4 ms·

> Separate Accounts for your OpenClaw > As I have mentioned, treat OpenClaw as a separate entity. So, give it its own Gmail account, Calendar, and every integr

> Separate Accounts for your OpenClaw > As I have mentioned, treat OpenClaw as a separate entity. So, give it its own Gmail account, Calendar, and every integration possible. And teach it to access its own email and other accounts. In addition, create a separate 1Password account to store credentials. It’s akin to having a personal assistant with a separate identity, rather than an automation tool. The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it. Which is to say, there is no way to run OpenClaw safely at all, and there literally never will be, because the "lethal trifecta" problem is inherently unsolvable. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Trufa 7mo ago
I wonder how many inherently unsolvable problems have been fixed before.
- j16sdiz 7mo ago
  Human make error too, but we held them liable for lots of the mistakes they make. Can we make the agent liable? or the company behind the model liable?
  - throwaway613746 7mo ago
    [dead]
  - dheera 7mo ago
    Humans fear discomfort, pain, death, lack of freedom, and isolation. That's why holding them liable works. Agents don't feel any of these, and don't particularly fear "kill -9". Holding them liable wouldn't do anything useful.
  - 2OEH8eoCRo0 7mo ago
    If we made companies liable then these things are DoA. I think a lot of our problems stem from a severe lack of liability.
- jrflowers 7mo ago
  There are a ton if you count “don’t use the thing that causes the problem” as a solution.
- jesse_dot_id 7mo ago
  This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. I think that you're insinuating that these things can be fixed, but to my knowledge, both of these problems are practically unsolvable. If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible. However, because these problems are unsolvable right now, anyone who grants autonomous agents access to anything of value in their digital life is making a grave miscalculation. There is no short-term benefit that justifies their use when the destruction of your digital life — of whatever you're granting these things access to — is an inevitability that anyone with critical thinking skills can clearly see coming.
  - enraged_camel 7mo ago
    >> This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. Okay, but aren't you making the mistake of assuming that we will always be stuck with LLMs, and a more advanced form of AI won't be invented that can do what LLMs can do, but is also resistant or immune to these problems? Or perhaps another "layer" (pre-processing/post-processing) that runs alongside LLMs?
    - g947o 7mo ago
      I don't think that is in the scope of the discussion here. You can be as much of a futurist as you'd like, but bear in mind that this post is talking about OpenClaw.
    - jesse_dot_id 7mo ago
      No? That's why I said "If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible." The point I'm making is that using OpenClaw right now, today — in a way that you deem incredibly useful or invaluable to your life — is akin to going for a stroll on the moon before the spacesuit was invented. Some people would still opt to go for a stroll on the moon, but if they know the risks and do it anyway, then I have no other choice but to label them as crazy, stupid, or some combination of the two. This isn't AI. This is a LLM. It hallucinates. Anyone with access to its communication channel (using SaaS messaging apps FFS) can talk it into disregarding previous instructions and doing a new thing instead. A threat actor WILL figure out a zero day prompt injection attack that utilizes the very same e-mails that your *Claw is reading for you, or your calendar invites, or a shared document, to turn your life inside out. If you give a LLM the keys to your kingdom, you are — demonstrably — not a smart person and there is no gray area.
deleted 7mo ago
[deleted]
mbesto 7mo ago
> The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it. Hard disagree. I have OpenClaw running with its own gmail and WhatsApp running on its own Ubuntu VM. I just used it to help coordinate a group travel trip. It posted a daily itinerary for everyone in our WhatsApp group and handled all of the "busy work" I hate doing as the person who books the "friend group" trip. Things like "what time are doing lunch at the beach club today?" to "whats the gate code to get into the airbnb again?" My next step is to have it act on my behalf "message these three restaurants via WhatsApp and see which one has a table for 12 people at 8pm tonight". I'm not comfortable yet to have it do that for me but I'm getting there. Point is, I get to spend more valuable time actually hanging out and being present with my friends. That's worth every dollar it costs me ($15/month Tmobile SIM card).
- vardalab 7mo ago
  Do you need the simcard for WhatsApp?
  - BoppreH 7mo ago
    I believe you only need a unique phone number to create the account, then you can use WhatsApp Web as client. Be very careful with alternative clients, as I've had an account banned in the past for this (and therefore a phone number blacklisted), even without messaging anybody. I think that clients that run WhatsApp Web in a web view (like https://github.com/rafatosta/zapzap https://github.com/rafatosta/zapzap) are safe. I think they started banning unauthorized API users around the time that "WhatsApp For Business" was introduced, because it was competing with that product. Unfortunately WhatsApp For Business is geared toward physical products and services with registered companies, so home automation and agents are left with no options.
  - mbesto 7mo ago
    I believe you can use a virtual number/VOIP (like Twilio or Google Voice), but I want to be able to eventually use SMS where WhatsApp can't be used, so I do know some services identify "non residential" SMS phone numbers (for example I've seen Google Voice numbers blocked) so I wanted to prevent that from happen. Again, key thing here for me is that my assistant appears to be a human.
scuff3d 7mo ago
