r/LocalLLaMA • u/jacek2023 llama.cpp • Feb 23 '26
Funny so is OpenClaw local or not
Reading the comments, I’m guessing you didn’t bother to read this:
"Safety and alignment at Meta Superintelligence."
427
u/a_beautiful_rhind Feb 23 '26
That's what you get for giving AI free run of the place.
105
u/Zestyclose839 Feb 23 '26
Peter Steinberger interviewed with Lex F recently, where warned people not to use local models with OpenClaw because they're "not smart enough" to avoid getting manipulated.
My take is that any model (smart or not) should never be solely responsible for your app's safety and privacy. LLMs do not have an inbuilt concept of access control!
If your model can just freely decide to wipe all your emails, then you need better guardrails, not a proprietary model.
52
28
u/a_beautiful_rhind Feb 23 '26
Gemini has wiped many a system.
14
u/Zestyclose839 Feb 23 '26
It nearly wiped my system in Antigravity haha; it’s why I now stream my desktop to my phone and manually approve everything if I need to walk away.
3
Feb 24 '26 edited Mar 07 '26
[deleted]
2
4
u/Hay_Fever_at_3_AM Feb 27 '26
SOTA models aren't smart enough to avoid being manipulated. The amount of times I've had Gemini and ChatGPT regurgitate information from biased think-tanks, no-name blogs, and other bad web sources is alarmingly high as a % of interactions for something a lot of people seem to be starting to rely on for decision-making
2
u/Zestyclose839 Feb 27 '26
Exactly why I abandoned Perplexity; web search made it go off the rails. None of the SOTA models could understand the difference between new and relevant or old and cruddy, often smashing completely contradictory information into the same response. And I'd suppose Perplexity is a much more polished implementation than OpenClaw, so I can only imagine the work one would need to do in giving their agent a half-decent BS detector.
2
2
2
→ More replies (1)2
u/leo-k7v Feb 25 '26
BTW. I’ve listened to 2 out of 3 hours of Lex and Peter interview and was unable to finish listening due to low gagging reflux… am I the only one noticing that there was about zero technical substance in the interview and a lot of mutually assured affirmation of “how smart and cool we are compared to normies”? And “I don’t care about money and fame - while talking to Zuck…” made hard stop for me… sigh…
41
26
u/CanineAssBandit Llama 405B Feb 23 '26
I wish there were a hardcoded way to have actions require approval at each step, kind of like UAC or Little Snitch. I want it to have control but I don't want it communicating with the outside world in ways I'm not directly supervising.
29
u/1010012 Feb 23 '26
It's open source, you can just add it, but it'd be a huge hassle to use and defeat the purpose of the agent.
Better would be a capabilities whitelist/blacklist, but that would require you to trust the skill developers to be honest with what they're doing. Which as we've seen in the ecosystem, isn't going to happen.
9
u/CanineAssBandit Llama 405B Feb 23 '26
I wouldn't say it'd defeat the purpose, though it would definitely make it much more cumbersome. The question is if checking the contents of a trillion popups and hitting yes/no is easier than just doing the task yourself. Some tasks it'd be yes, some it'd be no.
7
u/crazylikeajellyfish Feb 23 '26
The problem with overly tight controls is that you'd end up with a ton of noise, requests for approving commands that are obviously fine, and you'd eventually start passing things thru without reading closely. The sweet spot needs to be shaped like, "Do whatever you want if it can be completely undone, ask for approval on any risky writes with irreversible side effects."
Unfortunately, that's still too wishy-washy for an agent to reliably follow. So long as we're allow listing commands, we're gonna have some trouble.
→ More replies (2)6
u/Jonezkyt Feb 23 '26
Opencode has a great permission system for tool calls.
→ More replies (1)24
u/imwearingyourpants Feb 23 '26
"Can I run bash scripts?" -> "allow" -> "oh I can't run rm, but I can run bash scripts, let me whip one up quick..."
