I find it's the same kind of "tech savvy" person who puts an amazon echo in every room.

Tech enthusiast vs tech savvy

> and now I'm supposed to let LLM agents go wild on my data?

Who is forcing you to do that?

The people you are amazed by know their own minds and understand the risks.

> and understand the risks

I'm very unconvinced this is true. Ignorance causes overconfidence.

That's the thing with rampant enthusiasm, nobody has to be forced into it, they'll do dumb things out of their own initiative.

> understand the risks

Here's the director of Safety and alignment at Meta Superintelligence deleting her emails and panicking: https://xcancel.com/summeryue0/status/2025774069124399363

> That's just insane. Insanity.

I feel the same way! Just watching on in horror lol

The computer nerds understand how to isolate this stuff to mitigate the risk. I’m not in on openclaw just yet but I do know it’s got isolation options to run in a vm. I’m curious to see how they handle controls on “write” operations to everyday life.

I could see something like having a very isolated process that can, for example, send email, which the claw can invoke, but the isolated process has sanity controls such as human intervention or whitelists. And this isolated process could be LLM-driven also (so it could make more sophisticated decisions about “is this ok”) but never exposed to untrusted input.

I don’t understand how “running it in a vm” Or a docker image, prevents the majority of problems. It’s an agent interacting with your bank, your calendar, your email, your home security system, and every subscription you have - DoorDash, Spotify, Netflix, etc. maybe your BTC wallet.

What protection is offered by running it in a docker container? Ok, It won’t overwrite local files. Is that the major concern?

Read my second paragraph.

It’s a matter of giving the system shims instead of direct access to “write” ops. Those shims have controls in place. Their only job is to examine the context and decide whether the (email|purchase|etx) is acceptable, either by static rules, human intervention, or, if you’re really getting spicy. separate-llm-model-that-isn’t-polluted-by-untrusted-data.

Edit: I actually wrote such a thing over the weekend as a toy PoC. It uses the LLM to generate a list of proposed operations, then you use a separate tool to iterate though them and approve/reject/skip each one. The only thing the LLM can do is suggest things from a modest set of capabilities with a fairly locked-down schema. Even if I were to automate the approvals, it’s far from able to run amok.

> computer nerds understand

No, literally no one understands how to solve this. The only option that actually works is to isolate it to a degree that removes the "clawness" from it, and that's the opposite of what people are doing with these things.

Specifically, you cannot guard an LLM with another LLM.

The only thing I've seen with any realism to it is the variables, capabilities and taint tracking in CaMeL, but again that limits what the system can do and requires elaborate configuration. And you can't trust a tainted LLM to configure itself.

https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

https://simonwillison.net/2025/Jun/13/prompt-injection-desig...

https://simonwillison.net/2025/Apr/11/camel/

If the “clawness” means you only use the llm to control itself, then yes, that’s impossible. But you can easily shim such a process so that the interfaces it uses to “claw out” to the real world are shims that have safeties such as human control. Openclaw does not do this, and is thus a scary shit show, but you can play with it in isolation safely, and I think a standard pattern for good control will emerge.

> easily

Yeah that's an active research topic for teams of PhDs, including some of Google's brightest. And the current approach even with added barriers may just be fundamentally untrustable. Read the links from my earlier comment for background.

If the shim doesn’t use an LLM to make its decisions this is not a problem.

If the shim does use an LLM but no uncontrolled data is allowed in, this is not a problem.

I think you're misunderstanding the severity of the lethal trifecta. Just because you put access controls around the LLM doesn't mean all that much if the access controls allow anything in & out. There is no way to write a shim that blocks "everything naughty", while remaining useful.

You literally have to fully prevent all outside input, or you have to prevent all exfiltration routes including web page reading (even the choice of links to follow is an exfiltration mechanism). At that point, what's left? What do you think will be on your allowlist?

I seriously doubt the early adopters of these software bundles use their assistants like with such restraint (https://xcancel.com/summeryue0/status/2025774069124399363), and that idealized image of these access control shims is not realistic.

Your definition of “remaining useful” seems to require a lot more than mine. An email shim, for example could have destination whitelists, rate limits, an overall message quota, and can have its contents driven by fixed templates which the LLM can choose from, but not inject arbitrary data into. The point is that your claw need not have “do anything” powers, it needs to have extremely constrained powers. Maybe that is, as you say, “not a claw.” In fact, mine calls itself a “clav” because it’s almost a claw, but not quite.

I live in Tahoe. I travel the area a lot. I wrote a Replit app that gathered a bunch of weather and traffic and local event info and told me what I needed to know for travel between certain events. Part of the stimulus was finding myself stuck in terrible traffic on the Bay Bridge, again and again, when there was a GSW game. I don't do pro team sports so being stuck in extra-traffic when all I wanted was a certain meal in the city felt dumb. GSW games wasn't really even in the periphery of what I pay attention to.

The app was pretty good, but it was very demand driven.

I have an OpenClaw instance running for a lot of banal things. To discuss the same use case, this time I have a /drive command and it knows about all those same data sources. This last week someone needed to come visit me but the roads were closed. I told my claw to check those data sources every 15 minutes and tell me when the chain controls were dropped. It told me as soon as that happened, and me and the other person didn't have to think about it for the duration (it took a few hours).

Again, same things with travel around Tahoe, road closure.. traffic accidents, when the rushes leaving the ski resorts is impacting the area.

Or, a bunch of conditions around weather for my outdooring, adventuring, and fitness routines. When it's very very sunny I tend to gym indoors. When it's partly cloudy I tend to hike up mountains. Unless it's very windy. Back to the gym.

Coordinating a lot of these activities, and my training schedule (for racing, etc), requires an obnoxiously detailed spreadsheet. It's how I roll. Or I tell it I'm heading to Desolation tomorrow around 10am and it'll check ahead of time and warn me if there are issues with the route there. Living up here, there often are.

But my claw makes it a lot easier, and I don't have to think up all the nuances of my requirements at the outset. Use, iterate, repeat. It adjusts and enhances along the way.

Almost no personal data involved.

I have other uses that matter to me, including writing some documentation notes to an Obsidian vault periodically.. very personalized, targeted notes about 100+ topics I care about. Places and things, but not really me.

Don't let the personal-data-overdoers negate the other great uses cases that can't easily be handled with traditional apps. The claw feels like something that can't really be handled, qualitatively, in other ways.

Whats it got to do with being a nerd? Just a matter of risk aversity.

Personally I dont give a shit and its cool having this thing setup at home and being able to have it run whatever I want through text messages.

And it's not that hard to just run it in docker if you're so worried

> And it's not that hard to just run it in docker if you're so worried

There is risk of damage to ones local machine and data as well as reputational risk if it has access to outside services. Imagine your socials filled with hate, ala Microsoft Tay, because it was red pilled.

Though given the current cultural winds perhaps that could be seen as a positive?

Bath salts. Ever seen an alpha-PVP user with eyes out of their orbits, sitting through the night in front of basically a random string generator, sending you snippets of its output and firehosing with monologues about how they're right at the verge of discovering an epically groundbreaking correlation in it?

That is what's happening to nerds right now. Some next-level mind-boggling psychosis-inducing shit has to do with it.

Either this or a completely different substance: AI propaganda.

The idea that the majority of computer nerds are any more security conscious than the average normy has long been dispelled.

The run everything as root, they curl scripts, they npx typos, they give random internet apps "permission to act on your behalf" on repos millions of people depend on