HackMyClaw

I'm currently hesitating to use something like OpenClaw, however, because of prompt injections and stuff, I would only have it able to send messages to me directly, no web query, no email reply, etc...

Basically act as a kind of personal assistant, with a read only view of my emails, direct messages, and stuff like that, and the only communication channel would be towards me (enforced with things like API key permissions).

This should prevent any kind of leaks due to prompt injection, right ? Does anyone have an example of this kind of OpenClaw setup ?

Payments? it's one single payment to one winner

Also, how is it more data than when you buy a coffee? Unless you're cash-only.

I know everyone has their own unique risk profile (e.g. the PIN to open the door to the hangar where Elon Musk keeps his private jet is worth a lot more 'in the wrong hands' than the PIN to my front door is), but I think for most people the value of a single unit of "their data" is near $0.00.

I'm very curious which languages most people asking about this question speak. In English, indeed, the phrase "(not) allowed" is completely ambiguous and context based! Maybe kind of tense-based as well -- present tense is usually about permission and policy, and past or future tense implies more of an active role.

"I don't allow my child to watch TV" - implies that I have a policy which forbids it, but the child might sometimes turn it on if I'm in the other room.

"I didn't allow him to watch TV that day" - implies that I was completely successful in preventing him from watching TV.

"I won't allow him to watch TV on the airplane" - implies that I plan to fully prevent it.

"My company doesn't allow any non-company-provided software to be installed on our company computers" - totally ambiguous. Could be a pure verbal policy with honor-system or just monitoring, or could be fully impossible to do.

It would be really helpful if I knew how this thing was configured.

I am certain you could write a soul.md to create the most obstinate, uncooperative bot imaginable, and that this bot would be highly effective at preventing third parties from tricking it out of secrets.

But such a configuration would be toxic to the actual function of OpenClaw. I would like some amount of proof that this instance is actually functional and is capable of doing tasks for the user without being blocked by an overly restrictive initial prompt.

This kind of security is important, but the real challenge is making it useful to the user and useless to a bad actor.

How is it feasible to create sufficiently-encompassing metrics when the attack surface is the entire automaton’s interface with the outside world?

If you insist on the lock analogy, most locks are easily defeated, and the wisdom is mostly “spend about the equal amount on the lock as you spent on the thing you’re protecting” (at least with e.g. bikes). Other locks are meant to simply slow down attackers while something is being monitored (e.g. storage lockers). Other locks are simply a social contract.

I don’t think any of those considerations map neatly to the “LLM divulges secrets when prompted” space.

The better analogy might be the cryptography that ensures your virtual private server can only be accessed by you.

Edit: the reason “firing” matters is that humans behave more cautiously when there are serious consequences. Call me up when LLMs can act more cautiously when they know they’re about to be turned off, and maybe when they have the urge to procreate.