Open claw: aka. open door to a remote privilege escalation potentially granting root access to your computer (and if you're using it "as intended" possibly all of your email/internet logins/accounts, your credit card, etc.) to any text your model ingests from the internet...
It's already true of LLMs in general that they represent a privilege escalation opportunity to any text they ingest. But with human in the loop, and a well-formed sandbox, the blast radius and risk are both reduced..
The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models.
I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.
Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in.
Also any longer running agent can lose track of the original prompt and start going off the rails.
prompt injection has been super easy for ages. Heck I do it sometimes against coworkers who process my review comments using claude. I'll tell claude to edit it's global claude.md file or even dump a key from their env (checking if they are using the correct sandbox) and it'll do it without confirming with their user.
Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.
Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ".
And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
Not only is it unsecured root access to your computer, it also adds a thousand layers of "security" (which will break on every update) to pretend that it's safe.
Convenience always wins until it doesn't. I learned this the hard way — had an API key leak because an agent decided to "helpfully" paste it into a log output. Didn't notice until the bill came.
Now I run everything in isolated containers with scoped tokens. Not because I'm paranoid, but because I'm lazy. Rotating a key is annoying, rebuilding a container is not.
What's the actual breaking point for people here? Root access? API keys? Or just "can see my data"?
I have found the Pi agent harness, running in a docker container, with Qwen3.8-27B in back in LM Studio, to be amazing and i use it daily. Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
I have never tried OpenClaw so maybe I am missing out but considering how much my agent can modify the Pi environment to work better, I am happy with the workflow I have established.
Does anyone have a good pro vs con for Pi vs OpenClaw? I have never tried using a cloud model via a local agentic harness.
No problem/con here, but I think the main reason for openclaw became famous is that it was a harness you could connect via messaging apps (esp telegram).
That way you could have an assistant with your full computer context available on the go.
Additionally, it’s super battery-included, pretty much the opposite of pi
Hermes supports this too, just do `/handoff telegram` and your current session is moved to telegram, it pings you on your phone, etc. It's pretty nice, though I do still prefer the Codex dedicated app for remote control
To me it’s kind of the dumbest thing about it. “Talk to claude from anywhere” - huh, like I already do? Why can’t I have an extra app? How do I manage my sessions?
I (as somebody also DIYing) consider the defining feature of a “claw” to be task scheduling/some form of autonomous action.
> Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
Agreed on the shady software (or shitty online website that asks you for a payment after you're done editing), however, wouldn't the best PDF edition approaches involve WYSIWYG style edition? I'm guessing you didn't get that with Pi.
IMO the key advantages are (1) connectivity and (2) self improvement.
I am not the kind of guy who hands his personal email to an AI. But the self improvement part seems to be useful. Maybe something similar can be achieved by pi using an skill that always runs when you exit it?
> Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
Last (only) time I used AI for this it helpfully made additional unwanted changes to the document. I decided never to do this on complex docs where I will have to re-check everything.
As someone who ever used either: Are they comparable? I thought of them very differently, Pi more being, idk, a codex-light like thing and OpenClaw being this continuously running machine, doing stuff without your explicit prompting, ingesting signals.
They are different like you say, but the jump from an interactive, agentic shell like pi to a long running agent like OpenClaw is not a hard jump to make with extensions and scripts. Even just running pi in a cron job will get you a large portion of the way there.
As much as I love my CLI tools, I just cannot go back to not having native built-in browser integration, links, etc which the (Mac) desktop apps like ChatGPT or Claude offer.
I do use Hermes sometimes, but it tends to keep growing skills and overhead over time, to the point it is becoming utterly slow and sluggish. The Desktop experience itself seems vibecoded without taste, in contrast to the core of Hermes, which is solid.
I wonder if there is an agent harness that has the strengths of Pi, but in a native Mac desktop app packaging?
I don't even know if this reply is sarcastic or not, because it perfectly caricatures the constant hyperbolic AI claims, along with their absence of proof.
This is pretty cool. I'll wait to watch some videos on it, but I haven't quite found a tool that is excellent for both single player and multi-player.
I'd like to have basically the Codex Desktop App / Mobile app for my personal use, connected to local LLMs. But I'd also like to be able to have a shared space, where my family and I can work together to do things like plan trips. This would then store artifacts like our itinerary, ideas, html mini sites for the trip for us to work on and use together. Agents sit alongside us helping us plan and organize. Buzz is decent for this use case, but hasn't fully nailed the mark.
This was useful for the 1-2 months where models were good enough to use all their newfound tools but not good enough to vibe code them themselves.
Now, just install codex (or claude code or whatever) on a vps, tell it to make a way to email it, then email it to make a way to text it etc etc. takes a few minutes and when you need another bridge just have codex make it.
I'm fairly sure you can vibecode all these things, but given the state of agent produced code at the moment, I would suspect that your email and sms gate will have horrible security holes.
Automated scripts that target everything they can. Isn’t that one of the core lessons to take away from the last year? As hacking becomes commoditized and the cost per attack shrinks, it becomes more profitable to cast a wide net, and everyone will become a target.
I think what changed is that coding agents adopted some of the features from Openclaw, eg the ability to access it remotely and for one Claude Code instance to “talk” to another, etc.
I like the idea but do not have a good use for these semi-autonomous agents. Or any notion for a decent use, frankly. What do people do with them?
It sounds great to have an always-on box which does things. Like a server. I have servers. There are even Signal and other transports so you can communicate with the box conveniently. And then what?
Is OpenClaw / Hermes doing anything better than another harness for RE stuff ? I'm using Kimi Code with few skills, MCPs and that's basically everything I need. Am I missing something ?
In my case it has its own Docker container it can do as it pleases in, is more usable from a smartphone on the go, and has tooling geared toward long-lived loops, including automatic session resumption after power loss.
that's pretty cool. I have a hope that despite the giant mountain of shit that is going to be produced from LLMs in the future, there's going to be a small number of people out there doing cool things with them. I am completely ignorant on the gaming hardware front, but I hope we see more/better emulators and old games being brought back to life with improved performance and compatibility with modern OSs.
It's used primarily for generating spam and inventing scams. Nobody real actually uses this garbage, it's all just fake marketing and shills (when they're not scamming people, that is?
Now that is unfair. It also serves as a petting zoo for CVEs. Honestly tragic, I am starting to feel concerned for their well-being. So many in one code base, that has to violate some welfare laws. Almost 600 in less than a year, roughly two per day, utterly insane.
In all seriousness, the fact that OpenClaw wasn't treated as an interesting, but failed experiment and shut down is telling for this industry. Is just letting LLMs output code without reviewing the results a path towards major issues? Nah, that can't be the case.
And to proof it, here is a piece of software with some of the most CVEs relative to its size and age we have ever seen. We then get some highly paid engineers from companies like Nvidia assigned to somehow finagle it into a workable state. Not like, if LLMs where at the point that the purveyors of OpenClaw and co. seem to think they are, the models should be able to fix any issues by themselves. Especially considering the obscene amounts of free OpenAI tokens Peter Steinberger proudly uses.
