"I Wouldn't Give Open Claw My Passwords" — George Zeng

Transcript

Welcome back to the rollup. I'm Robbie. >> I'm Andy. Rob and I met at the University of Florida in 2017 [music] where we first found out about digital assets. >> We learned a lot along the way and we're bringing you face to face with the leaders of our industry. Sit back, relax, and enjoy today's episode. >> Is the whole team wearing the leather jackets today? >> You know, it's not an AI keynote unless there's a leather jacket. >> All right. [laughter] I believe you. I believe you. I believe you man. >> I think I Jensen set the tone. So, you know, uh you got to do what you got to do. policy. How's how's the how's the event treating you?

>> The event's been fantastic. Um, just having the energy here has been great. I mean, if you're going to build anything in AI and frankly in crypto, San Francisco is the place to do it. And given just all the history, given the fact that uh near started here, given the fact it was headquartered here before, given just the history we have with all the companies here, it's fantastic to be back. >> Yeah. Incredible. Well, there's uh been quite a few people that have come in here. We've been talking about AI all the way from the the bare metal of the stack all the way through to Near AI which you guys have just launched uh which is I think live for everyone to try out now. You were just on stage talking about it.

>> Yeah. Go on ironclaw.com and deploy your own secure agent. >> I tried to and damn it is hard to write Rus code in for a non-programmer. It was like I was talking to Claude about it and I was like all right so I've got openclaw here but I kind of want to set up ironclaw instead. Can we do that? And then like Cloud was like, "Well, you can, but Rust is extremely hard, but here's all the steps." And then I downloaded Rust on my terminal. And then I tried and then that's kind of where I got stuck. >> Oh, if you go on ironclaw.com, um, this is actually launching an agent within a CDM.

>> So you don't actually have to download Rust at all. You don't have to do anything with terminal. You press two buttons and then you basically are up and running with the Rust agent. >> So I call unleash your AI agent with peace of mind. So you can just deploy now. You can sign in with near or Google and I must agree to the terms [snorts] of conditions. Of course, I'll read all of that later. >> Of course. >> Uh and then I [laughter] read >> and then I can activate my agent. I can choose from OpenClaw. I can choose from ironclaw, which is still in alpha. Yep, but it has a lightweight runtime, structured tasks, sessionbased runs, APIdriven framework. And it looks like you guys are subsidizing a starter plan for $0 a month. Yeah. It's completely free.

>> Yeah. Why pay $3,000 for a Mac Mini, wait three weeks, have it delivered to your door, and then buy inference and set up like a technical setup. Press three buttons and get started right away. >> Yeah. Incredible. Okay. So, you you put in your your card, but it is actually free. So, all we Well, so so once we put in our card and we end up deploying the agent, let's say we choose ironclaw and not openclaw. Maybe we'll start there. What are the differences at the high, you know, between openclaw and ironclaw when we're going to ironclaw.com to to deploy our >> Yeah, I love the lore behind this. So, the lore behind this is one night G I was feeding his baby and he was looking at the OpenClaw code and he thought to himself, this is not right. It's not secure. We have to rewrite this in Rust.

So he wrote the first version of ironclaw while feeding his baby. [laughter] >> Well, typing typing into his like four to eight >> coding agents. >> Yeah, I feel the worst version of this. >> Who would ever code themselves? [laughter] >> I've started to realize through this entire day that I have way too many humanoriented tasks and not enough agents. >> It's kind of amazing. You can really have four, five, six, seven, eight agents running to do different things for you at all hours of the day. Yeah. >> Yeah.

>> I think people struggle with what they need the agents to do. >> Um >> like yes people like oh like I you know you know I got open claw and uh you know I've got all these things that but like most people have no idea what they even want the agent to do. >> You know I think that this is largely an education issue. I think people don't know what agents are capable of doing yet. >> Um but I've had friends get agents to find them apartments in San Francisco. >> Okay. I've had friends who used agents to I I think I've read a Twitter post about a person who used an agent to help him with his dating life. Wow. NSF, which we all know ends up being a problem for many people in San Francisco. [snorts] >> Um, and then obviously agents are really

great for coding. >> Of course. Yeah. >> So, if you roll back to the first version of Ironclaw, Yeah. Ilia was architecting this while on night duty, helping to sort of feed his baby with four different eight different agents. And what we realized pretty quickly was that open claw is fantastic. It's a great open source product. Um it is something that came [snorts] out of like you know the genius of people wanting to hack something together that's like very useful and moves very fast, >> right? >> But is not secure. I would not give my one password passwords to open call.

>> No, I wouldn't either. >> But we wanted to actually make ironclaw secure enough where you could do that. >> So we rebuilt it in Russ instead of Typescript. uh better memory management from a safety perspective. We ended up uh making essentially per tool um sandboxing. We ended up uh making sure that we had prompt injection protection at the architectural level, >> right? >> And we just ended up doing a lot of other stuff. Obviously, you can sort of put your secrets in secured uh encrypted sort of this. You can use confidential infrance >> instead of inference that doesn't go through these trusted execution environments, >> right? And it's just a lot more secure.

>> I feel a lot more comfortable giving my email, my my notion, my Slack to ironclaw than I do to OpenClaw. >> Wow. >> Wow. >> Yeah, that's insane. >> Looking for yield that stands out? Infinify gives you just that. Deposit stable coins and earn far more than the current savings rate. Infinify is a battle tested, reliable DeFi platform that is ready to go. Head to infinifi.xyz. Go anywhere onchain instantly with Relay.Link. Relay is closing in on 10 billion dollars [music] transferred. Go to relay.link to bridge your assets.

Now, >> okay. So, um let's say that I want to talk to uh ironclaw and give it access to personal information. >> Yeah. >> The thing with openclaw that you hear is don't let it have access to like your WhatsApp and your telegram and your Gmail because it can like take control of it and you know do go rogue. I think just last week we saw a woman that worked at OpenAI had all of her emails be deleted by her open claw. >> Oh, this is the meta meta. She ripped her she ripped her um plug out of her computer because she didn't know how to hard stop it on terminal.

>> So like is the I understand the privacy capabilities and the security uh capability differentiation, but is the actual ability for the ironclaw to go rogue less is there less of that ability or is it that that same kind of baseline? So a lot of what ended up happening with um the specific example you cited about the AI going rogue was a function of the model >> right it's the a person using an open claw agent ended up giving a lot of permissions and then the model ended up making a lot of poor decisions right so there's a fair amount of stuff that you have to fix at the model level right and that's going to be the case for ironclaw or openclaw which is if you have a model that's doing silly things where you gave

it permission to your email and whatnot can still do silly things. >> Yeah. >> At the same time, what Open Claw is really protecting against [snorts] is um call it different toolbased sandbox. Um not giving certain sensitive information that you don't want to give to an agent like let's say your secrets, let's say your uh your private keys. Yeah. >> