3 ms·

The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.

by simonw 8mo ago

_pdp_ 8mo ago
There are secure alternatives but they are not making millions of dollars.
- simonw 8mo ago
  Which secure alternatives? I've not seen any yet.
  - _pdp_ 8mo ago
    Connecting telegram to an agent with a bunch of skills and access to isolated compute environment is largely a solved problem. I don't want to advertise but here but plenty of solutions to spin this up, including what we have built.
    - lemming 8mo ago
      But if it doesn’t have access to the network, then it’s just not very useful. And if it does, then it’s just a prompt injection away from exfiltrating your data, or doing something you didn’t expect (eg deleting all your emails).
    - feznyng 8mo ago
      That isn't secure is the issue, the more things you have it hooked up to the more havoc it can cause. The environment being locked down doesn't help when you're giving it access to potentially destructive actions. And once you remove those actions, you've neutered it.
      - _pdp_ 8mo ago
        The openclaw security model is the equivalent of running as root - i.e. full access. If that is insecure the inverse of it is running without any access as default and adding the things that you need. This is pretty much standard security 101. We don't need to reinvent the wheel.
        simonw 8mo ago
        The unsolved security challenge is how to give one of these agents access to private data while also enabling other features that could potentially leak data to an attacker (see the lethal trifecta.) That's the product people want - they want to use a Claw with the ability to execute arbitrary code and also give it access to their private data.
ares623 8mo ago
That's easy. We just keep pumping these things and remind everyone that there's no real consequences (at least to the people who actually matter) and what was previously agreed as super important and critical will eventually turn out to no longer be super important or critical. Lethal trifecta solved. Who cares if your agent is forwarding private and confidential emails to random people, if everyone else is doing it too. Syndrome from the Incredibles movie won, and we helped make it happen. In fact, we made sure of it.
aminebnk 8mo ago
[dead]
deaux 8mo ago
The same way as delivering a "truly secure human". Which is of course impossible, that's why spies, double agents and even triple agents exist and have succeeded to do their job. And that's despite an enormous number of guardrails meant to prevent exactly that. And simply "secure enough" doesn't help much either, because whereas a single human spy can only do so much damage, if an LLM is given access to everything in one way or another - which is the whole concept - then the potential damage is boundless.
vessenes 8mo ago
It seems almost impossible. I spent the weekend comparing nanoclaw to openclaw - nanoclaw is a slightly more secure version - containerized filesystem basically - and very popular. It's a) harder to setup, b) less functional out of the box, c) has almost exactly the same security risk surface -- either you hook it up to your email, comms, documents and give it API tokens, or you don't. If you do -- well, at least it can't delete your hard drive without turning full evil and looking for red pill type exploits that break the container -- but, it still has the same other security dynamics. Anyway, employing a very suspicious watcher that's hooked to the shell and API calls is probably the way forward. Can that thing be reasoned with / tricked?
- Tylast 8mo ago
  I'm on my 3rd "claw" variant (currently https://github.com/moltis-org/moltis https://github.com/moltis-org/moltis). I had the same issues you had. Moltis is better (at the moment).

The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.

by simonw 8mo ago

The first company to deliver a truly secure Claw is going to make millions of dollars. I have no idea how anyone is going to do that.

_pdp_ 8mo ago

There are secure alternatives but they are not making millions of dollars.

simonw 8mo ago
Which secure alternatives? I've not seen any yet.
- _pdp_ 8mo ago
  Connecting telegram to an agent with a bunch of skills and access to isolated compute environment is largely a solved problem. I don't want to advertise but here but plenty of solutions to spin this up, including what we have built.
  - lemming 8mo ago
    But if it doesn’t have access to the network, then it’s just not very useful. And if it does, then it’s just a prompt injection away from exfiltrating your data, or doing something you didn’t expect (eg deleting all your emails).
  - feznyng 8mo ago
    That isn't secure is the issue, the more things you have it hooked up to the more havoc it can cause. The environment being locked down doesn't help when you're giving it access to potentially destructive actions. And once you remove those actions, you've neutered it.
    - _pdp_ 8mo ago
      The openclaw security model is the equivalent of running as root - i.e. full access. If that is insecure the inverse of it is running without any access as default and adding the things that you need. This is pretty much standard security 101. We don't need to reinvent the wheel.
      - simonw 8mo ago
        The unsolved security challenge is how to give one of these agents access to private data while also enabling other features that could potentially leak data to an attacker (see the lethal trifecta.) That's the product people want - they want to use a Claw with the ability to execute arbitrary code and also give it access to their private data.

ares623 8mo ago

That's easy. We just keep pumping these things and remind everyone that there's no real consequences (at least to the people who actually matter) and what was previously agreed as super important and critical will eventually turn out to no longer be super important or critical. Lethal trifecta solved. Who cares if your agent is forwarding private and confidential emails to random people, if everyone else is doing it too. Syndrome from the Incredibles movie won, and we helped make it happen. In fact, we made sure of it.

aminebnk 8mo ago

[dead]

deaux 8mo ago

The same way as delivering a "truly secure human". Which is of course impossible, that's why spies, double agents and even triple agents exist and have succeeded to do their job. And that's despite an enormous number of guardrails meant to prevent exactly that. And simply "secure enough" doesn't help much either, because whereas a single human spy can only do so much damage, if an LLM is given access to everything in one way or another - which is the whole concept - then the potential damage is boundless.

vessenes 8mo ago

It seems almost impossible. I spent the weekend comparing nanoclaw to openclaw - nanoclaw is a slightly more secure version - containerized filesystem basically - and very popular. It's a) harder to setup, b) less functional out of the box, c) has almost exactly the same security risk surface -- either you hook it up to your email, comms, documents and give it API tokens, or you don't. If you do -- well, at least it can't delete your hard drive without turning full evil and looking for red pill type exploits that break the container -- but, it still has the same other security dynamics. Anyway, employing a very suspicious watcher that's hooked to the shell and API calls is probably the way forward. Can that thing be reasoned with / tricked?

Tylast 8mo ago
I'm on my 3rd "claw" variant (currently https://github.com/moltis-org/moltis https://github.com/moltis-org/moltis). I had the same issues you had. Moltis is better (at the moment).