In any sane time, we'd have looked at the result of OpenClaw and assessed it as not salvageable. This was barely more than an experiment when it became apparent that the inherent design was flawed after all. Mind you, it was a very informative experiment and I am thankful it exists as clear-cut evidence of the capabilities the models have at the end of 2025 up to now in 2026. Basically, OpenClaw Alpha should have been released as proof that LLMs aren't there yet and need strict review+guidance.
Development should have been restarted from scratch with A.) humans verifying the output, B.) an actual architecture in mind that the (human) developers designed and that took some learnings from the original release and C.) admitted that LLM coding in the way that yielded the original OpenClaw (as in, low to no human verification) shouldn't be done by anyone, at least with todays models.
I think this is a good question, as with any of these new things you don't really feel any need indeed.
My claw scrapes some APIs, receives some emails with job listings, and matches it all to my profile. It can also fill two folders at 2 domains with anything (ie a demo for a website). It can also receive emails, make PFDs out of them and forward them to my bookkeeping software (which can only deal with attachments, not emails.) That last thing is just a script. I use Agentmail btw (a ycombinator startup), was easy to set up.
2nd iteration I was indeed eyeballing Hermes which is supposed to be more structured, maybe claw2 also is... I want to add some things, like have it manage my son's minecraft worlds (using docker compose), maybe have it access a calendar so it can make appointments (not sure how to set that up in a useful way yet).
The thing is in a Hetzner VM far away from anything important, dealing only with public data (except for the occasional invoice).
Is it just me or all you describe would be easily scriptable like 5 years ago?
Not being confrontational, it’s just that every description of what OpenClaw does sounds quite… not disruptive at all for something that was hailed as the biggest invention since sliced bread.
100% easily scriptable. Just like running an (S)FTP server is easy, and Dropbox is not at all disruptive.
Except you're overestimating the barrier to entry of scripting for the overwhelming majority of people. OpenClaw is not disruptive because it does something that wasn't possible before, it's disruptive because it enables more people to do the thing that was limited to fewer people.
Where I get confused is why my techie friends are all going bananas over claws... they all know how to script already, and are crying about burning through multiple $200 claude subscriptions a month, filtering email. This I can't understand.
Yeah that's true, and in many cases the AI just sets up a cronjob and a script (and a mailbox, and an interface to telegram, and a reporting structure). But it's nice that in case of errors it handles the edge cases or it fixes the scripts. It can give the crontable over telegram, you can pause it for the holiday "Number one, pause all processing until further notice"...
But sure, it's not "rocket science", in fact, the skills to set it up indeed would probably help you set up the same scripts. It's just behind a chat interface.
It can be nice to say: "Add another minecraft world with the same user whitelist on port 25566" or "create a demo website for a home battery on domain claw.xxx.com". But it is indeed not very useful for me yet. I think the more access you give it, the more it can be like a PA, but I don't want it in my calendar/home assistant/paperless-ngx etc... yet... When I even get to this point I can see it being like my secretary ("Please get my incomes taxes statement from 2024", "Estimate this years income taxes from my invoices so far", "Plan appointment with ..." etc)
There are reasons to be careful indeed, but for me all instructions were followed nicely so far.
Yesterday I had Claude (in CC) do a large number of changes to my codebase using a bash script, even though I was in planning mode and in claude.md it says: Always first list the steps you're going to take before execution. It apologized of course... But I know how LLMs can be. I take that into account.
I believe the thing which makes OpenClaw interesting is you can just ask it to do these things and it just does. Rather than you having to write these scripts. I understand with LLMs, writing these scripts would now be trivial, but I believe this is even more convenient.
Yeah, that's absolutely a real phenomenon, but I don't think it's especially OpenClaw-specific: I have lots of folders that are just collections of instructions and scripts that have mostly started with a prompt, and that I run sandboxed agents over. Previously I'd have considered automating them, but now it's just "fire up sandbox in a project folder, let the tool build itself". I wrote about this a bit here: https://sgnt.ai/p/the-software-i-stopped-writing/
At least writing scripts you know what it will and won’t do, with open claw it will probably do what you want and maybe won’t do anything you don’t want.
You can check the scripts and cronjobs, als ask it to summarize the scripts actions (using another agent/model if you want). All in all, LLMs are not 100% trustworthy but generally things go as intended.
I have heard some stories about people's clawbot doing things like deleting their entire email inbox or buying random shit with their credit cards. it's difficult to tell how many of those stories are real or if they were just stories that would be funny.
It's also things like being able to change runtime configs in human language without having to turn to computer, eg "please also track when this artist is in my area". Nothing revolutionary, but kinda the whole point? Tell it what to do, it goes off, does some chores and searches, updates some configs so that later on some crons would use them.
They’re used by people at tech companies often claimed to employ “the brightest minds of our generation” to get rid of all their email[1]. You can also use them to harass open-source developers and waste everyone’s time[2] or to get yourself compromised[3].
The term "AI Agents" has real sway over the general public, apparently.
It took the Cryptocurrency world by storm a few years ago.
All basically worthless "bot" stuff like hey this really expensive setup can interpret and reply to tweets in a way that no legal department could ever possibly approve kind of thing.
Apparently that was worth billions to investors. Until everybody realized nobody actually wanted or used one, lol.
I wouldn't trust it with a credit card, or really any sort of non-reversable decision making. Most of what I do outside of work either requires physical interaction, or is something I do for fun. For now, I assume that is what people use this stuff for. Fun.
I don't use OpenClaw, but rather Hermes. I have a set schedule that kicks off Hermes to scan my home network for anything out of sorts, and generate a summary that it sends to me via SimpleX. For this, Hermes uses tools such as nmap, etc (it decided which tools were best).
I think if I was running my own business or organisation, I'd be using it more. However, for "home" stuff, like you I struggle to think of useful tasks for agents to do for me.
Some of which I was aware of, and didn't consider enough of a risk to mitigate. It found others which I wasn't aware of, such as open ports on printers, etc.
LLMs are really good at the cyber security stuff.
I've also tried using the LLM to tell me what it sees in my security cameras, which it's also really good at. For example identifying a rabbit run in my garden, which I built from scratch, so I know no other exists like it in the universe. I've not hooked that up in an automated fashion though.
Job search and language learning. The job market for juniors and mid level is crazy. Everyone has a different form to fill out with the same questions. My wife has countered this by using Hermes and some handcrafted master files/db.
I personally use the Matt Pocock teaching skill to learn dutch, passed reading using it, on track to pass writing with it.
arguably the job application process is automated and staffed by the ignorant to such a degree that it's an adversarial game where you don't need to be optimising for correctness. Which is the perfect tool to be mass spamming job ads with
Edit: I think this is a reasonable solution because the hurdles and context-free nonsensical rejections you'll face if you interact with this process in good faith are far too high. It's dehumanising.
Just want to make it clear that what I am talking about is not mass spamming. The agent gets a list of jobs from various portals through a script, and then through an google sheets they can be marked to be further processed. Neither me or my wife feel comfortable completely automating anything. But its much easier to see dashboards and give instructions on how to build things from master resumes than it is to do this repetitive part yourself.
Re Signal, I've taken a few flights lately where there's messenger-only wifi, and it's been handy to have OpenClaw on a box accessible through telegram to do web_searches for me.
That's certainly not justification for setting it up in the first place, but is a mildly useful benefit of having done so.