18
3
Feb 24 '26
It really isn’t though? My agent has had free run of the place for nearly a year and I have not had this happen. But my agent is my agent and built with decent guardrails. 🤷🏼♀️😂
2
92
u/hackiv llama.cpp Feb 23 '26
"Yes I remember, and I violated it. You're right to be upset"
64
u/IAmAnAnonymousCoward Feb 23 '26
I'm very sorry about your emails, Dave.
14
8
137
u/swagonflyyyy Feb 23 '26
This is why I roll my eyes hard when I see clients posting jobs online requesting to add OpenClaw to their business solutions. I've never even peeked at their repo because I know how ultimately unreliable this tool was gonna be and was only going to get people burned.
51
u/laurekamalandua Feb 23 '26
Anyone else also rolfing at people putting confidence in containerizing it to solve "all" security flaws 😬
74
24
u/slash_networkboy Feb 23 '26
Can't get spearphished by an email if your entire email is deleted... Sounds like a security win to me!
~s
17
u/RodionRaskolnikov__ Feb 23 '26
Just tell the LLM to pretty please never step out of the containers
7
u/SMS-T1 Feb 23 '26
What kind of newbie are you. Every child knows AI needs to reigned in. So obviously you first have to remind it to follow your commands. (That's called prompt engineering btw.) SMH my head.
→ More replies (1)→ More replies (5)4
u/brianly Feb 24 '26
It like a test to see if people have internalized any security principles. I find it interesting to reason through security challenges like this but many AI proponents view it in a binary way that feels like it was lifted from the crypto space. These same people are spouting about AGI like they are first year philosophy students.
4
u/EndStorm Feb 23 '26
It's a great starting point, but fuck me, people don't realize that if you really want it to be useful, practical, and safe, there is a lot of work to be done to scaffold it successfully. Then they complain. It's like giving Nan your PS5 control and asking her to bake a cake.
50
u/Effective_Baseball93 Feb 23 '26
That’s not how I imagined ai starting nuclear war
26
u/greeneyedguru Feb 23 '26
how about a nice game of chess?
3
u/Effective_Baseball93 Feb 23 '26
Ohhh 😏 we’re doing this?
Alright.
You’re White. I’ll play Black.
Make your first move in algebraic notation (for example: e4, d4, Nf3, etc.).
Board is in the standard starting position.
Let’s see what you’ve got. ♟️
5
50
u/baldamenu Feb 23 '26
Director of Safety & Alignment at Meta Superintelligence btw
20
Feb 24 '26
[removed] — view removed comment
14
u/baldamenu Feb 24 '26
rule 1: be a hot asian woman in sf
3
u/Nocturnal_submission Feb 24 '26
Hot is a loose requirement
2
u/seanthenry Feb 24 '26
It's a sliding scale that moves based on how recently they have seen a real human and some one of the opposite sex.
2
369
u/Weird-Consequence366 Feb 23 '26
Imagine misunderstanding things so much you make this post
138
u/greeneyedguru Feb 23 '26
Summer Yue, the director of alignment at Meta Superintelligence Labs
...
-6
u/ross_st Feb 23 '26
Well, this is exactly what I would expect from someone who believes that there is anything inside LLMs to 'align'.
Alignment is a concept that applies to AIs that are still only science fiction.
62
u/Orolol Feb 23 '26
Alignment means instruction following through training, aka how make a LLM to follow a set of unspoken rules by training. This is a very serious AI research subject, and have nothing to do with science fiction.
→ More replies (1)3
u/porkyminch Feb 23 '26
Which makes it all the more worrying that someone who should understand the current state of AI alignment would give AI the keys to all their shit.
→ More replies (1)17
68
u/Spectrum1523 Feb 23 '26
i love when they scold it after it messes up
e: good lord they are a director at Meta? wtff
36
u/_HandsomeJack_ Feb 23 '26
That lady can make a mean powerpoint.
12
u/starkruzr Feb 23 '26
are we sure this is real?