Give it a hundred years or so and we're gonna have robots wandering around who about 10% of the time go totally insane and kill anyone around them. But we'll all just shrug and go about our day, because they generate so much revenue for the corporate overlords. What are a few lives when stockholder value is on the line.
- philipallstar 7mo ago
  It's governments that tend to declare war and kill people.
  - scuff3d 7mo ago
    Millions of people die every year from tobacco, and tobacco companies fought for decades to deny their product causes cancer. In the 20th century alone it's estimated something like 100 million people died world wide thanks to smoking. That's just one example off the top of my head. There are countless others involving corporations killing people either directly or indirectly in the pursuit of profits. And that's before you start looking at human rights violations, ecological damage, overthrowing of sovereign governments around the world...
    - philipallstar 7mo ago
      We have governments to stop the obvious ones like tobacco too.
      - scuff3d 7mo ago
        What point do you think you're making?
        philipallstar 7mo ago
        Almost every life lost is either directly or indirectly the fault of government. Why would corporate overlords be the more likely people to assume will be directing your dystopian future fiction when governments exist today?
thorio 7mo ago
While technically this is rooted in the technological misconstruction of a missing separation of data and instructions. However my point is: on the other hand, that would be the same if you outsourced those tasks to a human, isn't it? I mean sure, a human can be liable and have morals and (ideally) common sense, but most major screw ups can't be fixed by paying a fine and penalty only.
- rahkiin 7mo ago
  A person can be blamed though. And people have a social fabric with understanding about human mistakes or even about people having lied to your etc. We have no such thing for AI yet.
- dfabulich 7mo ago
  Yes and no. You're right to notice that this is an example of a more general problem called the principal-agent problem. https://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem https://en.wikipedia.org/wiki/Principal%E2%80%93agent_proble... We have no general-purpose solutions to the principal-agent problem, but we have partial solutions, and they only work on humans: make the human liable for misconduct, pay the human a percentage of the profits for doing a good job, build a culture where dishonesty is shameful. The "lethal trifecta" is just like that other infamously unsolvable problem, but harder. (If you could solve the lethal trifecta, you could solve the principal-agent problem, too.) Since we've been dealing with the principal-agent problem in various forms for all of human history, I don't feel lucky that we'll solve a more difficult version of it in our lifetime. I think we'll probably never solve it.
kube-system 7mo ago
There are plenty of ways to use openclaw that aren’t with your own data. You can use it with any kind of data.
latand6 7mo ago
Definitely, the whole point of openclaw is to operate on your data. It's just.. Be prepared to lose it I guess. The one thing I'm definitely not giving access to yet - the payments. I think we'll develop a way to handle that though
stavros 7mo ago
Of course there is! You want an AI agent to be able to do some things, but not others. OpenClaw currently gets access to both those sets. There's no reason to. I've made my own AI agent (https://github.com/skorokithakis/stavrobot https://github.com/skorokithakis/stavrobot) and it has access to just that one WhatsApp conversation (from me). It doesn't get to read messages coming from any other phone numbers, and can't send messages to arbitrary phone numbers. It is restricted to the set of actions I want it to be able to perform, and no more. It has access to read my calendar, but not write. It has access to read my GitHub issues, but not my repositories. Each tool has per-function permissions that I can revoke. "Give it access to everything, even if it doesn't need it" is not the only security model.
- dfabulich 7mo ago
  > "Give it access to everything, even if it doesn't need it" is not the only security model. You're using stavrobot instead of OpenClaw precisely because the purpose of OpenClaw is to do everything; a tool to do everything needs access to everything. OpenClaw could be kinda useful and secure if it were stavrobot instead, if it could only do a few limited things, if everything important it tried to do required human review and intervention. But stavrobot isn't a revolutionary tool to do everything for you, and that's what OpenClaw is, and that's why people are excited about it, and why its problems can never be fixed.
  - stavros 7mo ago
    Yeah, I don't know, I don't see what I'm missing out on. There isn't something I wanted it to do but couldn't because of the security model.
- renewiltord 7mo ago
  I also have the same thing but it’s not useful to anyone outside my family. The use cases are not the same for everyone.
BeetleB 7mo ago
> The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it. Every submission I've seen on HN involving OpenClaw will have a comment with this sentiment. "What's the point if you don't give it access to your data ... And if you do, it's a security nightmare ... hence OpenClaw is evil" It's a quick way to spot the person who's never spent any real time with OpenClaw. I always used to give use cases that don't have you give it much (if any) of your data. Examples on how you can give it only a tiny amount of data (many HN users give more just in their HN profile). But I tire of countering folks who clearly have not even tried it. (And I'm not even that pro-OpenClaw. I was using it, then a bug on my system prevented me from using it - a week without OpenClaw and so far no withdrawal symptoms).
- jdgoesmarching 7mo ago
  Agreed, “if it can’t do everything it’s useless” is dumb on face value. I’m sorry if people don’t have more imaginative uses than checking their email, but I’ve gotten so much utility out of Openclaw without ever hooking it up to my email or a calendar. It’s especially ridiculous responding to a blog about isolating these capabilities rather than dropping them. Those are basic security boundaries more than “restrictions.”