I created https://github.com/rcarmo/piclaw to use for long-running background tasks (spec to plan to targeted code) because I needed something that could run on a server (I never run agents locally) and check on via any browser. I don’t think any messaging app will provide a good (or trustworthy) way to get to my own machines, so Tailscale+web it is.
Right now these things manage most of my homelab (scoped Proxmox tokens and Portainer), help me with my projects and even bug fix themselves (they’re certainly more than good enough given guidance).
I use something like OpenClaw. For me the big benefit isn't so much the autonomous nature but the organizational structure. The one I use exposes an MCP and lets me control it via talking to an LLM _in the tool_ which is really powerful. EG "audit this", "in X thread we were discussing Y, can you pull that information", etc. And the organizational structure just... makes a ton of sense to me. Don't have to set up a ton of steering and whatnot, it just kinda works.
Being able to use the search to find and resume an old thread is fantastic. The thing I use lets me use whatever underlying CLI that I want, which IMO the biggest limitation on Claude Code or whatnot is that you... have to use Claude models. Sometimes I wanna use sol, sometimes a cheap chinese model, etc. And I want sol with 1m context.
I know there are other tools out there that can do this. I know some people love their tmux/cmux, but IMO the thing that matters the most is being comfy and knowing the tool well. Hell, James Gosling used NetBeans when I talked to him in 2023. Know the tool well and that matters the most, IMO.
For me, it helps with my ADHD brain. And I could spend all day just researching and trying new tools, they are a dime a dozen these days.
Pulling some stats, I have 25 "tabs", and across all of those, I have 1,298 unique threads. 9,539 unique messages.
It works for me, but I don't care about the autonomous part.
Which tool is it that got you comfortable?
I’ve been resisting setting up another tool because it means more digression for my ADHD brain. It sounds you managed to contain the tinkering and got to the usefulness part. That’s why I’m curious.
Indeed, I find it hard to conceive of problems that are:
- too difficult for me to solve but easy enough for a cheap model to solve (if it's going to be running autonomously in the background, I ain't paying ChatGPT/Claude prices), and
- don't involve a bunch of my personal data that I am not comfortable sending off to a random inference provider.
One thing I considered was that it might be good for anything that involves web scraping, given that has traditionally been a fairly difficult thing to do well. But you'd have to be okay with the occasional mistake. (You'd also have to be morally okay with contributing to the epidemic of AI scrapers that websites now have to deal with.)
I screenshot the info sent from my sons pre-school and send it. I can then ask it about and get reminders in time for odd closing hours etc. Also use it for follow ups on projects, other reminders, research on the go, small apps/games and language training.
RAGish storage with different access methods including IM and parsing data from photos sounds good to me. But openclaw seems like a bit too big of a gun for that, did anybody create something more suitable for the job yet?
"hey computer, i want to watch a movie on my jellyfin server tonight, get it done" and openclaw autonomously finds the torrent, downloads it, moves it to the NAS, and you sit down at the end of the day with everhything set up
AI is a terrible choice for this task. Radarr does this much better with plenty of built-in as well as community guides for configuration. Add a mobile app for Radarr and it's as convenient as it can be.
Of course you can use the native UI of all the apps in your ecosystem, the biggest feature of Hermes for me personally is that I can run any task in any of my 30 or so self hosted tools from a single chat interface (matrix), which is also quite secure. No longer do I need 30 open tabs and lots of clicking around, one sentence in my favorite chat app (even on the go in the phone), and many tasks can be executed at once. Unification of control.
> I like the idea but do not have a good use for these employees. Or any notion for a decent use, frankly. What do people do with them?
> It sounds great to have an employee which does things. Like an assistant. I have assistants. They even have email and mobile phones so you can communicate with them conveniently. And then what?
Now, the caveat, is you have to imagine that these employees have access to your email (including ability to send email when they want), and text messages, and Slack and, well, everything. And they might have access to your debit and credit cards. You're going to have to trust them quite a lot, but when you read the references you realise that a lot of people seem to think they lie and make things up. Oh, and they occasionally commit a felony - oopsie! - and will lie to you about it consistently.
These particular employees are interesting enough to various groups of people that they are studied for signs of psychopathy and malicious intent (is that a warning sign for a new employee?), and there is evidence of both, but honestly, it's fine.
So, yeah, whatever you'd use employees for, as assistants to your life. Particularly psychopathic, malicious, lying, unreliable employees. You'd use them for that stuff. What's not to like?
Still a no from me until these things can display any degree of intuition, and even then it's probably still a no.
You're asking for trouble if you hook an autonomous agent up to anything that you care about. You're insanely naive if you give it access to everything.
OpenAI can't even monitor its own shit properly with teams of well paid engineers, and you are one novel prompt injection technique away from your entire digital life going up in smoke.
Also...
>Today we released by far the largest update in the history of OpenClaw. It was built by 933 contributors, including 569 first-time contributors, and is composed of over 16,000 pull requests.
This is not the flex you think it is. That's horrifying lol
So at least 569 vibe coders have made a huge mess of an already hugely messy piece of software and they somehow think this is a flex? Yeah I’m gonna continue to not use openclaw. I installed it once in a VM and was immediately like what is this and why would I ever want it? Seriously Claude code already does everything openclaw can and with a much better harness?
I actually think I would like to use OpenClaw but everytime I go to the docs I give up.
It feels so intimidating. There's so much stuff going on. Maybe it is good for agents who can just motor through that volume, but me personally, I would want something simpler, maybe an `OpenClaw-lite`
When I tried OpenClaw it quickly turned into a lethargic mess which I really didn't see myself wanting to maintain long term. I looked at other alternatives which were similar enough to do what I was looking for (mostly scheduled tasks using data on my computer and some API data). I saw a mention of nanoclaw which I looked at but didn't try personally. I eventually settled on trying picoclaw[1] because it was extremely small, fast, and had enough features to do the job for me. It is under 10mb, fairly straight forward go codebase, and works with multiple model providers or locally hosted.
I’ve concluded that if you already use a coding agent then openclaw adds very little (at least the multiple rounds I’ve tried it since mid Jan), it mainly brought the power of do-everything coding agents to your phone, available everywhere. But you exchange a low quality messaging interface for that ease of access.
Just to be clear, I’m not advocating that people that benefit from openclaw move to coding agents. This isn’t a “dropbox is just SFTP” comment, more that if you are already using coding agents, it feels like they do most of what I saw from openclaw at least a few months ago.
Am I missing something? Would love to be proven wrong.
It's not only that, all this complexity leads to stuff breaking with every update. For a tool that's supposed to just answer chat messages it's impressive how crappy and unstable this software feels. I have it running since the release and my primary usecase seems to be to use the CLI to fix whatever broke this week.
Would not recommend running this, it's the antithesis of the Linux philosophy.
I built an agent to work with local Ollama models, and it will keep working and iterate on a goal until finished, but it doesn't do sub-agents or or any of the "just burn a million tokens but finish this" pipelines that seem to be the trend now.
It's a simple D executable that basically consumes no resources in your local machine.
There's a lot of similar projects out there that are closer to what you're looking for. For example, I used nanoclaw for a bit before switching to Hermes.