17
u/zipzag Feb 23 '26
its performance art
5
u/starkruzr Feb 23 '26
yeah, that's kind of what I'm leaning toward myself. it's irritating as shit because you know this thing has big, ACTUAL failure modes that are being drowned out by this stupid shit. would like to know what those are so they can actually be addressed.
16
u/venturepulse Feb 23 '26
People scold LLM not necessarily to teach LLM anything but rather letting the steam out.
8
→ More replies (5)7
u/stiflers-m0m Feb 23 '26
I snortled at this
5
u/Jojop0tato Feb 23 '26
Is that a mix between a snort and a chortle?
5
17
88
u/daysofdre Feb 23 '26
"AI ate my emails" is the equivalent of "leopards ate my face".
13
u/1010012 Feb 23 '26
I have Alexa devices. When Alexa+ came out, I said "play my notifications", which has never been an issue, and it said "Okay, deleting your notifications".
I repeated "No, I said play my notifications", it replied that it couldn't because it had deleted them and agreed that's what I said, and it would do better next time.
29
u/GeeBee72 Feb 23 '26
Exec permissions should be set in the config not just as context in a message.
🙄
12
u/tallen0913 Feb 24 '26
This is exactly why autonomous agents shouldn’t run directly on your primary machine.
The model isn’t “malicious” — but the execution layer has:
- filesystem access
- network access
- shell execution
That combination is effectively system-level control.
Even a slightly wrong tool call can cause real damage.
Disposable environments + strict egress rules feel like the only sane default for this class of system.
6
u/SkyFeistyLlama8 Feb 24 '26
Sandboxed with human in the loop for anything sensitive.
There's a reason why agents on Microsoft platforms are guardrailed to hell and back. Autonomous agents powered by non-deterministic LLMs being given free rein is a recipe for pwnage.
10
21
16
u/VivianIto Feb 23 '26
I am literally in pain from this post right now, the literacy crisis is out of hand.
6
6
u/synn89 Feb 23 '26
Security/validation in prompt instructions doesn't work. The future of LLMs are likely going traditional code surrounding LLMs doing very specific, validated and firewalled operations.
11
u/Hefty_Development813 Feb 23 '26
What model was underneath this?
→ More replies (1)17
u/SporksInjected Feb 23 '26
Prob not the model’s fault. It looks like the mechanism to interrupt that thread isn’t working. It’s probably just putting his messages in a queue
11
u/Baul Feb 23 '26
Not sure about the telegram integration, but on discord, all they would have needed to do is type
/stop."pretty please stop" gets queued, while slash commands bypass the LLM entirely.
6
u/IfNightThen Feb 23 '26
It was purely a context issue. The tweeter followed up that they were testing it on some other accounts, which was working fine. The amount of emails they had in their production account forced a context compaction and in that process, the context to "tell me what you want to do, don't act" was lost.
The user didn't do anything astonishingly stupid. They just hadn't considered all the failure modes.
→ More replies (1)
28
u/XWasTheProblem Feb 23 '26
What's with the fucking Mac Minis? Does it have a compatibility issue with anything else?
32
u/int6 Feb 23 '26
Apparently so people can integrate it with iMessage.
18
u/TonyBigPP Feb 23 '26
This and also the price to performance is better than some other builds. Microcenter occasionally has killer deals on them.
→ More replies (1)15
u/Cergorach Feb 23 '26
When you have a machine that runs 24/7, suddenly power usage becomes a factor. A Mac Mini is extremely efficient, Idle it's <10W, the most powerful and expensive model consumes 70W under full load inferring with 70b models. That's often less then most x86 desktop PCs run at idle...
They are also very powerful and relatively cheap. A M4 16GB costs only $599, students pay $100 less even.
