Absolute madman :)

Giving an agent access to AWS is effectively giving it your credit card.

At the max, I would give it ssh access to a Hetzner VM with its own user, capable of running rootles podman containers.

Not at all. AWS IAM policy is a complex maze, but incredibly powerful. It solves this exact problem very well.

Do you honestly believe that they made the effort of setting the appropriate roles and policies, though?

you tell your clanker to do it obviously

I am using an AWS Organization managed sub-account, so it's all pretty self-contained to that one account, and I can easily enough terminate that single sub-account.

There's infamously no way to set a max bill amount for an account in AWS, so it indeed has unlimited spending, but I'm okay with a couple hundred bucks a month.

> Hetzner VM with its own user, capable of running rootles podman containers

Why not give it root on the full VM, and not use the VM for anything else? Giving it a user, and presumably also running your own stuff as a different user, sounds like a very weak security boundary to me compared to giving it a dedicated machine.

If you're not doing multi-tenancy, there's no reason to not give it root, and if you are doing multi-tenancy, then your security boundary is worse than mine is, so you can't call me a madman for it.

Would having a locally-hosted model offset any of these costs?

Our starter plan gives you a machine with 2GB of RAM. You will not be able to run a local LLM. OpenRouter has free models (eg Z.ai: GLM 4.5 Air), I recommend those.

Yes, but that comes at the cost of using a dumber llm. The state of the art ones are only available via commercial api, and the best self-hostable models require $10,000+ gpus.

This is a problem for coding as smarter really has an impact there, but there are so so so many tasks that an 8b model that runs on a $200 gpu can handle nicely. Scrape this page and dump json? Yeah that’s gonna be fine.

This is my conclusion based on a week or so of using ollama + qwen3.5:3b self hosted on a ~10 year old dell optiplex with only the built-in gpu. You don’t need state of the art to do simple tasks.

> Scrape this page and dump json? Yeah that’s gonna be fine.

Only gonna be fine on a trusted page, an 8b model can be prompt injected incredibly trivially compared to larger ones.

Relying on the model to protect you seems like a bad idea…

I mean, clawbots are inherently insecure. Using a better model is defense in depth.

Obviously you should also take precautions, like never instructing it to invoke the browser tool on untrusted sites, avoiding feeding it untrusted inputs where possible in other places, giving it dedicated and locked-down credentials where possible....

But yeah, at this point it's inherent to LLMs that we cannot do something like SQL prepared statements where "tainted" strings are isolated. There is no perfect solution, but using the best model we can is at least a good precaution to stack on top of all our other half-measures.

The "dedicated and locked-down credentials" point is worth expanding. Most of the discussion here focuses on model robustness, but credential scope matters just as much. An agent running with a full-access API key and a scoped one fail very differently under prompt injection.

The pattern that helps most: agents get session-scoped tokens that map to real credentials stored in a vault. The real key never appears in agent context. If the agent gets injected and leaks its token, the token expires after the session. Blast radius is bounded by design, not by model choice.

How we've implemented this: https://www.apistronghold.com/blog/securing-openclaw-ai-agen...

I saw that the Hetzner matrix like has GPU servers < £300 per month (plus set up fee). I haven't tried it but I think if I was getting up to that sort of spend I'd be setting up Ollama on one of those with a larger Qwen3 max model (which I hear is on par with Opus 4.5?? - I haven't been able to try Qwen yet though so that could be b*****ks).

I have tried most of the major open source models now and they all feel okay, but i’d prefer Sonnet or something any day over them. Not even close in capability for general tasks in my experience.

I suspected that might be the case. I'm sure one day soon though there will be a local model as capable as Opus 4.6

Generally the benefit you get out of claws involves untrusted input, i.e. it using the browser tool to scrape websites, etc.

Claude 4.6 is at least a bit resilient to prompt injection, but local models are much worse at that, so using a local model massively increases your chance of getting pwned via a prompt injection, in my estimation.

You're kinda forced to use one of the better proprietary models imo, unless you've constrained your claw usage down to a small trusted subset of inputs.

Just have to know... What the heck are you building?

The model choice matters a lot for cost. I've been running a production NLP pipeline on OpenClaw using Claude Haiku exclusively — it's roughly 25x cheaper than Opus for inference tasks where you don't need the full reasoning power. For most "read this text, classify it" tasks Haiku is more than sufficient.

The hard part for a new user who knows about VMs isn't the VM setup — it's knowing which model to reach for. Opus for complex reasoning, Sonnet for balanced tasks, Haiku for high-volume classification or anything where you're calling the API repeatedly in a loop. Getting that wrong is where bills explode.

A sensible default for a hosted product like Klaus would be Sonnet with Haiku available for bulk operations. Opus should require an explicit opt-in with a cost warning.