Live data from Hacker News

Don't trust AI agents

nanoclaw.dev

51–60 of 211 posts

Re: Don't trust AI agents

#51
post #46

Earlier quoted context omitted.

Brook's law anno 2026: "Adding manpower to a late software project makes it later -- unless that manpower is AI, then you're golden!"

That law (formulated in the 70s, I’ll remind the reader) wasn’t true for at least couple decades now.

Why not? What changed? It seems like a human factors thing. New people have to get up to speed. Doers become trainers.

Re: Don't trust AI agents

#52

> OpenClaw has nearly half a million lines of code, 53 config files, and over 70 dependencies. This breaks the basic premise of open source security. Chromium has 35+ million lines, but you trust Google’s review processes. Most open source projects work the other way: they stay small enough that many eyes can actually review them. Nobody has reviewed OpenClaw’s 400,000 lines. This reminds me of a very common thing po…

LLMs are incredibly eager to write new code, rather than modifying or integrating with existing systems. I agree that context windows are too small currently for this to seem sustainable. Without reasonable architecture pure vibe coded software feels like it’s going to cap out at a certain size.

Re: Don't trust AI agents

#54
post #41

> OpenClaw has nearly half a million lines of code, 53 config files, and over 70 dependencies. This breaks the basic premise of open source security. Chromium has 35+ million lines, but you trust Google’s review processes. Most open source projects work the other way: they stay small enough that many eyes can actually review them. Nobody has reviewed OpenClaw’s 400,000 lines. This reminds me of a very common thing po…

Yeah, it’s pretty wild. Even pg is tweeting stuff like “An experienced programmer told me he's now using AI to generate a thousand lines of code an hour.“ https://x.com/paulg/status/2026739899936944495 Like if you had told pg to his face in (pre AI) office hours “I’m producing a thousand lines of code an hour”, I’m pretty sure he’d have laughed and pointed out how pointless that metric was?

It’s all virtual virtue signaling. If you were to say this shit in the office, you’d be walked out pretty fast.

Re: Don't trust AI agents

#55
post #19

Earlier quoted context omitted.

I did a cloc check on it and it does seem to have 800k lines of typescript. So unless they are vendoring dependencies it's actually as insane as it sounds.

Christ their repo is an absolute nightmare. There's new issues and PRs being posted practically every minute, and I assume 99% of them are from agents given the target demographic. Just full-auto vibeslop from all barrels 24/7. Even if we count the repos whole lifetime, including when it wasn't so active, the averages are still absurd. 96 days / (4,239+9,170) issues = one issue every 10 minutes 96 days / (5,082+10,22…

At least nobody can accuse them of not dogfooding enough.

Re: Don't trust AI agents

#57

This doesn’t really feel like enough guardrails to prevent the type of problems we’ve seen so far. For example an agent in a single container which has access to an email inbox, can still do a lot of damage if that agent goes off the rails. We agree this agent should not be trusted, yet the ideas proposed as a solution are insufficient. We need a fundamentally different approach. Also and this is just my ignorance ab…

Exactly! I installed nanoclaw to try to out. What is kinda crazy is that any extension like discord connection is done using a skill. A skill is a markdown file written in English to provide a step by step guide to an ai agent on how to do something. Basically, the extensions are written by claude code on the fly. Every install of nanoclaw is custom written code. There is nothing preventing the AI Agent from modifyin…

Yes and and they still have code examples in them so its not like it somehow doesn't count. Plus if you run the skill good luck bringing in changes from master later.

Re: Don't trust AI agents

#58
post #43

As someone who only coding agents at work, can someone describe their use case for claw type agent? What do you do with it?

I want to try one to be a bit of a personal coach. Remind me to do things and check in on goals. The memory / schedule / chat thing is enough and it wont need emails or anything more dangerous.

Re: Don't trust AI agents

#59
post #51

Earlier quoted context omitted.

That law (formulated in the 70s, I’ll remind the reader) wasn’t true for at least couple decades now.

Why not? What changed? It seems like a human factors thing. New people have to get up to speed. Doers become trainers.

Several related reasons working at once. The nature of work changed. The boundary between accidental and incidental complexity shifted (and it’s unclear whether this distinction still exists). Niche specializations within the field emerged. The way to structure and decompose projects changed dramatically (agile and stuff).

One pathological example: if you’re running a server-based product, quite often what stands between you and a new feature launch is literally couple of thousands of lines of Kubernetes YAML. Would adding someone who’s proficient in Kubernetes slow you down? Of course not.

One may say, hey, this is just the server-side Kubernetes-based development being insane, and I’ll say, the whole modern business of software development is like this.

Re: Don't trust AI agents

#60

> OpenClaw has nearly half a million lines of code, 53 config files, and over 70 dependencies. This breaks the basic premise of open source security. Chromium has 35+ million lines, but you trust Google’s review processes. Most open source projects work the other way: they stay small enough that many eyes can actually review them. Nobody has reviewed OpenClaw’s 400,000 lines. This reminds me of a very common thing po…

I asked Grok to rewrite your comment and it did it in 2400 words. I hope you know you'll be obsolete soon.
Post reply on HN