Live data from Hacker News

OpenClaw is a security nightmare dressed up as a daydream

composio.dev

71–80 of 323 posts

Re: OpenClaw is a security nightmare dressed up as a daydream

#71
post #35
post #13

Earlier quoted context omitted.

The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.

There are secure alternatives but they are not making millions of dollars.

Which secure alternatives? I've not seen any yet.

Re: OpenClaw is a security nightmare dressed up as a daydream

#72
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Some of it is lack of imagination, but some of it is because many truly visionary examples would largely sound stupid to most of today's audience. Imagine it's 2007 and you're explaining how the smartphone will change society over the next 20 years:

- A photo sharing app will change restaurants, public spaces, and the entire travel industry across the world

- The smartphone will bring about regime change in Egypt, Tunisia, Lebanon, and other countries in ~4 years

- We'll replace taxis and hotels by getting rides and sharing homes with strangers

- Billions of people across the world will never need to own a desktop or laptop

- A short video sharing app will kill TV

- QR codes become relevant

Most of these would be a hard sell at the time.

Re: OpenClaw is a security nightmare dressed up as a daydream

#73

> In 2025, the number of data compromises in the United States stood at 3,322 cases. Meanwhile, over 278.83 million individuals were affected in the same year by data compromises, including data breaches, leakage, and exposure. While these are three different events, they have one thing in common. As a result of all three incidents, the sensitive data is accessed by an unauthorized threat actor. Source: https://www.s…

> It returns text free of ads

For now.

Re: OpenClaw is a security nightmare dressed up as a daydream

#74
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Not using OpenClaw - but I have a limited agent running that currently does a few things well. Morning Briefing: - it reads all my new email (multiple accounts and contexts), calendars (same accounts and contexts), slack (and other chat) messages (multiple slacks, matrix, discord, and so on), the weather reports, my open/closed recent to dos in a shared list across all my devices, my latest journal/log entries of thi…

>possible scheduling conflicts across the multiple calendars (that are not syncable due to corporate policies)

Doesn't this sorta defeat those policies though? Now all of your calendars are "synced" to a random unvalidated AI agent.

Re: OpenClaw is a security nightmare dressed up as a daydream

#75
post #59

Earlier quoted context omitted.

All of them. It's not like AI companies have managed to fix the security issues since last time they promised they had fixed all the hallucinations & accidental database deletions.

You know it’s open source code, right?

do you think anybody has actually read all 700k lines of the ai generated code?

Re: OpenClaw is a security nightmare dressed up as a daydream

#76
post #13
post #6

Yes, yes it is. And it's amaaaazing. We're going to have lots of sharp edges getting stuff like this secured, but it is not going to go away. Too useful.

The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.

That's easy. We just keep pumping these things and remind everyone that there's no real consequences (at least to the people who actually matter) and what was previously agreed as super important and critical will eventually turn out to no longer be super important or critical. Lethal trifecta solved. Who cares if your agent is forwarding private and confidential emails to random people, if everyone else is doing it too. Syndrome from the Incredibles movie won, and we helped make it happen. In fact, we made sure of it.

Re: OpenClaw is a security nightmare dressed up as a daydream

#77
post #17

Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing. There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

I think some folks want a legitmate personal assistant/secretary like ceo's and wealthy people have but ai. I think that's a good goal. Modern cells and pdas kinda fell short of "your own literal secretary" and I think people want that. Still we should continue pushing the boundaries beyond that.

Re: OpenClaw is a security nightmare dressed up as a daydream

#78
post #57

The overlap between the target audience for openclaw in spite of its attack surface, and the audience that considers a mac mini to be a sandbox while handing over the keys to their digital life is a Venn Eclipse.

How is a dedicated Mac not a sandbox?

Because the bit thats import is your context (ie email, credit card, privileged data), not the place where you do the execution.

Having a separate machine thats isolated is all well and good, but that doesn't protect you from someone convincing your openclaw to give them your credit card.

Re: OpenClaw is a security nightmare dressed up as a daydream

#79
post #33

Earlier quoted context omitted.

For example?

It would probably depend on the target audience. I was very impressed by Anthropic's swarm of agents building a C compiler earlier this year with 1000 PRs per hour. Easy to nitpick that it wasn't perfect, but it sure was impressive.

You mean trying and failing to build a C compiler. This isn't a very hard task to begin with (assuming you know compilers, and the models do), but it was made unrealistically easy by giving the agents thousands of tests written by humans over years (on top of a spec and a reference implementation, both of which the models were trained on), and the agents still failed to converge. I was actually surprised that they failed as this was the purest possible example of "just do the coding" (something that isn't achievable in real or more complex cases) and when I read the description I thought they made it too easy, and in a way that isn't representative of real software. My thought at that failure was that if agents can't even build a C compiler with so much preparation effort put into the test, then we have some ways to go. Indeed, once you work a lot with agents for a while you see that coding isn't really their strong suit (although they are impressive at debugging).

Re: OpenClaw is a security nightmare dressed up as a daydream

#80
post #56

Earlier quoted context omitted.

Indeed I have a bunch of apps that do most of these things, but it's the seamless integration I'm looking for - which may not need much AI at all (especially of the LLM kind), just some well directed machine learning and UI integration.

Home assistant automations?

I read this as the aspirational dream of computers actually doing what you want. Yes, you can absolutely spend a bunch of time to build out the personal automation that will proactively inform you of relevant events. Yet, that is likely to be a lot of finicky messing around that may be pretty fragile and dependent upon N APIs staying fixed.
Post reply on HN