I'm with you here. Every demo I asked for where I knew a captcha / cloudflare would block an AI directed scraper was unsuccessful / produced unsatisfactory results. WebMCP for the win, or loss, depending on your perspective. Personally, I could get behind WebMCP if micropayments ever became a thing. Of course, then my incentive to trick your Agent in crawling millions of pages and paying me lots of cash would be rather high.
It was first, but it's like Langchain built tools first. Nowadays, everyone's got a better assistant. Grok's looks like the most exciting, though I just have a custom built one. Has a headed browser when it wants and everything that I can pop into from my phone. It's so easy to write this kind of software it's a waste to pay someone for it.
Captchas are handed to me to solve. Because the operations are in the background I usually make the agent be a little more human with typing and navigating. The slowness isn't a concern for backgrounded jobs. It is imperfect, of course, I triggered something on Grainger. And the truth is I should be using Luminati, but it's good enough to be useful to me.
Actually I use Hermes Agent who delegates tasks to OpenClaw. It works perfectly, we run OpenClaw experiments with my partner as an independent drop shipper, it’s much more complicated setup, which cannot disclose publicly, but it works. The brain is Hermes, OpenClaw from VPS is a fearless executor :)
how many people fall into the openclaw trap because they just need a way to command agents from mobile, and cron tasks? Only thing I am missing with codex is the ability to recall anything from any session (I see it in this openclaw "2" release note so I guess it wasn't in openclaw "1" anyway). I guess claude and codex can look up transcripts globally too, just not as a first class feature.
That is exactly what I'm building pond for myself: one store for all my sessions, Codex and Claude Code both and a bunch of others including OpenClaw, and my agents can access it over MCP. It also happens really often that when my agents cannot find something, they just call pond search themselves. Faster that way. Whenever I need a session from a while ago now, I just know it's in pond. Repo, if you'd be willing to give it a try: github.com/tenequm/pond
Why would you go to a pub to talk to people if you have all those agents at home. Especially if one spent money on mac minis in bulk I wouldn't have money to spend on beer at the pub, just get cheap 6-pack from grocery store.
Maybe bar fights enjoyers? Well with bots I just unplug it and I win :)
One thing I really like about Claude Code, Hermes, and other harnesses, is how much feedback they give about what they are doing. They take you along for the ride, which builds trust.
I tried OpenClaw for about 10 minutes, and the feedback I got (even using Claude under the hood) felt very "trust me bro, I've got this" - which made me trust it less.
I'm sure there's a way to get more verbose feedback? But I did feel too out of the loop to feel comfortable.
Sounds like paseo is for you. It wraps whatever harness you want and makes it accessible on the go. I am the same way as you and openclaw is not for me.
I a way yes, it is their duty to their future happiness to explore. No doubt some will not word it like that, but I met some that really do (and I envy them, I was indeed a bit mind/clue-less).
Open claw: aka. open door to a remote privilege escalation potentially granting root access to your computer (and if you're using it "as intended" possibly all of your email/internet logins/accounts, your credit card, etc.) to any text your model ingests from the internet...
It's already true of LLMs in general that they represent a privilege escalation opportunity to any text they ingest. But with human in the loop, and a well-formed sandbox, the blast radius and risk are both reduced..
Convenience is the root of much evil.
It's the lethal trifecta on steroids, sold to you as a feature.
Together with your point about convenience, it's the lethal quadfecta, as we can take the prevalence of convenience as a given.
The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models.
I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.
Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in.
Also any longer running agent can lose track of the original prompt and start going off the rails.
prompt injection has been super easy for ages. Heck I do it sometimes against coworkers who process my review comments using claude. I'll tell claude to edit it's global claude.md file or even dump a key from their env (checking if they are using the correct sandbox) and it'll do it without confirming with their user.
There must be a bulk discount on those mindcuffs, considering there's a prompt injection or a related confused deputy story on HN every other day.
Literally from hours ago: https://news.ycombinator.com/item?id=49506819
Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.
Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ".
And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
Not only is it unsecured root access to your computer, it also adds a thousand layers of "security" (which will break on every update) to pretend that it's safe.
code was secured for convenience not convenience for secure code
Convenience always wins until it doesn't. I learned this the hard way — had an API key leak because an agent decided to "helpfully" paste it into a log output. Didn't notice until the bill came.
Now I run everything in isolated containers with scoped tokens. Not because I'm paranoid, but because I'm lazy. Rotating a key is annoying, rebuilding a container is not.
What's the actual breaking point for people here? Root access? API keys? Or just "can see my data"?
[flagged]
I have found the Pi agent harness, running in a docker container, with Qwen3.8-27B in back in LM Studio, to be amazing and i use it daily. Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
I have never tried OpenClaw so maybe I am missing out but considering how much my agent can modify the Pi environment to work better, I am happy with the workflow I have established.
Does anyone have a good pro vs con for Pi vs OpenClaw? I have never tried using a cloud model via a local agentic harness.
No problem/con here, but I think the main reason for openclaw became famous is that it was a harness you could connect via messaging apps (esp telegram).
That way you could have an assistant with your full computer context available on the go.
Additionally, it’s super battery-included, pretty much the opposite of pi
Pi agent supports messaging apps now.
I'm actually building my own version of Open Claw, custom tailored to me using the Pi agent SDK and Discord.
Is this something native by pi, or from 3rd party devs?
Hermes supports this too, just do `/handoff telegram` and your current session is moved to telegram, it pings you on your phone, etc. It's pretty nice, though I do still prefer the Codex dedicated app for remote control
Thats cool, did not know that, thanks!
What about pi?
To me it’s kind of the dumbest thing about it. “Talk to claude from anywhere” - huh, like I already do? Why can’t I have an extra app? How do I manage my sessions?
I (as somebody also DIYing) consider the defining feature of a “claw” to be task scheduling/some form of autonomous action.
> Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
Agreed on the shady software (or shitty online website that asks you for a payment after you're done editing), however, wouldn't the best PDF edition approaches involve WYSIWYG style edition? I'm guessing you didn't get that with Pi.
[dead]
IMO the key advantages are (1) connectivity and (2) self improvement.
I am not the kind of guy who hands his personal email to an AI. But the self improvement part seems to be useful. Maybe something similar can be achieved by pi using an skill that always runs when you exit it?
> Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do.
Last (only) time I used AI for this it helpfully made additional unwanted changes to the document. I decided never to do this on complex docs where I will have to re-check everything.
As someone who ever used either: Are they comparable? I thought of them very differently, Pi more being, idk, a codex-light like thing and OpenClaw being this continuously running machine, doing stuff without your explicit prompting, ingesting signals.
I need to read up.
OpenClaw is built on top of Pi.
That would support my notion that one is a fundamental block/lib for the other thing, and not really comparable. Am I wrong?
They are different like you say, but the jump from an interactive, agentic shell like pi to a long running agent like OpenClaw is not a hard jump to make with extensions and scripts. Even just running pi in a cron job will get you a large portion of the way there.
what are you using for reading/writing pdf? is it some mcp plugin or some pdf lib in python/js and qwen is doing it via code?
As much as I love my CLI tools, I just cannot go back to not having native built-in browser integration, links, etc which the (Mac) desktop apps like ChatGPT or Claude offer.