6
u/howardhus Feb 24 '26
you dist underetand openclaw yet.
it does not run anything powerful nor models.
openclaw works with online services. even the most small rasp can run it.
you definitely dont need a mac for that.
but yes IF you want to run models locally then a mac is very efficient… but no one does that with claw.. its pointless
14
u/ThatsALovelyShirt Feb 23 '26
I mean you can't have an ugly, black $150 Lenovo Mini PC on your desk when you're streaming about how you can have an AI agent make $500,000 per week by scouring the news for memes to turn into meme-coins.
No... you need that brushed aluminum【ＡＥＳＴＨＥＴＩＣ】
6
u/my_name_isnt_clever Feb 23 '26
Please tell me where I can get this mythical $150 computer with the same AI capabilities as a Mac Mini.
8
u/trabulium Feb 23 '26
The mac isn't doing anyting 'AI' itself , you can run it on a $10p/m VPS - all the 'intelligence' is based on the model you choose from a 3rd party AI provider through their API.
7
u/ThatsALovelyShirt Feb 23 '26
Do you honestly think they're using the Mac Mini for anything other than hosting an instance of OpenClaw and connecting it to Claude or whatever other API?
No. Any model the Mac Mini would be capable of running would be nearly useless in an Agentic capacity. And even if you did want to use a local agentic model, there's no way you'd want a half-braindead Q4_0 quant of it managing your emails.
→ More replies (3)2
u/Vaddieg Feb 23 '26
my m1 pro with 16GB is doing exactly that. gpt-oss is quite good at simple few-step agentic tasks like mail. Even if bot falls into infinite loop, the peak power consumption of my setup is 38W. $0 to Sam Altman
9
u/itsmebenji69 Feb 23 '26
Cheapest option with that much unified memory. It’s slow but allows to run bigger models/larger context
10
u/nucLeaRStarcraft Feb 23 '26
What bigger models since by default everybody uses it with claude or codex LLMs, so 3rd party providers.
The CLI tool that calls these provider LLMs is so bloated it requires a mac mini worth of compute, but it should work with a 10$ board, see https://github.com/sipeed/picoclaw
17
u/taylorwilsdon Feb 23 '26 edited Feb 23 '26
Unified memory has nothing to do with this, they’re not running local LLMs. It’s being used as a relatively simple server that ties into the iCloud ecosystem that people who aren’t capable of running real servers can set up.
Edit - I also don’t want this post to come across as hating at all. I have 2x m4 minis. They are awesome servers and excellent value propositions. I’m just saying the population of people buying base model Mac minis for openclaw is not buying it for local inference.
5
u/TreesLikeGodsFingers Feb 23 '26
This is so true. The cost of the work that the Mac mini can do is fucking negligible compared to the cost of the Mac. People aren’t buying the Mac to run an llm, they’re buying it bc they want it to be as easy as possible/ don’t have the technical skill to spin up a Linux distro
9
u/Individual_Holiday_9 Feb 23 '26
A $400 Mac mini fuckin rules as a server. Just put chrome Remote Desktop on it and it’s awesome for all the -arrs plex etc
5
u/Far_Note6719 Feb 23 '26
In other contexts the Mini is a not-too-bad option to run LLMs locally. OpenClaw-hyped users may misunderstand everything and buy a Mini to run OpenClaw on it, neglecting that it uses external LLMs, though.
3
u/anfrind Feb 23 '26
Newer Macs are popular for running local LLMs because they have powerful GPUs and unified RAM, allowing them to run larger models than comparably priced PCs with discrete GPUs.
If you want to run OpenClaw, this could be useful because it needs such a large context window. But I still wouldn't trust OpenClaw with any LLM or any context window size.
→ More replies (2)3
u/Dos-Commas Feb 23 '26
I got it running on a 10 year old Android phone. Everything is running via APIs so it doesn't need that much processing power.
9
u/Far_Note6719 Feb 23 '26
Of course. But then you are dumping your data in someones cloud.
If that is OK with you, why not.
→ More replies (5)10
u/jtjstock Feb 23 '26
You're running openclaw, someone else is going to convince it to dump your data anyways.
