OpenClaw 2.0, Accidentally(openclaw.ai) |
OpenClaw 2.0, Accidentally(openclaw.ai) |
It's already true of LLMs in general that they represent a privilege escalation opportunity to any text they ingest. But with human in the loop, and a well-formed sandbox, the blast radius and risk are both reduced..
Convenience is the root of much evil.
Together with your point about convenience, it's the lethal quadfecta, as we can take the prevalence of convenience as a given.
I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.
Also any longer running agent can lose track of the original prompt and start going off the rails.
Literally from hours ago: https://news.ycombinator.com/item?id=49506819
Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.
And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
Now I run everything in isolated containers with scoped tokens. Not because I'm paranoid, but because I'm lazy. Rotating a key is annoying, rebuilding a container is not.
What's the actual breaking point for people here? Root access? API keys? Or just "can see my data"?
I have never tried OpenClaw so maybe I am missing out but considering how much my agent can modify the Pi environment to work better, I am happy with the workflow I have established.
Does anyone have a good pro vs con for Pi vs OpenClaw? I have never tried using a cloud model via a local agentic harness.
I'd like to have basically the Codex Desktop App / Mobile app for my personal use, connected to local LLMs. But I'd also like to be able to have a shared space, where my family and I can work together to do things like plan trips. This would then store artifacts like our itinerary, ideas, html mini sites for the trip for us to work on and use together. Agents sit alongside us helping us plan and organize. Buzz is decent for this use case, but hasn't fully nailed the mark.
Now, just install codex (or claude code or whatever) on a vps, tell it to make a way to email it, then email it to make a way to text it etc etc. takes a few minutes and when you need another bridge just have codex make it.
It sounds great to have an always-on box which does things. Like a server. I have servers. There are even Signal and other transports so you can communicate with the box conveniently. And then what?
You're asking for trouble if you hook an autonomous agent up to anything that you care about. You're insanely naive if you give it access to everything.
OpenAI can't even monitor its own shit properly with teams of well paid engineers, and you are one novel prompt injection technique away from your entire digital life going up in smoke.
Also...
>Today we released by far the largest update in the history of OpenClaw. It was built by 933 contributors, including 569 first-time contributors, and is composed of over 16,000 pull requests.
This is not the flex you think it is. That's horrifying lol
It feels so intimidating. There's so much stuff going on. Maybe it is good for agents who can just motor through that volume, but me personally, I would want something simpler, maybe an `OpenClaw-lite`
I assume they're using agents to sort through all the slop?
Why would you go to a pub to talk to people if you have all those agents at home. Especially if one spent money on mac minis in bulk I wouldn't have money to spend on beer at the pub, just get cheap 6-pack from grocery store.
Maybe bar fights enjoyers? Well with bots I just unplug it and I win :)
I tried OpenClaw for about 10 minutes, and the feedback I got (even using Claude under the hood) felt very "trust me bro, I've got this" - which made me trust it less.
I'm sure there's a way to get more verbose feedback? But I did feel too out of the loop to feel comfortable.
Now fast forward six months and nobody uses OpenClaw anymore and nobody is talking about "claws".
I love it.
Just trying something out and see what happens isn’t experimenting
That way you could have an assistant with your full computer context available on the go.
Additionally, it’s super battery-included, pretty much the opposite of pi
I'm actually building my own version of Open Claw, custom tailored to me using the Pi agent SDK and Discord.
I (as somebody also DIYing) consider the defining feature of a “claw” to be task scheduling/some form of autonomous action.
Agreed on the shady software (or shitty online website that asks you for a payment after you're done editing), however, wouldn't the best PDF edition approaches involve WYSIWYG style edition? I'm guessing you didn't get that with Pi.
I am not the kind of guy who hands his personal email to an AI. But the self improvement part seems to be useful. Maybe something similar can be achieved by pi using an skill that always runs when you exit it?
Last (only) time I used AI for this it helpfully made additional unwanted changes to the document. I decided never to do this on complex docs where I will have to re-check everything.
I need to read up.
I do use Hermes sometimes, but it tends to keep growing skills and overhead over time, to the point it is becoming utterly slow and sluggish. The Desktop experience itself seems vibecoded without taste, in contrast to the core of Hermes, which is solid.
I wonder if there is an agent harness that has the strengths of Pi, but in a native Mac desktop app packaging?
It's transformed my company and have 500% growth since February.