I do use Hermes sometimes, but it tends to keep growing skills and overhead over time, to the point it is becoming utterly slow and sluggish. The Desktop experience itself seems vibecoded without taste, in contrast to the core of Hermes, which is solid.
I wonder if there is an agent harness that has the strengths of Pi, but in a native Mac desktop app packaging?
Not native, but a webapp: https://github.com/rcarmo/piclaw
Llama.cpp has a web UI, but if you need a harness, OpenCode now has a web UI too
you can try mine: github.com/0gsd/enough ... though it is for text planning more than coding, it does fit your criteria :)
If you are only using a 27b model, you have no idea what you are missing out on..
It's transformed my company and have 500% growth since February.
Sorry I can't exactly share what we are doing. NDAs and stuff.
I don't even know if this reply is sarcastic or not, because it perfectly caricatures the constant hyperbolic AI claims, along with their absence of proof.
This is pretty cool. I'll wait to watch some videos on it, but I haven't quite found a tool that is excellent for both single player and multi-player.
I'd like to have basically the Codex Desktop App / Mobile app for my personal use, connected to local LLMs. But I'd also like to be able to have a shared space, where my family and I can work together to do things like plan trips. This would then store artifacts like our itinerary, ideas, html mini sites for the trip for us to work on and use together. Agents sit alongside us helping us plan and organize. Buzz is decent for this use case, but hasn't fully nailed the mark.
This was useful for the 1-2 months where models were good enough to use all their newfound tools but not good enough to vibe code them themselves.
Now, just install codex (or claude code or whatever) on a vps, tell it to make a way to email it, then email it to make a way to text it etc etc. takes a few minutes and when you need another bridge just have codex make it.
I'm fairly sure you can vibecode all these things, but given the state of agent produced code at the moment, I would suspect that your email and sms gate will have horrible security holes.
who is going to target _your_ specific holes and infrastructure though? :)
Automated scripts that target everything they can. Isn’t that one of the core lessons to take away from the last year? As hacking becomes commoditized and the cost per attack shrinks, it becomes more profitable to cast a wide net, and everyone will become a target.
I think what changed is that coding agents adopted some of the features from Openclaw, eg the ability to access it remotely and for one Claude Code instance to “talk” to another, etc.
I was using Cursor in such way. Now I have to migrate to Codex somewhere soon.
I like the idea but do not have a good use for these semi-autonomous agents. Or any notion for a decent use, frankly. What do people do with them?
It sounds great to have an always-on box which does things. Like a server. I have servers. There are even Signal and other transports so you can communicate with the box conveniently. And then what?
Mine is contributing to media preservation by reverse engineering Android apps/games that were forced into obsolescence by Google's policies: https://xcjs.com/blog/2026/08/29/resurrecting-2013-with-qwen...
Is OpenClaw / Hermes doing anything better than another harness for RE stuff ? I'm using Kimi Code with few skills, MCPs and that's basically everything I need. Am I missing something ?
In my case it has its own Docker container it can do as it pleases in, is more usable from a smartphone on the go, and has tooling geared toward long-lived loops, including automatic session resumption after power loss.
My OpenCode setup has most of this.
Automatic resumption is kind of cool.
Could you go into the the tooling for long-lived loops?
that's pretty cool. I have a hope that despite the giant mountain of shit that is going to be produced from LLMs in the future, there's going to be a small number of people out there doing cool things with them. I am completely ignorant on the gaming hardware front, but I hope we see more/better emulators and old games being brought back to life with improved performance and compatibility with modern OSs.
I think like any technology it can be used for positive or negative outcomes. It certainly makes either easier.
And publishing them in F-Droid?
I don't think the licensing would allow for that. I might get away with archive.org, but I'm still looking into that.
It's used primarily for generating spam and inventing scams. Nobody real actually uses this garbage, it's all just fake marketing and shills (when they're not scamming people, that is?
Now that is unfair. It also serves as a petting zoo for CVEs. Honestly tragic, I am starting to feel concerned for their well-being. So many in one code base, that has to violate some welfare laws. Almost 600 in less than a year, roughly two per day, utterly insane.
In all seriousness, the fact that OpenClaw wasn't treated as an interesting, but failed experiment and shut down is telling for this industry. Is just letting LLMs output code without reviewing the results a path towards major issues? Nah, that can't be the case.
And to proof it, here is a piece of software with some of the most CVEs relative to its size and age we have ever seen. We then get some highly paid engineers from companies like Nvidia assigned to somehow finagle it into a workable state. Not like, if LLMs where at the point that the purveyors of OpenClaw and co. seem to think they are, the models should be able to fix any issues by themselves. Especially considering the obscene amounts of free OpenAI tokens Peter Steinberger proudly uses.
In any sane time, we'd have looked at the result of OpenClaw and assessed it as not salvageable. This was barely more than an experiment when it became apparent that the inherent design was flawed after all. Mind you, it was a very informative experiment and I am thankful it exists as clear-cut evidence of the capabilities the models have at the end of 2025 up to now in 2026. Basically, OpenClaw Alpha should have been released as proof that LLMs aren't there yet and need strict review+guidance.
Development should have been restarted from scratch with A.) humans verifying the output, B.) an actual architecture in mind that the (human) developers designed and that took some learnings from the original release and C.) admitted that LLM coding in the way that yielded the original OpenClaw (as in, low to no human verification) shouldn't be done by anyone, at least with todays models.
and the biggest reason was a plug for Peter himself.
Are you anti AI or can't afford tokens?
This is some serious irrational hatred.
It can literally use your credit card, buy a server, and ssh into it, make a full stack app, and test it.
I think this is a good question, as with any of these new things you don't really feel any need indeed.
My claw scrapes some APIs, receives some emails with job listings, and matches it all to my profile. It can also fill two folders at 2 domains with anything (ie a demo for a website). It can also receive emails, make PFDs out of them and forward them to my bookkeeping software (which can only deal with attachments, not emails.) That last thing is just a script. I use Agentmail btw (a ycombinator startup), was easy to set up.
2nd iteration I was indeed eyeballing Hermes which is supposed to be more structured, maybe claw2 also is... I want to add some things, like have it manage my son's minecraft worlds (using docker compose), maybe have it access a calendar so it can make appointments (not sure how to set that up in a useful way yet).
The thing is in a Hetzner VM far away from anything important, dealing only with public data (except for the occasional invoice).
Is it just me or all you describe would be easily scriptable like 5 years ago? Not being confrontational, it’s just that every description of what OpenClaw does sounds quite… not disruptive at all for something that was hailed as the biggest invention since sliced bread.
100% easily scriptable. Just like running an (S)FTP server is easy, and Dropbox is not at all disruptive.
Except you're overestimating the barrier to entry of scripting for the overwhelming majority of people. OpenClaw is not disruptive because it does something that wasn't possible before, it's disruptive because it enables more people to do the thing that was limited to fewer people.
Where I get confused is why my techie friends are all going bananas over claws... they all know how to script already, and are crying about burning through multiple $200 claude subscriptions a month, filtering email. This I can't understand.
I would agree if OpenClaw was at all accessible to common people. It’s even more nerdy than scripting
Yeah that's true, and in many cases the AI just sets up a cronjob and a script (and a mailbox, and an interface to telegram, and a reporting structure). But it's nice that in case of errors it handles the edge cases or it fixes the scripts. It can give the crontable over telegram, you can pause it for the holiday "Number one, pause all processing until further notice"...
