-
Ben Badejo (@BenjaminBadejo): "You really are not supposed to install OpenClaw on your personal computer. It needs to be on its own separate computer, Mac Mini or otherwise. It must have its own phone number — one that you install on your phone as a dual eSIM so that you can receive its 2FA SMS codes. It must not have its own iCloud account, to prevent it from reading its 2FA codes itself (on, say, the Messages app on a Mac Mini). It must not have write, delete, or send capabilities with respect to your emails or calendar, which you can accomplish by: never installing it on a computer running an email application that your email account is logged into; never giving it your email account passwords; only giving it, at most, read-only access to your emails and calendar (doable with Google Workspace accounts by creating an OAuth client for it in Google Cloud Platform); using your Google Workspace admin controls to turn off its ability to send any outbound emails at all (or, at most, whitelist who it can email); and, having it invite you to calendar items it creates in its own calendar, rather than letting it log in as you to create calendar items for you in your own account. Listen carefully: OpenClaw is basically a real person you have hired, whose capabilities are vast and fast — in ways both good and potentially bad. But you’ve hired it in the absence of a resume or behavioral background check results. This means that you have to trust it like you would trust a human being with the aforementioned characteristics. As in, not at all. Instead of trust, you must limit what it has access to in the first place. You do not “trust.” You do not even “trust, but verify.” And believe it or not, you also do not “distrust.” You withhold trust altogether. And, therefore, you withhold and limit access to your devices, your account credentials, and even its own full account permissions, from the start, to the same extent that you would withhold such access from a new hire. Would you let a human being with the aforementioned characteristics — brilliant and capable, but lacking a resume or behavioral background check results — directly use your personal computer or your work computer? You would not. Would you give that person your email account passwords? You would not. Would you let it use your phone number for anything? You would not. So, don’t do that." | XCancel
Tue Feb 24 12:29:17 2026 - permalink -
-
https://xcancel.com/BenjaminBadejo/status/2025987544853188836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-