My single most important learning after installing, customizing and working with @openclaw and @Gavriel_Cohen's nanoclaw:
The biggest risk was hiding in plain sight. And the only way to discover it was by actually exploring claws.
In order to make my point, I first need to briefly walk you through some of the "known unknowns" risks that I had on my radar:
Fear 1: That claws would be simply useless and I would have to face the social shame of trying something that really was just a joke. (Turns out, it IS actually very engaging, useful and even fun.)
Fear 2: Having credentials such as API keys and auth profiles on the server (to make claws actually useful) and then getting those credentials stolen and abused. (Could still happen, but also easily managed with spending limits.)
Fear 3: Customizing my assistant with code and skills from the internet which would lead to any of the above and more subtle attacks such as semantic worms, anti-memetic ███████, cognitive root-kits etc. (Could and probably will happen but we'll deal with it when that is the case)
However. ALL of my fears were DWARVED by the biggest, unanticipated, unmonitored and unmanaged blind spot:
THE FUCKING UTTERLY INSANE TOKEN BURN AND POTENTIAL LOSS OF MY ANTHROPIC MAX SUBSCRIPTION!
In hindsight, it literally sat there right smack in the middle of all the other fears and risks.
And at the same time, I did not have this on my radar AT ALL.
And of course: Once I was aware of it (Thank you @RealistSec for your help), I could start managing it.
My personal solution is that I've given my assistant the ability to sleep, dream and forget. Meaning, at night, a cron-job takes the session data from the previous day, checks for a few important bits to remember and then clears out all session storage. In the morning, the agent starts out fresh and with a free mind.
But my solution isn't what matters here. What matters to me is that I was reminded how action produces information. And that the things that actually hurt often are not what we anticipated. And that the peeps at @AnthropicAI stayed cool (thank you) while a few of their servers went up in flames.
So. That's what I've learned with all of this.
Just wanted to share it :)