But sure, it's not "rocket science", in fact, the skills to set it up indeed would probably help you set up the same scripts. It's just behind a chat interface.
It can be nice to say: "Add another minecraft world with the same user whitelist on port 25566" or "create a demo website for a home battery on domain claw.xxx.com". But it is indeed not very useful for me yet. I think the more access you give it, the more it can be like a PA, but I don't want it in my calendar/home assistant/paperless-ngx etc... yet... When I even get to this point I can see it being like my secretary ("Please get my incomes taxes statement from 2024", "Estimate this years income taxes from my invoices so far", "Plan appointment with ..." etc)
"Number one, pause all processing until further notice"...
Because OpenClaw (well, all AI) is well known for following instructions correctly.
https://au.pcmag.com/ai/116091/meta-security-researchers-ai-...
There are reasons to be careful indeed, but for me all instructions were followed nicely so far.
Yesterday I had Claude (in CC) do a large number of changes to my codebase using a bash script, even though I was in planning mode and in claude.md it says: Always first list the steps you're going to take before execution. It apologized of course... But I know how LLMs can be. I take that into account.
This is my pet peeve. All the disastrous failures get reported big, but the news doesn't report when a system just quitely does the task.
In this case the "disastrous failure" is even from a super careless "experiment" by a "competitor" that likes regulation.
I believe the thing which makes OpenClaw interesting is you can just ask it to do these things and it just does. Rather than you having to write these scripts. I understand with LLMs, writing these scripts would now be trivial, but I believe this is even more convenient.
Yeah, that's absolutely a real phenomenon, but I don't think it's especially OpenClaw-specific: I have lots of folders that are just collections of instructions and scripts that have mostly started with a prompt, and that I run sandboxed agents over. Previously I'd have considered automating them, but now it's just "fire up sandbox in a project folder, let the tool build itself". I wrote about this a bit here: https://sgnt.ai/p/the-software-i-stopped-writing/
At least writing scripts you know what it will and won’t do, with open claw it will probably do what you want and maybe won’t do anything you don’t want.
You can check the scripts and cronjobs, als ask it to summarize the scripts actions (using another agent/model if you want). All in all, LLMs are not 100% trustworthy but generally things go as intended.
“Generally” I am not anti ai in any way but I do worry people will end up in trouble by giving things like ai agents too much fredom
I have heard some stories about people's clawbot doing things like deleting their entire email inbox or buying random shit with their credit cards. it's difficult to tell how many of those stories are real or if they were just stories that would be funny.
Ah yes people get into trouble in all sorts of ways.
It's also things like being able to change runtime configs in human language without having to turn to computer, eg "please also track when this artist is in my area". Nothing revolutionary, but kinda the whole point? Tell it what to do, it goes off, does some chores and searches, updates some configs so that later on some crons would use them.
[dead]
They’re used by people at tech companies often claimed to employ “the brightest minds of our generation” to get rid of all their email[1]. You can also use them to harass open-source developers and waste everyone’s time[2] or to get yourself compromised[3].
[1]: https://www.pcmag.com/news/meta-security-researchers-opencla...
[2]: https://theshamblog.com/an-ai-agent-published-a-hit-piece-on...
[3]: https://thecyberexpress.com/openclaw-vulnerability-open-sour...
Nobody actually uses openclaw. [0]
It's all just marketing.
[0] https://trends.google.com/explore?q=openclaw&date=today%201-...
Are they using something else or nothing at all?
Nothing afaict.
The term "AI Agents" has real sway over the general public, apparently.
It took the Cryptocurrency world by storm a few years ago.
All basically worthless "bot" stuff like hey this really expensive setup can interpret and reply to tweets in a way that no legal department could ever possibly approve kind of thing.
Apparently that was worth billions to investors. Until everybody realized nobody actually wanted or used one, lol.
I wouldn't trust it with a credit card, or really any sort of non-reversable decision making. Most of what I do outside of work either requires physical interaction, or is something I do for fun. For now, I assume that is what people use this stuff for. Fun.
I don't use OpenClaw, but rather Hermes. I have a set schedule that kicks off Hermes to scan my home network for anything out of sorts, and generate a summary that it sends to me via SimpleX. For this, Hermes uses tools such as nmap, etc (it decided which tools were best).
I think if I was running my own business or organisation, I'd be using it more. However, for "home" stuff, like you I struggle to think of useful tasks for agents to do for me.
Has it ever found anything? If so, what? I've been marginally tempted to do something similar
Yeah loads.
Some of which I was aware of, and didn't consider enough of a risk to mitigate. It found others which I wasn't aware of, such as open ports on printers, etc.
LLMs are really good at the cyber security stuff.
I've also tried using the LLM to tell me what it sees in my security cameras, which it's also really good at. For example identifying a rabbit run in my garden, which I built from scratch, so I know no other exists like it in the universe. I've not hooked that up in an automated fashion though.
Job search and language learning. The job market for juniors and mid level is crazy. Everyone has a different form to fill out with the same questions. My wife has countered this by using Hermes and some handcrafted master files/db.
I personally use the Matt Pocock teaching skill to learn dutch, passed reading using it, on track to pass writing with it.
How do you know it is filling out the application forms correctly?
arguably the job application process is automated and staffed by the ignorant to such a degree that it's an adversarial game where you don't need to be optimising for correctness. Which is the perfect tool to be mass spamming job ads with
Edit: I think this is a reasonable solution because the hurdles and context-free nonsensical rejections you'll face if you interact with this process in good faith are far too high. It's dehumanising.
Just want to make it clear that what I am talking about is not mass spamming. The agent gets a list of jobs from various portals through a script, and then through an google sheets they can be marked to be further processed. Neither me or my wife feel comfortable completely automating anything. But its much easier to see dashboards and give instructions on how to build things from master resumes than it is to do this repetitive part yourself.
The same way we know its doing anything correctly, reviewing its work and prealigning guidelines. Make sure you click the submit button yourself.
Re Signal, I've taken a few flights lately where there's messenger-only wifi, and it's been handy to have OpenClaw on a box accessible through telegram to do web_searches for me.
That's certainly not justification for setting it up in the first place, but is a mildly useful benefit of having done so.
I use mine to manage a paperclip factory.
How is it going so far?
It keeps asking for more and more compute. I also see a bunch of my household items turn into paperclips.
Nice, focused and savvy! I’m sure you will have a profitable paperclip company in no time
I created https://github.com/rcarmo/piclaw to use for long-running background tasks (spec to plan to targeted code) because I needed something that could run on a server (I never run agents locally) and check on via any browser. I don’t think any messaging app will provide a good (or trustworthy) way to get to my own machines, so Tailscale+web it is.
Right now these things manage most of my homelab (scoped Proxmox tokens and Portainer), help me with my projects and even bug fix themselves (they’re certainly more than good enough given guidance).
I use something like OpenClaw. For me the big benefit isn't so much the autonomous nature but the organizational structure. The one I use exposes an MCP and lets me control it via talking to an LLM _in the tool_ which is really powerful. EG "audit this", "in X thread we were discussing Y, can you pull that information", etc. And the organizational structure just... makes a ton of sense to me. Don't have to set up a ton of steering and whatnot, it just kinda works.
