Sandboxes won't save you from OpenClaw • Hacker News Board

Re: Sandboxes won't save you from OpenClaw

#71

Post by ramoz » Wed, Feb 25, 2026, 7:37 PM UTC

bee_rider wrote: post #64

ramoz wrote: post #40

Earlier quoted context omitted.

I'm not too sure what you're asking, but that last part, I think, is very key to the eventual delegation. Where we can verify the lineage of the user's intent originally captured and validated throughout the execution process - eventually used as an authorization mechanism. Google has a good thought model around this for payments (see verifiable mandates): https://cloud.google.com/blog/products/ai-machine-learning/a.…

It was more of a rhetorical question. Anyway, that payment system looks sort of interesting. It seems to have buy-in from some of the payment vendors, so it might become a real thing. But, you can give a claw agent your credit card number and have it go through the typical human-facing shop fronts, impersonating you the whole time and never actually identifying itself as a model. If you’ve given it the accounts and p…

Im not a fan of the payment use case & agree with your take, just a fan of the cryptographically verifiable mandate used throughout the process.

Re: Sandboxes won't save you from OpenClaw

#72

Post by lucasus » Wed, Feb 25, 2026, 7:38 PM UTC

Personally, I've created local relay/proxy for tool calls that I'm running with elevated permissions (I have to manually run it with my account). Every tool call goes through it, with deterministic code that checks for allowed actions. So AI doesn't have direct access to tools, and to secrets/keys needed by them. It only has access to the relay endpoint. Everything Dockerized ofc

Re: Sandboxes won't save you from OpenClaw

#73

Post by buremba » Wed, Feb 25, 2026, 7:43 PM UTC

Sandboxes are not enough but you can have more observability into what the agent is doing, only give it access to read-only data and let it take irreversible actions that you can recover from. Here are some tips from building sandboxed multi-tenant version of Openclaw, my startup: https://github.com/lobu-ai/lobu

1. Don't let it send emails from your personal account, only let it draft email and share the link with you.

2. Use incremental snapshots and if agent bricks itself (often does with Openclaw if you give it access to change config) just do /revert to last snapshot. I use VolumeSnapshot for lobu.ai.

3. Don't let your agents see any secret. Swap the placeholder secrets at your gateway and put human in the loop for secrets you care about.

4. Don't let your agents have outbound network directly. It should only talk to your proxy which has strict whitelisted domains. There will be cases the agent needs to talk to different domains and I use time-box limits. (Only allow certain domains for current session 5 minutes and at the end of the session look up all the URLs it accessed.) You can also use tool hooks to audit the calls with LLM to make sure that's not triggered via a prompt injection attack.

Last but last least, use proper VMs like Kata Containers and Firecrackers.

Re: Sandboxes won't save you from OpenClaw

#74

Post by dgxyz » Wed, Feb 25, 2026, 7:46 PM UTC

ChicagoDave wrote: post #68

dgxyz wrote: post #47

Earlier quoted context omitted.

No you're not the only one. I've got my popcorn ready.

It’s like the world has given script kiddies a way to pwn themselves.

Yep. Given me consultancy gigs until I retire cleaning up the disaster too.

Re: Sandboxes won't save you from OpenClaw

#75

Post by bob1029 » Wed, Feb 25, 2026, 7:58 PM UTC

I think something like OAuth might help here. Modeling each "claw" as a unique Client Id could be a reasonable pattern. They could be responsible for generating and maintaining their own private keys, issuing public certificates to establish identity, etc. This kind of architecture allows for you to much more precisely control the scope and duration of agent access. The certificates themselves could be issued, trusted & revoked on an autonomous basis as needed. You'd have to build an auth server and service providers for each real-world service, but this is a one-time deal and I think big players might start doing it on their own if enough momentum picks up in the OSS community.

Re: Sandboxes won't save you from OpenClaw

#76

Post by raincole » Wed, Feb 25, 2026, 8:14 PM UTC

> In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months.

Of course OpenClaw is not secure, but to be honest I believe most of the 'stories' where the it went wild are just made up. Especially the crypto one.

Re: Sandboxes won't save you from OpenClaw

#77

Post by Frannky » Wed, Feb 25, 2026, 8:23 PM UTC

I recently installed Zeroclaw instead of OpenClaw on a new VPS(It seems a little safer). It wasn’t as straightforward as OpenClaw, but it was easy to setup. I added skills that call endpoints and also cron jobs to trigger recurrent skills. The endpoints are hosted on a separate VPS running FastAPI (Hetzner, ~$12/month for two vps).

I’m assuming the claw might eventually be compromised. If that happens, the damage is limited: they could steal the GLM coding API key (which has a fixed monthly cost, so no risk of huge bills), spam the endpoints (which are rate-limited), or access a Telegram bot I use specifically for this project

Re: Sandboxes won't save you from OpenClaw

#78

Post by ramoz » Wed, Feb 25, 2026, 8:45 PM UTC

beepbooptheory wrote: post #54

ramoz wrote: post #12

I’ve said similar in another thread[1]: Sandboxes will be left in 2026. We don't need to reinvent isolated environments; not even the main issue with OpenClaw - literally go deploy it in a VM* on any cloud and you've achieved all same benefits. We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc ——- Unfortuentl…

What could "human in the loop" be here but just literally reading your own emails?

Stronger or novel planning capabilities, and interfaces. Same for verification and review capabilities (not being blind to everything, adding in assurance checkpoints where it makes sense), and automating the inbetween (e.g. hooks for deterministic automation/permissions).

Re: Sandboxes won't save you from OpenClaw

#79

Post by pkroll » Wed, Feb 25, 2026, 9:22 PM UTC

raincole wrote: post #76

> In 2026, so far, OpenClaw has deleted a user's inbox, spent 450k in crypto, installed uncountable amounts of malware, and attempted to blackmail an OSS maintainer. And it's only been two months. Of course OpenClaw is not secure, but to be honest I believe most of the 'stories' where the it went wild are just made up. Especially the crypto one.

Really? Why? I'd bet the opposite: the worst of the things happening with OpenClaw aren't being revealed.

Re: Sandboxes won't save you from OpenClaw

#80

Post by dheera » Wed, Feb 25, 2026, 9:38 PM UTC

bee_rider wrote: post #41

dheera wrote: post #34

Earlier quoted context omitted.

> We need to know if the email being sent by an agent is supposed to be sent and if an agent is actually supposed to be making that transaction on my behalf. etc At the same time, let's not let the perfect be the enemy of good. If you're piloting an aircraft, yeah, you should have perfection. But if you're sending 34 e-mails and 7 hours of phone calls back and forth to fight a $5500 medical bill that insurance was su…

The AI bot wouldn’t be representing you any more than your text editor would be. You would be using an AI bot to create a lot of text. An AI bot can’t be held accountable, so isn’t able to be a responsibility-absorbing entity. The responsibility automatically falls through to the person running it.

The bot doesn't need to be held accountable. It only needs to spew out the right text that triggers humans to rightfully transfer accountability from me to the insurance company.