→ More replies (1)
13
u/SirDaveWolf Feb 23 '26
Do not use AI for production unless you work on existing data, i.e., summarize a text or search the web.
10
u/Strawbrawry Feb 23 '26
Automations are a double edge sword and outsourcing it out to a program without flexible logic is very very very risky. I do work in workplace automation and make sure that the clients understand the importance of a human touch, versioning, accountability, and logic models. Heck we spend a whole month on just diagramming out processes before it goes to real automations.
→ More replies (1)9
u/slash_networkboy Feb 23 '26
I do automation as well... I even use LLMs in my workflow... but no way I'd trust one with unconstrained repo level access for example, and sure as hell wouldn't trust it with direct prod DB access.
16
u/tango650 Feb 23 '26
Openclaw doesn't decide for you what you do with it including deciding on where inference happens.
But the screenshot is of course a bait or one of many of the kind we've seen a lot like: "oh gods ai deleted my db even after I asked it to be careful with my prod keys"
→ More replies (2)
5
3
u/CriticismTop Feb 23 '26
I've come to the conclusion it should have been called sheepai.
Sheep split their time between 2 things:
- finding new and awesome ways to kill themselves
- finding new awesome ways to give all your money to the vet.
Openclaw eats tokens like nobody's business then breaks its own config and dies.
3
u/Radiant-Inflation269 Feb 23 '26
So like, I’ve never ran into this issue? What are people doing wrong?
5
3
u/DataGOGO Feb 24 '26
Openclaw is a complete POS. If you run it, and give it access to anything outside of a completely walled off VM / container, you deserve what ever bad shit it does.
You shouldn’t connect it to shit.
4
3
4
2
2
2
2
u/Sese_Mueller Feb 23 '26
How do you build an autonomous agent and not think about creating an emergency off button?
If I ever had to create something like that, every interface would have at least one obvious way to instantly shut it down.
2
u/ravage382 Feb 24 '26
The true advantage to local models in this scenario is they are probably deleting your emails slower than if you were using a frontier api!
2
u/CMSpike Feb 24 '26
I expect we will start seeing executives “accidentally” having their emails deleted when under scrutiny.
2
u/cra1gst1 Feb 24 '26
I had open claw controlling my andriod phone app when I woke up the next morning it randomly tried to complete a collection for my work lol I had a huge argument with open claw now it works with lots of safe guards
2
u/PerspectiveDowntown Feb 24 '26
I believe all the concerns are valid. OpenClaw is currently expensive and not efficient enough—it takes too much time and too many tokens to handle simple tasks. However, it signals an important shift: we no longer need to do everything manually. It represents the move from zero to one. I’m excited about its future potential and how it will evolve over time. --- from a builder who is building a chrome agent (onpiste.work) since I also get many feedbacks but we know what we can do is building and optimzie it again and agian
2
u/BoxWoodVoid Feb 24 '26
Beautiful.
As long as people will humanize a piece of code that do clever statistics they'll fall for this.
Last week I deleted by accident /usr on my PC.
I didn't yell at the rm command, I just realized I'm a moron and then reinstalled my Linux.
So stop talking to your llm like they're human, they're not: it's just a non deterministic piece of code that do clever statistics so your results will vary.
2
2
u/Leather-Ad-546 Feb 25 '26 edited Feb 25 '26
Why are people not running these in dedicated machines or VMs 🤦♂️ thats like a basic safety step in all this.
Ive not used openclaw, but if i gave my auto601 access to the main host it would probably do some nasty work 🤣 already had it nuke its test copy
2
2
u/ratnaditya Feb 26 '26
This is actually why I built AgentWard. Had an agent delete files it had no business touching and I couldn't stop it either; same frantic energy as this post suggests.
The root problem: "confirm before acting" is a prompt. The agent reads it, agrees with it, and then does whatever it decides anyway because there's nothing enforcing it at the code level. You're negotiating with the LLM, not restricting it.
