Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sandboxes won't save you from OpenClaw

tachyon.so

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Sandboxes won't save you from OpenClaw

#61

Post by zahlman »

observationist wrote: post #45
downsplat wrote: post #22

I don't think openclaw can possibly be secured given the current paradigm. It has access to your personal stuff (that's its main use case), access to the net, and it gets untrusted third party inputs. That's the unfixable trifecta right there. No amount of filtering band-aid whack-a-mole is going to fix that. Sandboxes are a good measure for things like Claude Code or Amp. I use a bubblewrap wrapper to make sure it c…

Current AI requires a human in the loop for anything non-trivial. Even the most used feature, coding, causes chaos without strict human oversight. You can vibe-code a standalone repository, but any sort of serious work with real people working alongside bots, every last PR has to be reviewed, moderated, curated, etc. Everything AI does that's not specifically intended to be a standalone, separate project requires tha…

> Even the most used feature, coding, causes chaos without strict human oversight.

s/Even/Especially , I would think. Everyone's idea of how to get any decent performance out of an LLM for coding, entails allowing the code to be run automatically. Nominally so that the LLM can see the results and iterate towards a user-provided goal; but it's still untrusted code.

Re: Sandboxes won't save you from OpenClaw

#62

Post by jimlikeslimes »

programmarchy wrote: post #51
jejeyyy77 wrote: post #27

Earlier quoted context omitted.

eh, the point of the Mac is so that it can have its own iMessage and iCloud account

Then what’s the point of skills like apple-reminders? Isn’t the implication for a personal assistant styled OpenClaw setup that you allow it access to those tools on your behalf? Otherwise where is the benefit?

Maybe so you can communicate with it via tools like iMessage? Not so it can impersonate you. People will 100% be doing both though, security be damned.

Re: Sandboxes won't save you from OpenClaw

#63

Post by HWR_14 »

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

Why a cloud provider and not a local VM?

Re: Sandboxes won't save you from OpenClaw

#64

Post by bee_rider »

ramoz wrote: post #40
bee_rider wrote: post #37

Earlier quoted context omitted.

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc Isn’t this the whole point of the Claw experiment? They gave the LLMs permission to send emails on their behalf. LLMs can not be responsibility-bearing structures, because they are impossible to actually hold accountable. The responsibility must fall through…

I'm not too sure what you're asking, but that last part, I think, is very key to the eventual delegation. Where we can verify the lineage of the user's intent originally captured and validated throughout the execution process - eventually used as an authorization mechanism. Google has a good thought model around this for payments (see verifiable mandates): https://cloud.google.com/blog/products/ai-machine-learning/a.…

It was more of a rhetorical question.

Anyway, that payment system looks sort of interesting. It seems to have buy-in from some of the payment vendors, so it might become a real thing.

But, you can give a claw agent your credit card number and have it go through the typical human-facing shop fronts, impersonating you the whole time and never actually identifying itself as a model. If you’ve given it the accounts and passwords that let it do that, it should be possible to use the LLM to perform the transaction and buy something. It can just click all the buttons and input the numbers that humans do. What is the vendor going to do, disable the human-facing shopfront?

Re: Sandboxes won't save you from OpenClaw

#65

Post by crawshaw »

I do think sandboxes as a concept are oversold for agents. Yes we need VMs, a lot more VMs than ever before for all the new software. But the fundamental challenge of writing interesting software with agents is we have to grant them access to sensitive data and APIs. This lets them do damage. This is not something with a simple solution that can be written in code.

That said, we (exe.dev) have a couple more things planned on the VM side that we think agents need that no cloud provider is currently providing. Just don't call it a sandbox.

Re: Sandboxes won't save you from OpenClaw

#66

Post by ramoz »

HWR_14 wrote: post #63
ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

Why a cloud provider and not a local VM?

Just an example. I personally have it running on a local Mac Mini (obviously aware that this isnt a perfect security measure, but I couldnt install on my laptop which has sensitive work access).

Re: Sandboxes won't save you from OpenClaw

#67

Post by ChicagoDave »

AlienRobot wrote: post #55
ChicagoDave wrote: post #36

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

I genuinely don't know anymore. Another user linked this https://www.tomshardware.com/tech-industry/artificial-intell... and the irony is at satire levels. By the way, was that that movie a boy plays a game with an A.I. and the same A.I. starts a thermonuclear war or something like that? I think I watched the start when I was a kid but never really finished it.

Yes. Watch it. Excellent movie.

Re: Sandboxes won't save you from OpenClaw

#68

Post by ChicagoDave »

dgxyz wrote: post #47
ChicagoDave wrote: post #36

I’m late in looking at this OpenClaw thing. Maybe it’s because I’ve been in IT for 40 years or I’ve seen War Games, but who on earth gives an AI access to their personal life? Am I the only one that finds this mind bogglingly dumb?

No you're not the only one. I've got my popcorn ready.

It’s like the world has given script kiddies a way to pwn themselves.

Re: Sandboxes won't save you from OpenClaw

#69

Post by logicx24 »

zahlman wrote: post #60
logicx24 wrote: post #50

Earlier quoted context omitted.

One insidious thing is whitelists. If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file, and the agent can then read that in future runs. That bit me once already.

> If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file It wouldn't be inherently. Is this something that Docker does? Or perhaps something that was done by the code that was run? (Shouldn't it have stayed within that container?) But also, if it's not okay for the agent to know the API key permanently, why is it okay for the agent to have one-off use…

What I meant to say was, the agents (like Claude Code) often have a "Allow all instances of this command in the session," and that persists to a whitelist for that session. The mechanic here is actually just a prefix match, so `API_KEY=... diff_command` also matches, allowing the agent to reuse the key without asking me. This file also sticks around, so I had another agent read the whitelist and the conversation transcript and do other things automatically without approval.

> if it's not okay for the agent to know the API key permanently, why is it okay for the agent to have one-off use of something that requires the same key?

Read commands vs. write commands. I'm okay having the agent fetch info for me, but I want to approve any state changes.

Post reply on HN