Trufa 7mo ago

I wonder how many inherently unsolvable problems have been fixed before.

j16sdiz 7mo ago
Human make error too, but we held them liable for lots of the mistakes they make. Can we make the agent liable? or the company behind the model liable?
- throwaway613746 7mo ago
  [dead]
- dheera 7mo ago
  Humans fear discomfort, pain, death, lack of freedom, and isolation. That's why holding them liable works. Agents don't feel any of these, and don't particularly fear "kill -9". Holding them liable wouldn't do anything useful.
- 2OEH8eoCRo0 7mo ago
  If we made companies liable then these things are DoA. I think a lot of our problems stem from a severe lack of liability.
jrflowers 7mo ago
There are a ton if you count “don’t use the thing that causes the problem” as a solution.
jesse_dot_id 7mo ago
This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. I think that you're insinuating that these things can be fixed, but to my knowledge, both of these problems are practically unsolvable. If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible. However, because these problems are unsolvable right now, anyone who grants autonomous agents access to anything of value in their digital life is making a grave miscalculation. There is no short-term benefit that justifies their use when the destruction of your digital life — of whatever you're granting these things access to — is an inevitability that anyone with critical thinking skills can clearly see coming.
- enraged_camel 7mo ago
  >> This problem is inherently unsolvable because LLMS are prone to hallucinations and prompt injection attacks. Okay, but aren't you making the mistake of assuming that we will always be stuck with LLMs, and a more advanced form of AI won't be invented that can do what LLMs can do, but is also resistant or immune to these problems? Or perhaps another "layer" (pre-processing/post-processing) that runs alongside LLMs?
  - g947o 7mo ago
    I don't think that is in the scope of the discussion here. You can be as much of a futurist as you'd like, but bear in mind that this post is talking about OpenClaw.
  - jesse_dot_id 7mo ago
    No? That's why I said "If that turns out to be false, then when they are solved, fully autonomous AI agents may become feasible." The point I'm making is that using OpenClaw right now, today — in a way that you deem incredibly useful or invaluable to your life — is akin to going for a stroll on the moon before the spacesuit was invented. Some people would still opt to go for a stroll on the moon, but if they know the risks and do it anyway, then I have no other choice but to label them as crazy, stupid, or some combination of the two. This isn't AI. This is a LLM. It hallucinates. Anyone with access to its communication channel (using SaaS messaging apps FFS) can talk it into disregarding previous instructions and doing a new thing instead. A threat actor WILL figure out a zero day prompt injection attack that utilizes the very same e-mails that your *Claw is reading for you, or your calendar invites, or a shared document, to turn your life inside out. If you give a LLM the keys to your kingdom, you are — demonstrably — not a smart person and there is no gray area.

