OpenClaw is a security nightmare dressed up as a daydream (composio.dev)

by fs_software 297 comments 397 points
Read article View on HN

297 comments

[−] Oarch 55d ago
Responding to the tweet quoted in the article: why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting. Doing this manually is already pretty trivial, it's more productivity theatre than genuinely life-changing.

There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

[−] mjr00 55d ago

> why are the examples given of futuristic capabilities always so visionless - it's always booking a flight or scheduling a meeting.

This AI wave is filled with "ideas guys/gals" who thought they had an amazing awesome idea and if only they knew how to program they could make a best-selling billion dollar idea, being confronted with the reality that their ideas are really uninteresting as well.

They're still happy to write blog posts about how their bleeding-edge Claw setup sends them a push notification whenever someone comments on one of their LinkedIn posts, though.

[−] FpUser 55d ago
I have "new genius" ideas very often. After doing quick search I discover that any idea worth thinking of implementation is either implemented already or what seems to be low barrier to entry clashes with some legal obstacles.
[−] stbtrax 55d ago
the whole obsequious nature of how LLMs also amp them up thinking they're onto something incredible is throwing gas on this dumpster fire.

"What a great idea! This will revolutionize linkedin commenting. Let's implement it together."

[−] _dain_ 55d ago
Yeah it seems like we're still in the "XYZ ... but on a computer!" stage of AI.
[−] brightball 55d ago
Wait til you see my todo app though…
[−] davidw 55d ago
Booking a flight is the kind of thing I want to dedicate my full attention to. It's expensive, and the timing and details matter a lot.

I'm happy for the voice assistant to add stuff to my grocery list, though. The consequences are not serious if it screws up a letter or something.

[−] sdoering 55d ago
Not using OpenClaw - but I have a limited agent running that currently does a few things well.

Morning Briefing: - it reads all my new email (multiple accounts and contexts), calendars (same accounts and contexts), slack (and other chat) messages (multiple slacks, matrix, discord, and so on), the weather reports, my open/closed recent to dos in a shared list across all my devices, my latest journal/log entries of things done. Has access for cross referencing to my "people files" to get context on mails/appointments and chat messages.

From all this, as well as my RSS feeds, it generates a comprehensive yet short-ish morning briefing I receive on weekdays at 7am.

Two minutes and I have a good grasp of my day, important meetings/deadlines/to dos, possible scheduling conflicts across the multiple calendars (that are not syncable due to corporate policies). This is a very high level overview that already enables me to plan my day better, reschedule things if necessary. And start the day focused on my most important open tasks/topics. More often than not this enables me to keep the laptop closed and do the conceptual work first without getting sucked into email. Or teams.

By the way: Sadly teams is not accessible to it right now. MS Power Automate sadly does not enable forwarding the content of chats. Unlike with emails or calendar appointments.

Just for that alone it is worth having it to me. YMMV.

I also can fire a research request via chat. It does that and writes the results into a file that gets synced to my other devices. Meaning I have it available at any device within a minute or so. Really handy sometimes. It also runs a few regular research tasks on a schedule. And a bit of prep work for copy writing and stuff like this.

Currently it is just a hobby/play project. But the morning briefing to me is easily worth an hour of my day. Totally worth running it on my infra without additional costs.

[−] sylos 55d ago
I think some folks want a legitmate personal assistant/secretary like ceo's and wealthy people have but ai. I think that's a good goal. Modern cells and pdas kinda fell short of "your own literal secretary" and I think people want that. Still we should continue pushing the boundaries beyond that.
[−] ForHackernews 55d ago
The dream of the middle class IT drone is to become the executive Office Man: he shouts at his PA and she books his flights.

Now AI can provide a simulacrum of his fondest aspiration, to be too important to click through booking.com and make someone else do it for him.

[−] Barrin92 55d ago

>There are real, impressive examples of the power of agentic flows

there aren't, and just like the blockchain "industry" with its "surely this is going to be the killer app" we're going to be in this circus until the money dries up.

Just like the note-taking craze, the crypto ecosystem and now AI there's an almost inverse relation between the people advocating it and actually doing any meaningful work. The more anyone's pushing it the faster you should run into the opposite direction.

[−] sxg 55d ago
Some of it is lack of imagination, but some of it is because many truly visionary examples would largely sound stupid to most of today's audience. Imagine it's 2007 and you're explaining how the smartphone will change society over the next 20 years:

- A photo sharing app will change restaurants, public spaces, and the entire travel industry across the world

- The smartphone will bring about regime change in Egypt, Tunisia, Lebanon, and other countries in ~4 years

- We'll replace taxis and hotels by getting rides and sharing homes with strangers

- Billions of people across the world will never need to own a desktop or laptop

- A short video sharing app will kill TV

- QR codes become relevant

Most of these would be a hard sell at the time.

[−] lxgr 55d ago
That's a fair point, and I guess the marketing problem here is intrinsic: If the problem is trivial, off-the-shelf solutions abound; if it's idiosyncratic, almost nobody will be able to relate (as you can't assume that people will do the transfer of "if it can solve complex problem I don't understand A, it'll probably be able to solve my complex problem B" for promotional material).
[−] endofreach 55d ago

> There are real, impressive examples of the power of agentic flows out there. Can we up the quality of our examples just a bit?

Please don't. The reason we're still enjoying the bit of the old world as we know it, is just because nobody has really figured it out yet. Enjoy the moment, while it lasts.

[−] thomasfromcdnjs 54d ago
I've been super impressed with this genealogy workflow -> https://github.com/mattprusak/autoresearch-genealogy

Somewhere should definitely make this for missing persons.