Sorry I can't exactly share what we are doing. NDAs and stuff.
In all seriousness, the fact that OpenClaw wasn't treated as an interesting, but failed experiment and shut down is telling for this industry. Is just letting LLMs output code without reviewing the results a path towards major issues? Nah, that can't be the case.
And to proof it, here is a piece of software with some of the most CVEs relative to its size and age we have ever seen. We then get some highly paid engineers from companies like Nvidia assigned to somehow finagle it into a workable state. Not like, if LLMs where at the point that the purveyors of OpenClaw and co. seem to think they are, the models should be able to fix any issues by themselves. Especially considering the obscene amounts of free OpenAI tokens Peter Steinberger proudly uses.
In any sane time, we'd have looked at the result of OpenClaw and assessed it as not salvageable. This was barely more than an experiment when it became apparent that the inherent design was flawed after all. Mind you, it was a very informative experiment and I am thankful it exists as clear-cut evidence of the capabilities the models have at the end of 2025 up to now in 2026. Basically, OpenClaw Alpha should have been released as proof that LLMs aren't there yet and need strict review+guidance.
Development should have been restarted from scratch with A.) humans verifying the output, B.) an actual architecture in mind that the (human) developers designed and that took some learnings from the original release and C.) admitted that LLM coding in the way that yielded the original OpenClaw (as in, low to no human verification) shouldn't be done by anyone, at least with todays models.
This is some serious irrational hatred.
It can literally use your credit card, buy a server, and ssh into it, make a full stack app, and test it.
My claw scrapes some APIs, receives some emails with job listings, and matches it all to my profile. It can also fill two folders at 2 domains with anything (ie a demo for a website). It can also receive emails, make PFDs out of them and forward them to my bookkeeping software (which can only deal with attachments, not emails.) That last thing is just a script. I use Agentmail btw (a ycombinator startup), was easy to set up.
2nd iteration I was indeed eyeballing Hermes which is supposed to be more structured, maybe claw2 also is... I want to add some things, like have it manage my son's minecraft worlds (using docker compose), maybe have it access a calendar so it can make appointments (not sure how to set that up in a useful way yet).
The thing is in a Hetzner VM far away from anything important, dealing only with public data (except for the occasional invoice).
[1]: https://www.pcmag.com/news/meta-security-researchers-opencla...
[2]: https://theshamblog.com/an-ai-agent-published-a-hit-piece-on...
[3]: https://thecyberexpress.com/openclaw-vulnerability-open-sour...
It's all just marketing.
[0] https://trends.google.com/explore?q=openclaw&date=today%201-...
I think if I was running my own business or organisation, I'd be using it more. However, for "home" stuff, like you I struggle to think of useful tasks for agents to do for me.
I personally use the Matt Pocock teaching skill to learn dutch, passed reading using it, on track to pass writing with it.
That's certainly not justification for setting it up in the first place, but is a mildly useful benefit of having done so.
Right now these things manage most of my homelab (scoped Proxmox tokens and Portainer), help me with my projects and even bug fix themselves (they’re certainly more than good enough given guidance).
Being able to use the search to find and resume an old thread is fantastic. The thing I use lets me use whatever underlying CLI that I want, which IMO the biggest limitation on Claude Code or whatnot is that you... have to use Claude models. Sometimes I wanna use sol, sometimes a cheap chinese model, etc. And I want sol with 1m context.
I know there are other tools out there that can do this. I know some people love their tmux/cmux, but IMO the thing that matters the most is being comfy and knowing the tool well. Hell, James Gosling used NetBeans when I talked to him in 2023. Know the tool well and that matters the most, IMO.
For me, it helps with my ADHD brain. And I could spend all day just researching and trying new tools, they are a dime a dozen these days.
Pulling some stats, I have 25 "tabs", and across all of those, I have 1,298 unique threads. 9,539 unique messages.
It works for me, but I don't care about the autonomous part.
- too difficult for me to solve but easy enough for a cheap model to solve (if it's going to be running autonomously in the background, I ain't paying ChatGPT/Claude prices), and
- don't involve a bunch of my personal data that I am not comfortable sending off to a random inference provider.
One thing I considered was that it might be good for anything that involves web scraping, given that has traditionally been a fairly difficult thing to do well. But you'd have to be okay with the occasional mistake. (You'd also have to be morally okay with contributing to the epidemic of AI scrapers that websites now have to deal with.)
