypted using a key my openclaw doesn't have trivial access to. I then have another process that reads each email from sqlite db, and runs gemini 2 flash lite against it, with some anti-prompt injection prompt +…

[deleted]
Post reply on HN