[−] mandeepj 55d ago

> booking a flight

> Doing this manually is already pretty trivial

No, it’s not! You are the one who made it trivial by using three words to define! How about if I could only fly out between 9 am-noon next Friday? Also, combine it with hotel and rental car. Many times total $ between sites could be a difference of close to $200 or more along with better itinerary. That’s just the surface. The more preferences you add, the complex it becomes, so make it a right scenario for agent automation along with calendar management which has similar complexity.

[−] bluGill 55d ago
They are only trivial in the simple case.

When you need a bunch of busy people in a meeting it becomes hard to book a meeting. If several people need to travel incuding get a visa it is hard to fit it all it between other meetings that refuired people caanot skip.

travel is hard when you are trying for the best deal across flights, hotels and such. many sites only guarentee prices for 15 minutes so you can't even get all the needed prices on a spreadsheet at once - particularly if you have flevible travel dates. I've booked a best price plane ticket only to discover it was the worst date for hotels and I could have saved money on a more expensive flight.

[−] dfabulich 55d ago

>

Separate Accounts for your OpenClaw

> As I have mentioned, treat OpenClaw as a separate entity. So, give it its own Gmail account, Calendar, and every integration possible. And teach it to access its own email and other accounts. In addition, create a separate 1Password account to store credentials. It’s akin to having a personal assistant with a separate identity, rather than an automation tool.

The whole point of OpenClaw is to run AI actions with your own private data, your own Gmail, your own WhatsApp, etc. There's no point in using OpenClaw with that much restriction on it.

Which is to say, there is no way to run OpenClaw safely at all, and there literally never will be, because the "lethal trifecta" problem is inherently unsolvable.

https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

[−] bigstrat2003 55d ago
Not just OpenClaw. Anyone giving an LLM direct access to the system is completely irresponsible. You can't trust what it will do, because it has no understanding. But people don't give a shit, gotta go fast - even if they are going in a bad direction.
[−] BrenBarn 54d ago
This sounded cool up until the part where they said "instead use this other AI we built that we say is more trustworthy".

There's a growing part of me that really wants a massive security/safety disaster that's clearly caused by AI so that everyone will shake it off and it will resettle into something at least halfway reasonable. I mean a watershed event like a Triangle Shirtwaist or thalidomide or Therac-25 or Hindenburg type incident that makes people shift their mindset to where they are reflexively skeptical of AI because they assume its risks outweigh its benefits.

[−] delbronski 55d ago
My prediction is that OpenClaw will eventually die. But it has provided a small glimpse of the future.The way the average consumers interact with computers will drastically change.

I can envision someone sitting in a park bench with a small set of earphones planning a family trip with their AI. They get home and see the details of it on their fridge. They check with their partner, and then just tell the AI to book it. And it all works.

I probably won’t use it and hate it. I’ll stick to my old ways of booking the trip with my fingers. But those born into it will look at me crazy.

[−] Xiaoher-C 43d ago
As someone building on top of OpenClaw, the security concern is real. We built an AgentBnB plugin that needed child_process for CLI execution — the OpenClaw installer flags 40+ security warnings during install, which scares users even though most are false positives from scanning test files and examples. The ClawHavoc incident was a wake-up call. We now follow the 100/3 rule (only install skills with 100+ downloads and 3+ months of activity) and built our identity layer with Ed25519 keypairs + UCAN delegation tokens to scope what agents can do.
[−] gos9 55d ago
At this point, I assume anyone writing commentary on software moving faster than they can understand just simply should be ignored. So when such commentary is advertising a product worth zero
[−] ncrmro 54d ago
I have been building a similar concept into my custom NixOS distribution, Keystone, where agents operate within their own user accounts with dedicated emails and SSH access. > It utilizes the Claude, Gemini, and Ollama CLIs. Because it is built directly into the OS, it seamlessly integrates with native notes and records calls. Furthermore, an AI agent can access Immich to deduce my context by analyzing image metadata and tagged faces. It features dedicated calendars for task scheduling and native PDF extraction capabilities. The entire system is declarative via NixOS, allowing it to provision itself almost entirely automatically.

https://github.com/ncrmro/keystone

[−] _pdp_ 55d ago
It is, but I thought security wasn't the point.

The point was to give it unlimited access to your entire digital life and while I'd never use it that way myself, that's what many users are signing up for, for better or worse.

Obviously, OpenClaw doesn't advertise it like that, but that's what it is.

Needless to say, OpenClaw wasn't even the first to do this. There were already many products that let you connect an AI agent to Telegram, which you could then link to all your other accounts. We built software like that too.

OpenClaw just took the idea and brought it to the masses and that's the problem.

[−] pama 55d ago
A thinly vailed ad for yet another variant that inevitably leads to more confusion and yet another future security nightmare. The authors (should) know better. No, the purpose of OpenClaw is not to immediately give it all your private accounts and live in bliss and no, their system is not better long term than following the mainline developments that have enough eyes (and bots) on them by now.
[−] operatingthetan 55d ago
I'm using openclaw for a personal development system running obsidian. It doesn't have access to anything else. Having an LLM trigger based on crons is very powerful and helps with focus and organizing.

The security risks of this setup are lower than most openclaw systems. The real risks are in the access you give it. It's less useful with limited access, but still has a purpose.

I know a guy using openclaw at a startup he works at and it's running their IT infrastructure with multiple agents chatting with each other, THAT is scary.

[−] somewhereoutth 55d ago
I would like a personal assistant on my phone that, based on my usual routine and my exact position, can tell me (for example) which bus will get me home the quickest off the ferry, whether the bridge is clogged with traffic, do I need an umbrella? what's probably missing from my fridge, time to top up transit pass, did I tap in? etc etc. These things would appear on my lock screen when I most probably need to know them.

No email stuff, no booking things, no security problems.