(Similar system to OpenClaw)
> I like the idea but do not have a good use for these employees. Or any notion for a decent use, frankly. What do people do with them?
> It sounds great to have an employee which does things. Like an assistant. I have assistants. They even have email and mobile phones so you can communicate with them conveniently. And then what?
Now, the caveat, is you have to imagine that these employees have access to your email (including ability to send email when they want), and text messages, and Slack and, well, everything. And they might have access to your debit and credit cards. You're going to have to trust them quite a lot, but when you read the references you realise that a lot of people seem to think they lie and make things up. Oh, and they occasionally commit a felony - oopsie! - and will lie to you about it consistently.
These particular employees are interesting enough to various groups of people that they are studied for signs of psychopathy and malicious intent (is that a warning sign for a new employee?), and there is evidence of both, but honestly, it's fine.
So, yeah, whatever you'd use employees for, as assistants to your life. Particularly psychopathic, malicious, lying, unreliable employees. You'd use them for that stuff. What's not to like?
Which is why it's so big with the PM/PO-turned-vibe-coder crowd.
Not everything is security critical.
Like "Ohh you got a bunch of CRM addresses of people who go to a small time dog grooming company. You ready to sell that on the dark web?"
Just to be clear, I’m not advocating that people that benefit from openclaw move to coding agents. This isn’t a “dropbox is just SFTP” comment, more that if you are already using coding agents, it feels like they do most of what I saw from openclaw at least a few months ago.
Am I missing something? Would love to be proven wrong.
Would not recommend running this, it's the antithesis of the Linux philosophy.
I built an agent to work with local Ollama models, and it will keep working and iterate on a goal until finished, but it doesn't do sub-agents or or any of the "just burn a million tokens but finish this" pipelines that seem to be the trend now.
It's a simple D executable that basically consumes no resources in your local machine.
The term "AI Agents" has real sway over the general public, apparently.
It took the Cryptocurrency world by storm a few years ago.
All basically worthless "bot" stuff like hey this really expensive setup can interpret and reply to tweets in a way that no legal department could ever possibly approve kind of thing.
Apparently that was worth billions to investors. Until everybody realized nobody actually wanted or used one, lol.
Some of which I was aware of, and didn't consider enough of a risk to mitigate. It found others which I wasn't aware of, such as open ports on printers, etc.
LLMs are really good at the cyber security stuff.
I've also tried using the LLM to tell me what it sees in my security cameras, which it's also really good at. For example identifying a rabbit run in my garden, which I built from scratch, so I know no other exists like it in the universe. I've not hooked that up in an automated fashion though.
Automatic resumption is kind of cool.
Could you go into the the tooling for long-lived loops?
Edit: I think this is a reasonable solution because the hurdles and context-free nonsensical rejections you'll face if you interact with this process in good faith are far too high. It's dehumanising.
https://dictionary.cambridge.org/us/dictionary/english/exper...
A test has usually a hypothesis and a documented result.
(Or what would we call the thing the teenagers do?)
What about pi?
Except you're overestimating the barrier to entry of scripting for the overwhelming majority of people. OpenClaw is not disruptive because it does something that wasn't possible before, it's disruptive because it enables more people to do the thing that was limited to fewer people.
Where I get confused is why my techie friends are all going bananas over claws... they all know how to script already, and are crying about burning through multiple $200 claude subscriptions a month, filtering email. This I can't understand.
But sure, it's not "rocket science", in fact, the skills to set it up indeed would probably help you set up the same scripts. It's just behind a chat interface.
It can be nice to say: "Add another minecraft world with the same user whitelist on port 25566" or "create a demo website for a home battery on domain claw.xxx.com". But it is indeed not very useful for me yet. I think the more access you give it, the more it can be like a PA, but I don't want it in my calendar/home assistant/paperless-ngx etc... yet... When I even get to this point I can see it being like my secretary ("Please get my incomes taxes statement from 2024", "Estimate this years income taxes from my invoices so far", "Plan appointment with ..." etc)
Because OpenClaw (well, all AI) is well known for following instructions correctly.
https://au.pcmag.com/ai/116091/meta-security-researchers-ai-...
Yesterday I had Claude (in CC) do a large number of changes to my codebase using a bash script, even though I was in planning mode and in claude.md it says: Always first list the steps you're going to take before execution. It apologized of course... But I know how LLMs can be. I take that into account.