LLMs are pattern-matching machines. They keep the pattern going. Once "the agent disobeys the human's instructions" has made its way into the context, that is the pattern that it's going to keep matching. No amount of telling it to stop will make it stop.

The only possible solution is excising it from context and replacing it with examples of it doing the right thing. Given that these models have massive context windows now and much of the output is hidden from the user, that's becoming less viable.

This is too funny to not laugh at the absurdity of "safety and alignment" researchers blindly trusting agents like Claw without fully understanding. Or maybe they were researching.

Moral outrage about how everything is in decline is absolutely the viral currency of social media and HN is no exception. I find it amazing how few people doubt the sincerity of the original post. Probably hundreds of thousands of aggregate words spent on how everything is going downhill, but not one on the intentions of the original post.

It’s even more unbelievable that they seem to think instructions are rules it will follow.

To paraphrase Captain Barbossa: “They’re more guidelines than actual rules.”

Has anyone tried something like this? Do you think it's a good idea / architecture?

More cloud services now need role accounts. You need a "can read email but not send or forward" account, for example. And "can send only to this read-only contacts list".

But I wonder what things these people approve for Claude code and it's equivalents? Where's the line?

https://github.com/skorokithakis/stavrobot

Obviously, it can't do everything OpenClaw can, because it doesn't have unfettered access to data you don't even know it has, but it'll only have access to the data you give it access to.

It's been really useful for me, hopefully it'll be useful to someone here.

Anyone security-conscious would isolate it on dedicated hardware (old laptop, Raspberry Pi, etc.) with a separate network and chat surface.

This example is, as of this moment, the only example that has communicated to me that February 2026's local agent harnesses have some utility in the right context and expert hands.

I was particularly bolstered by the unintentional but very real demonstration of how LLMs really can be leveraged to free up humans to spend more parent time with their infants. We spend a lot of characters lamenting how we never got jetpacks, so here's someone doing it right.

Edit an hour later: this comment is at -2 as of the time I'm writing this, but apparently those folks don't have anything to say about why this felt important to rail against.

Small upside: it saves a few minutes here and there on some tasks (eg. checking into flights)

Massive tail-risk downside: it does something like what's linked in the tweet (eg. deletes my entire inbox)

https://youtu.be/8uP2IrP3IG8

We have enough assistants, the key idea with opeclaw is it can do stuff instead of talk with what you have. It’s terrible security but that’s the only way it makes sense. Otherwise it’s just a lot of hoops to combine cron jobs with a AI agent on the cloud that can do things an report back.

Not that I think anyone should do it, it’s a recipe for disaster

I would still not want the LLM to have read access to email. Email is a primary vector for prompt injection and also used for password resets.

Sentence could have ended there

> if i had your job they would have had to waterboard this interaction out of me

    Listen carefully: OpenClaw is basically a real person you have hired, whose capabilities are vast and fast — in ways both good and potentially bad. But you’ve hired it in the absence of a resume or behavioral background check results. 

And also, when it says "You're absolutely right! I disobeyed your direct instructions causing irreparable damage, so sorry, that totes won't happen again, pinky promise!", those are just some words, not actually a meaningful apology or promise to not disobey future instructions.

Personally, I question the usefulness of an AI assistant that can't even be trusted to add an entry to my calendar.

    you withhold and limit access to your devices, your account credentials, and even its own full account permissions, from the start, to the same extent that you would withhold such access from a new hire.

What's the point of hiring a personal assistant who is incapable of sending email? Isn't that precisely what you hire a PA to do?

    Would you let a human being with the aforementioned characteristics — brilliant and capable, but lacking a resume or behavioral background check results — directly use your personal computer or your work computer?