I can understand the thought process, although I do not agree with it, of using Clawdbot/Openclaw. I do not understand the thought process of downloading random human-readable instructions or "skills" (especially those pertaining to the manipulation of crypocurrency) and giving it to something in charge of your system without at least reading them first.
Malicious skills targeting Claude Code and Moltbot users
71–80 of 92 posts
Re: Malicious skills targeting Claude Code and Moltbot users
#72Earlier quoted context omitted.
I think most people are buying separate computers to run it on. This is a nice example of why you might want to do that. (Though they're still hooking it up to their entire digital life, which also doesn't seem very reassuring.)
> I think most people are buying separate computers to run it on. You must be joking.
Most tech enthusiasts I know have a myriad of computers laying around.
Spinning up a physical instance to try out some totally shady software is pretty standard stuff going back decades now.
Re: Malicious skills targeting Claude Code and Moltbot users
#73Submitters: "Please use the original title, unless it is misleading or linkbait." - https://news.ycombinator.com/newsguidelines.html
In this case the original title "ClawdBot Skills ganked all my crypto" was both linkbait and misleading, because (unless I missed it), the article describes no actual such incident.
Re: Malicious skills targeting Claude Code and Moltbot users
#74So many years of work in Software and Hardware Engineering to separate instructions from data. NX bit, ASLR, prepared statements etc.
All out the door.
Re: Malicious skills targeting Claude Code and Moltbot users
#75Earlier quoted context omitted.
no, i remembered it being a quote from some famous scientist, and googling a bit now I see it was stephen hawking: I think computer viruses should count as life ... I think it says something about human nature that the only form of life we have created so far is purely destructive. We've created life in our own image.
That’s fun! Looks like he said it at the 1994 Macworld Expo. I wonder if that inspired the Matrix quote a few years later.
perhaps, though also "humans are the plague" is a popular trope in science fiction. e.g. this one is from pratchett, in a conversation between rats in "the amazing maurice and his educated rodents":
You will have worked out that there is a race in this world which steals and kills and spreads disease and despoils what it cannot use, said the voice of Spider.
'Yes,' said Dangerous Beans. 'That's easy. It's called humanity.'
Re: Malicious skills targeting Claude Code and Moltbot users
#76Earlier quoted context omitted.
> I think most people are buying separate computers to run it on. You must be joking.
I have a separate removable SSD I can boot from to work with Claude in a dedicated environment. It is nice being able to offload environment set up and what not to the agent. That environment has wifi credentials for an isolated LAN. I am much more permissive of Claude on that system. I even automatically allow it WebSearch, but not WebFetch (much larger injection surface). It still cannot do anything requiring sudo.
Man, let me tell you about virtual machines, it’s gonna blow your mind.
Re: Malicious skills targeting Claude Code and Moltbot users
#77I have not been following this whole thing closely, but this is where my mind went as soon as I heard there was some overlap in the popularity of this new un-sandboxed agent and people who are into crypto. It's like if everyone who is into buying physical gold started doing a Tiktok challenge to post pictures of their houses and leave their front doors unlocked.
Makes me wonder how much overlap there is with the crowd who disables protections like immutable system images and SIP on macOS as a matter of course…
Re: Malicious skills targeting Claude Code and Moltbot users
#78I think we all knew this would happen quickly. Clearly there's a demand for personal AI agents - does anyone have thoughts on what it would take to make a more secure one? Would current services like email need to be redesigned to accommodate AI agents?
Re: Malicious skills targeting Claude Code and Moltbot users
#79I'm reminded of the quip that "mankind has already created life in their own likeness, and it's the computer virus"
Are you thinking of Agent Smith in the Matrix? > I'd like to share a revelation that I've had during my time here. It came to me when I tried to classify your species. I realized that you're not actually mammals. Every mammal on this planet instinctively develops a natural equilibrium with the surrounding environment, but you humans do not. You move to an area, and you multiply, and multiply, until every natural reso…
Great monologue, shaky biology.
Viruses do not multiply endlessly. Most viruses exist in stable ecological cycles.
Most viruses are beneficial to life. We complain about the few (and tiny minority of viruses) that infect humans and we do so from a selfish perspective, but forget about all the other that make life and evolution possible.
As a matter of fact evolution favors reduced lethality in many cases because wiping out hosts is bad for viral survival.
Agent Smith is way off on this one ...
Re: Malicious skills targeting Claude Code and Moltbot users
#80play stupid games, win stupid prizes.