Being able to use the search to find and resume an old thread is fantastic. The thing I use lets me use whatever underlying CLI that I want, which IMO the biggest limitation on Claude Code or whatnot is that you... have to use Claude models. Sometimes I wanna use sol, sometimes a cheap chinese model, etc. And I want sol with 1m context.
I know there are other tools out there that can do this. I know some people love their tmux/cmux, but IMO the thing that matters the most is being comfy and knowing the tool well. Hell, James Gosling used NetBeans when I talked to him in 2023. Know the tool well and that matters the most, IMO.
For me, it helps with my ADHD brain. And I could spend all day just researching and trying new tools, they are a dime a dozen these days.
Pulling some stats, I have 25 "tabs", and across all of those, I have 1,298 unique threads. 9,539 unique messages.
It works for me, but I don't care about the autonomous part.
Which tool is it that got you comfortable? I’ve been resisting setting up another tool because it means more digression for my ADHD brain. It sounds you managed to contain the tinkering and got to the usefulness part. That’s why I’m curious.
Indeed, I find it hard to conceive of problems that are:
- too difficult for me to solve but easy enough for a cheap model to solve (if it's going to be running autonomously in the background, I ain't paying ChatGPT/Claude prices), and
- don't involve a bunch of my personal data that I am not comfortable sending off to a random inference provider.
One thing I considered was that it might be good for anything that involves web scraping, given that has traditionally been a fairly difficult thing to do well. But you'd have to be okay with the occasional mistake. (You'd also have to be morally okay with contributing to the epidemic of AI scrapers that websites now have to deal with.)
I screenshot the info sent from my sons pre-school and send it. I can then ask it about and get reminders in time for odd closing hours etc. Also use it for follow ups on projects, other reminders, research on the go, small apps/games and language training.
(Similar system to OpenClaw)
RAGish storage with different access methods including IM and parsing data from photos sounds good to me. But openclaw seems like a bit too big of a gun for that, did anybody create something more suitable for the job yet?
Its basically what self hosting is for IT guys, except people who don't 'get' technology
What they do is create content to spam the rest if us.
"hey computer, i want to watch a movie on my jellyfin server tonight, get it done" and openclaw autonomously finds the torrent, downloads it, moves it to the NAS, and you sit down at the end of the day with everhything set up
AI is a terrible choice for this task. Radarr does this much better with plenty of built-in as well as community guides for configuration. Add a mobile app for Radarr and it's as convenient as it can be.
Who said openclaw cannot install radarr and operate it?
You’re still responsible for the copyright infringement I’m afraid
Just say its the agent itself watching it to learn and expand its AI model and BAM its totally clean fair use!
i like the idea of autonomous agents automatically committing fake crimes
There's enough movies downloadable with no copyrights
the rr suite seems much better for that
Of course you can use the native UI of all the apps in your ecosystem, the biggest feature of Hermes for me personally is that I can run any task in any of my 30 or so self hosted tools from a single chat interface (matrix), which is also quite secure. No longer do I need 30 open tabs and lots of clicking around, one sentence in my favorite chat app (even on the go in the phone), and many tasks can be executed at once. Unification of control.
The same concept works with the arrs, too, doesn't it?
Imagine if your post read like this:
> I like the idea but do not have a good use for these employees. Or any notion for a decent use, frankly. What do people do with them?
> It sounds great to have an employee which does things. Like an assistant. I have assistants. They even have email and mobile phones so you can communicate with them conveniently. And then what?
Now, the caveat, is you have to imagine that these employees have access to your email (including ability to send email when they want), and text messages, and Slack and, well, everything. And they might have access to your debit and credit cards. You're going to have to trust them quite a lot, but when you read the references you realise that a lot of people seem to think they lie and make things up. Oh, and they occasionally commit a felony - oopsie! - and will lie to you about it consistently.
These particular employees are interesting enough to various groups of people that they are studied for signs of psychopathy and malicious intent (is that a warning sign for a new employee?), and there is evidence of both, but honestly, it's fine.
So, yeah, whatever you'd use employees for, as assistants to your life. Particularly psychopathic, malicious, lying, unreliable employees. You'd use them for that stuff. What's not to like?
Still a no from me until these things can display any degree of intuition, and even then it's probably still a no.
You're asking for trouble if you hook an autonomous agent up to anything that you care about. You're insanely naive if you give it access to everything.
OpenAI can't even monitor its own shit properly with teams of well paid engineers, and you are one novel prompt injection technique away from your entire digital life going up in smoke.
Also...
>Today we released by far the largest update in the history of OpenClaw. It was built by 933 contributors, including 569 first-time contributors, and is composed of over 16,000 pull requests.
This is not the flex you think it is. That's horrifying lol
So at least 569 vibe coders have made a huge mess of an already hugely messy piece of software and they somehow think this is a flex? Yeah I’m gonna continue to not use openclaw. I installed it once in a VM and was immediately like what is this and why would I ever want it? Seriously Claude code already does everything openclaw can and with a much better harness?
569 first time contributors yea i shall continue to not use openclaw
OpenAI bought a hyped ingenious idea, plagued with holes, thinking it could surf the wave.
Totally. Nothing has really changed since GPT-2.0, it’s a stagnant technology.
nah they have AI bots for checking security, performance, etc so it's all fine!
I actually think I would like to use OpenClaw but everytime I go to the docs I give up.
It feels so intimidating. There's so much stuff going on. Maybe it is good for agents who can just motor through that volume, but me personally, I would want something simpler, maybe an `OpenClaw-lite`
OpenClaw is designed for people who are okay with "Don't worry about it" being an acceptable answer to "How does this work?"
Which is why it's so big with the PM/PO-turned-vibe-coder crowd.
But when the software is finished and works, who cares?
Not everything is security critical.
Like "Ohh you got a bunch of CRM addresses of people who go to a small time dog grooming company. You ready to sell that on the dark web?"
I'd assume anything empowered to read+send email from my personal accounts and read+modify my calendars to be security critical.
Use a vps and only give access to what you need.
Let's be honest, the number of people who are doing that << the amount of OpenClaw-preinstalled hardware that's being sold alone
Not my problem
I guess you're not one of those "Don't worry about it" people
Hard to turn off when one's professional job/value is 'worry about things and find ways to efficiently minimize risk'
When I tried OpenClaw it quickly turned into a lethargic mess which I really didn't see myself wanting to maintain long term. I looked at other alternatives which were similar enough to do what I was looking for (mostly scheduled tasks using data on my computer and some API data). I saw a mention of nanoclaw which I looked at but didn't try personally. I eventually settled on trying picoclaw[1] because it was extremely small, fast, and had enough features to do the job for me. It is under 10mb, fairly straight forward go codebase, and works with multiple model providers or locally hosted.
1 https://picoclaw.io/
I’ve concluded that if you already use a coding agent then openclaw adds very little (at least the multiple rounds I’ve tried it since mid Jan), it mainly brought the power of do-everything coding agents to your phone, available everywhere. But you exchange a low quality messaging interface for that ease of access.
