alt Hacker NewsThe risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models.
I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.
Replies
Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in.
Also any longer running agent can lose track of the original prompt and start going off the rails.
Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ".
And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.
There must be a bulk discount on those mindcuffs, considering there's a prompt injection or a related confused deputy story on HN every other day.
Literally from hours ago: https://news.ycombinator.com/item?id=49506819
Even if you believe that they can't be tricked directly, consider that these things will happily build a small node.js app in the background just to fulfill some request, run npm install... and that might've already compromised you if you're only somewhat unlucky.