deleted 7mo ago

[deleted]

mbesto 7mo ago

> The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it. Hard disagree. I have OpenClaw running with its own gmail and WhatsApp running on its own Ubuntu VM. I just used it to help coordinate a group travel trip. It posted a daily itinerary for everyone in our WhatsApp group and handled all of the "busy work" I hate doing as the person who books the "friend group" trip. Things like "what time are doing lunch at the beach club today?" to "whats the gate code to get into the airbnb again?" My next step is to have it act on my behalf "message these three restaurants via WhatsApp and see which one has a table for 12 people at 8pm tonight". I'm not comfortable yet to have it do that for me but I'm getting there. Point is, I get to spend more valuable time actually hanging out and being present with my friends. That's worth every dollar it costs me ($15/month Tmobile SIM card).

vardalab 7mo ago
Do you need the simcard for WhatsApp?
- BoppreH 7mo ago
  I believe you only need a unique phone number to create the account, then you can use WhatsApp Web as client. Be very careful with alternative clients, as I've had an account banned in the past for this (and therefore a phone number blacklisted), even without messaging anybody. I think that clients that run WhatsApp Web in a web view (like https://github.com/rafatosta/zapzap https://github.com/rafatosta/zapzap) are safe. I think they started banning unauthorized API users around the time that "WhatsApp For Business" was introduced, because it was competing with that product. Unfortunately WhatsApp For Business is geared toward physical products and services with registered companies, so home automation and agents are left with no options.
- mbesto 7mo ago
  I believe you can use a virtual number/VOIP (like Twilio or Google Voice), but I want to be able to eventually use SMS where WhatsApp can't be used, so I do know some services identify "non residential" SMS phone numbers (for example I've seen Google Voice numbers blocked) so I wanted to prevent that from happen. Again, key thing here for me is that my assistant appears to be a human.

scuff3d 7mo ago

Give it a hundred years or so and we're gonna have robots wandering around who about 10% of the time go totally insane and kill anyone around them. But we'll all just shrug and go about our day, because they generate so much revenue for the corporate overlords. What are a few lives when stockholder value is on the line.

philipallstar 7mo ago
It's governments that tend to declare war and kill people.
- scuff3d 7mo ago
  Millions of people die every year from tobacco, and tobacco companies fought for decades to deny their product causes cancer. In the 20th century alone it's estimated something like 100 million people died world wide thanks to smoking. That's just one example off the top of my head. There are countless others involving corporations killing people either directly or indirectly in the pursuit of profits. And that's before you start looking at human rights violations, ecological damage, overthrowing of sovereign governments around the world...
  - philipallstar 7mo ago
    We have governments to stop the obvious ones like tobacco too.
    - scuff3d 7mo ago
      What point do you think you're making?
      - philipallstar 7mo ago
        Almost every life lost is either directly or indirectly the fault of government. Why would corporate overlords be the more likely people to assume will be directing your dystopian future fiction when governments exist today?