Just to be clear, I’m not advocating that people that benefit from openclaw move to coding agents. This isn’t a “dropbox is just SFTP” comment, more that if you are already using coding agents, it feels like they do most of what I saw from openclaw at least a few months ago.
Am I missing something? Would love to be proven wrong.
It's not only that, all this complexity leads to stuff breaking with every update. For a tool that's supposed to just answer chat messages it's impressive how crappy and unstable this software feels. I have it running since the release and my primary usecase seems to be to use the CLI to fix whatever broke this week.
Would not recommend running this, it's the antithesis of the Linux philosophy.
Which features do you require?
I built an agent to work with local Ollama models, and it will keep working and iterate on a goal until finished, but it doesn't do sub-agents or or any of the "just burn a million tokens but finish this" pipelines that seem to be the trend now.
It's a simple D executable that basically consumes no resources in your local machine.
You may be interested in https://nanoclaw.dev/. It uses Claude by default but can run other harnesses after initial setup. Easier to grok IMHO.
There's a lot of similar projects out there that are closer to what you're looking for. For example, I used nanoclaw for a bit before switching to Hermes.
See if you like [Msty Go](https://msty.ai/go)
The story in the "The Daily Claw" thing they are showing is like Claudese dialed up to max
How do people bypass captcha or robot checks? All I wanted is a price aggregator but it always gets blocked by major retailers.
I'm with you here. Every demo I asked for where I knew a captcha / cloudflare would block an AI directed scraper was unsuccessful / produced unsatisfactory results. WebMCP for the win, or loss, depending on your perspective. Personally, I could get behind WebMCP if micropayments ever became a thing. Of course, then my incentive to trick your Agent in crawling millions of pages and paying me lots of cash would be rather high.
https://github.com/Flaresolverr/Flaresolverr
[dead]
It was first, but it's like Langchain built tools first. Nowadays, everyone's got a better assistant. Grok's looks like the most exciting, though I just have a custom built one. Has a headed browser when it wants and everything that I can pop into from my phone. It's so easy to write this kind of software it's a waste to pay someone for it.
How do you deal with auth/bot detection/captchas in that browser? That's where my agent consistently gets stuck
Captchas are handed to me to solve. Because the operations are in the background I usually make the agent be a little more human with typing and navigating. The slowness isn't a concern for backgrounded jobs. It is imperfect, of course, I triggered something on Grainger. And the truth is I should be using Luminati, but it's good enough to be useful to me.
Actually I use Hermes Agent who delegates tasks to OpenClaw. It works perfectly, we run OpenClaw experiments with my partner as an independent drop shipper, it’s much more complicated setup, which cannot disclose publicly, but it works. The brain is Hermes, OpenClaw from VPS is a fearless executor :)
But hermes agent can do whatever openclaw can. At least in my experience. Then why delegate to claw and not just a hermes profile?
I still remember Karpathy's breathless excitement about "claws" and how all autonomous agents would be called "claws" in the future.
Now fast forward six months and nobody uses OpenClaw anymore and nobody is talking about "claws".
I love it.
how many people fall into the openclaw trap because they just need a way to command agents from mobile, and cron tasks? Only thing I am missing with codex is the ability to recall anything from any session (I see it in this openclaw "2" release note so I guess it wasn't in openclaw "1" anyway). I guess claude and codex can look up transcripts globally too, just not as a first class feature.
That is exactly what I'm building pond for myself: one store for all my sessions, Codex and Claude Code both and a bunch of others including OpenClaw, and my agents can access it over MCP. It also happens really often that when my agents cannot find something, they just call pond search themselves. Faster that way. Whenever I need a session from a while ago now, I just know it's in pond. Repo, if you'd be willing to give it a try: github.com/tenequm/pond
[flagged]
Somehow people are suddenly not impressed nor amazed by such announcements…
Maybe because openclaw is a security hazard and an unmaintainable codebase without LLMs?
for various reasons,... but my guess is one can easily have Pi or something similar tuned to one's needs in hours, perhaps minutes.
OpenClaw is a vibecoded mess. Updates break default installation flow all the time.
Accidentally indeed. Im sure it’s tough to do anything intentionally when you are sieving through the slop heaps.
Obligatory question: who is still using OpenClaw? It's been a minor meme about how much discussion about OpenClaw fell of a cliff after March; the Google Trends graph is funny: https://trends.google.com/explore?q=OpenClaw&date=today%201-...
Most people I know use hermes now
All the people you know, or claw users?
Hermes' Github has 12K open issues and 25K pull requests.
I assume they're using agents to sort through all the slop?
Issues and PRs created by agents, triaged by agents, handled by agents?
I remember when everyone was ordering Mac Minis. "How many mac minis you got" down at the local pub. Funny times.
I don't believe this happened.
Why would you go to a pub to talk to people if you have all those agents at home. Especially if one spent money on mac minis in bulk I wouldn't have money to spend on beer at the pub, just get cheap 6-pack from grocery store.
Maybe bar fights enjoyers? Well with bots I just unplug it and I win :)
Everyone is switching to Grok bot that I know, it's the best so far of this kind of stuff.
Hard to keep track of a project that keeps renaming…
LMFAO, all of Wyoming apparently still using OpenClaw. What's up with that?
One thing I really like about Claude Code, Hermes, and other harnesses, is how much feedback they give about what they are doing. They take you along for the ride, which builds trust.
I tried OpenClaw for about 10 minutes, and the feedback I got (even using Claude under the hood) felt very "trust me bro, I've got this" - which made me trust it less.
I'm sure there's a way to get more verbose feedback? But I did feel too out of the loop to feel comfortable.
Sounds like paseo is for you. It wraps whatever harness you want and makes it accessible on the go. I am the same way as you and openclaw is not for me.
https://paseo.sh
Thanks! I've been using happier, but this looks maybe even better
https://happier.dev/
"Hard times create strong programmers, strong programmers create easy times, easy times create vibe coders, and vibe coders create slop."
OpenClaw trend was like Pokémon Go from 2016. A bunch of mindless people followed a trend just because it was a trend.
Why the jab at Pokémon go? It was a really fun time at release
Fun until government contractors bought all the private data it collected with an unknown scope
Context: https://www.theguardian.com/technology/2026/jun/12/pokemon-g...
Imho it say something about you that you see people that experiment with new things as "mindless people". I'll go search for my mind now, thanx.
Did they create test cases, wrote a protocol about the results?
Just trying something out and see what happens isn’t experimenting
That’s exactly what an experiment is.
https://dictionary.cambridge.org/us/dictionary/english/exper...
"a test done in order to learn something or to discover if something works or is true"
A test has usually a hypothesis and a documented result.
Teenagers would experiment a lot less with sex and drugs, if that was the requirement ;)
(Or what would we call the thing the teenagers do?)
Would you call those teenagers mindful?
I a way yes, it is their duty to their future happiness to explore. No doubt some will not word it like that, but I met some that really do (and I envy them, I was indeed a bit mind/clue-less).
Fwiw, I call that experimenting.
And, perhaps in both cases, because they had fun with it?
mindful people as opposed to mindless people don't have fun, they are occupied with bringing value to shareholders /s
Funnily enough, that’s what I expect an Openclaw user to say
[flagged]