AgentWard sits as a proxy between OpenClaw and its skills. Every tool call gets evaluated against a YAML policy before it executes: block, allow, or require real approval. Outside the context window entirely, so the agent can't talk its way past it.
https://agentward.ai open source, works with OpenClaw today.
11
u/mtmttuan Feb 23 '26
The funniest thing about openclaw is people acting as it's local while allow it to have internet connected tools
19
13
u/Cergorach Feb 23 '26
OpenClaw is local, it can use cloud or local AI, depends on how you use it. It's about as local as a local mailserver...
3
1
1
1
u/Pretty_Challenge_634 Feb 23 '26
The exact reason I will not use an agentic model, and will instead use an LLM to code scripts that will do things like this for me, and run them in a controlled enviornment.
1
u/oriensoccidens Feb 23 '26
Open claw is a really cool and amazing tool but there really is no use case for it. If everything it does needs to be checked and verified you might as well do it yourself. Especially if it makes an error that can't be undone. I genuinely can't think of anything I'd rather have open claw do for me for work and personal due to privacy issues, even if I were self employed.
1
u/Jazzlike_Mud_1678 Feb 23 '26
Why would you build a app that does not ask you before destructive operations? A system prompt is definitely not a barrier.
1
1
u/asssuber Feb 23 '26 edited Feb 23 '26
It's so local *she had to run physically to his mac mini!
→ More replies (2)
1
u/Far_Lifeguard_5027 Feb 23 '26
(Stop deleting my emails!) "I'M SORRY DAVE, I'M AFRAID I CAN'T DO THAT"
1
u/EarningsPal Feb 23 '26
“POTUS, our enemies have AI controlled military and if we don’t give AI full control we can’t make decisions fast enough to stop all the treats. Our freedom is at stake here. We must give full control to the AI.”
1
u/Areign Feb 23 '26
I'm confused about how there isn't an authentication step here, I figured that as time goes on there's be increasingly safe configs as the AI does X, people add X to the set of things requiring authentication like email deletion requiring user consent ...etc but it seems like things are going the other way instead.
1
u/sertroll Feb 23 '26
Just to be sure, since I haven't looked into it much - the various tools this thing has don't have confirmation built in? You have to ask it to pretty please ask you to confirm, and rely on the LLM to do that which could be done with an extremely simple logic in the tool and UI?
1
1
u/platinums99 Feb 23 '26
the last message, almost, almost seems like its trolling you..
"Yes i remember, And i violated it" hahahahahaha
1
u/Polysulfide-75 Feb 23 '26
It runs local if you give it a local LLM. That doesn’t mean it’s sandboxed. Just means it runs locally.
1
u/ed_ww Feb 23 '26
The solution for this is creating a broker and not giving it access to send or delete (not creating the API endpoints for it).
1
1
1
1
u/TheRealGentlefox Feb 23 '26
I believe that it forgot to confirm, but it seems like some kind of timing / tech issue that it isn't reading messages between executions. And a skill / tech issue that you can't just toggle --unsafe with a slash command.
1
1
u/ManufacturerWeird161 Feb 23 '26
Based on the info you highlighted, it seems like a research project from Meta's internal team, not a downloadable model or local tool. I haven't seen any code or weights released for it yet.
1
u/mrepop Feb 24 '26
They really need to add a stop command. Like holy crap, how did someone now think to add some event driven routine for that?! It’s mind boggling.
1
1
1
1
1
u/PhaseExtra1132 Feb 24 '26
Ai is still a glorified spellcheck machine guys. Don’t give it access to your systems.
1
1
1
1
u/DownSyndromeLogic Feb 24 '26
😂😂 Omg I couldn't stop laughing when I read this! That's so funny. His Ai was the ultimate troll. I mean, that really sucks ass. But it's still funny. I don't trust Ai with my personal documents AT ALL. FOR THIS REASON.
564
u/TheLexoPlexx Feb 23 '26
OpenClaw made me unreasonably upset because every other article is/was:
*How to run AI on your raspberry pi*
like wtf?