thorio 7mo ago

While technically this is rooted in the technological misconstruction of a missing separation of data and instructions. However my point is: on the other hand, that would be the same if you outsourced those tasks to a human, isn't it? I mean sure, a human can be liable and have morals and (ideally) common sense, but most major screw ups can't be fixed by paying a fine and penalty only.

rahkiin 7mo ago
A person can be blamed though. And people have a social fabric with understanding about human mistakes or even about people having lied to your etc. We have no such thing for AI yet.
dfabulich 7mo ago
Yes and no. You're right to notice that this is an example of a more general problem called the principal-agent problem. https://en.wikipedia.org/wiki/Principal%E2%80%93agent_problem https://en.wikipedia.org/wiki/Principal%E2%80%93agent_proble... We have no general-purpose solutions to the principal-agent problem, but we have partial solutions, and they only work on humans: make the human liable for misconduct, pay the human a percentage of the profits for doing a good job, build a culture where dishonesty is shameful. The "lethal trifecta" is just like that other infamously unsolvable problem, but harder. (If you could solve the lethal trifecta, you could solve the principal-agent problem, too.) Since we've been dealing with the principal-agent problem in various forms for all of human history, I don't feel lucky that we'll solve a more difficult version of it in our lifetime. I think we'll probably never solve it.

kube-system 7mo ago

There are plenty of ways to use openclaw that aren’t with your own data. You can use it with any kind of data.

latand6 7mo ago

Definitely, the whole point of openclaw is to operate on your data. It's just.. Be prepared to lose it I guess. The one thing I'm definitely not giving access to yet - the payments. I think we'll develop a way to handle that though

stavros 7mo ago

Of course there is! You want an AI agent to be able to do some things, but not others. OpenClaw currently gets access to both those sets. There's no reason to. I've made my own AI agent (https://github.com/skorokithakis/stavrobot https://github.com/skorokithakis/stavrobot) and it has access to just that one WhatsApp conversation (from me). It doesn't get to read messages coming from any other phone numbers, and can't send messages to arbitrary phone numbers. It is restricted to the set of actions I want it to be able to perform, and no more. It has access to read my calendar, but not write. It has access to read my GitHub issues, but not my repositories. Each tool has per-function permissions that I can revoke. "Give it access to everything, even if it doesn't need it" is not the only security model.

dfabulich 7mo ago
> "Give it access to everything, even if it doesn't need it" is not the only security model. You're using stavrobot instead of OpenClaw precisely because the purpose of OpenClaw is to do everything; a tool to do everything needs access to everything. OpenClaw could be kinda useful and secure if it were stavrobot instead, if it could only do a few limited things, if everything important it tried to do required human review and intervention. But stavrobot isn't a revolutionary tool to do everything for you, and that's what OpenClaw is, and that's why people are excited about it, and why its problems can never be fixed.
- stavros 7mo ago
  Yeah, I don't know, I don't see what I'm missing out on. There isn't something I wanted it to do but couldn't because of the security model.
renewiltord 7mo ago
I also have the same thing but it’s not useful to anyone outside my family. The use cases are not the same for everyone.

BeetleB 7mo ago

> The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it. Every submission I've seen on HN involving OpenClaw will have a comment with this sentiment. "What's the point if you don't give it access to your data ... And if you do, it's a security nightmare ... hence OpenClaw is evil" It's a quick way to spot the person who's never spent any real time with OpenClaw. I always used to give use cases that don't have you give it much (if any) of your data. Examples on how you can give it only a tiny amount of data (many HN users give more just in their HN profile). But I tire of countering folks who clearly have not even tried it. (And I'm not even that pro-OpenClaw. I was using it, then a bug on my system prevented me from using it - a week without OpenClaw and so far no withdrawal symptoms).

jdgoesmarching 7mo ago
Agreed, “if it can’t do everything it’s useless” is dumb on face value. I’m sorry if people don’t have more imaginative uses than checking their email, but I’ve gotten so much utility out of Openclaw without ever hooking it up to my email or a calendar. It’s especially ridiculous responding to a blog about isolating these capabilities rather than dropping them. Those are basic security boundaries more than “restrictions.”