FWIW I mainly use Opus 4.6 on the $100/mo Max plan, and rarely run into these issues. They certainly occur with lower-tier models, with increased frequency the cheaper the model is - as for someone using it for a significant portion of their professional and personal work, I don’t really understand why this continues to be a widespread issue. Thoroughly vetting Plan Mode output also seems like an easy resolution to this issue, which most devs should be doing anyways IMO (e.g. `npm install random-auth-package`).
I really don’t understand the widespread adoption of OpenClaw when a simple prompt injection in an email, chat message, or calendar event has the potential to leak the credentials/keys for every attached service.
There are going to be some incredible blow ups due to this. From the sound of it people think they're safe by running it with local models and keeping it on their own network but seem to have zero concept of a malicious text prompt finding its way in and turning it into a double agent who figures out how to exfiltrate data.
This... OpenClaw is the best thing to happen to security and forensic firms since Windows XP. The amount of hacks, data/credential leaks, etc to come out of this will be of unfathomable proportions.
Paradoxically this is good in long term. A series of massive fuckups reported by mainstream media has more educational value than disclaimers or warnings by competent people.
The golden age is over. It’s a saddening experience watching something you care about, and your opportunities to build a career and life around it, fade away. The reasons for this are numerous, (like you mentioned; ZIRP, COVID, etc) but the ultimate irony IMO was the layoffs/AI push being an industry-driven nail in the industry’s own coffin.
There’s also something to be said about the industry’s faltering after the social era, a period which largely began the degradation of Big Tech’s public image, which was worsened even more by the overcorrection into Crypto/Web3, and finally through AI - which feels just as forced as the previous era was.
You can clearly run the provided gist. Calling “You are OpenCode” in the system prompt fails, but not if you replace the name with another tool name (e.g. “You are Cursor”, “You are Devin”). Pretty blatant difference in behavior based on a blacklisted value.
This is not how business is conducted in real world. You can’t just hack something together and expect the other party to let you “get away” with it indefinitely. If your product relies on some other vendor, then do it properly with ACTUAL contracts. People in tech can be so entitled.
I feel like it’s not talked about enough that the ultimate irony of software engineering is that, as an industry, it’s aiming to make itself obsolete as much as possible. I struggle to think of any other industry that, completely on their own accord, has actively pushed to put themselves out of work to such a degree.
reply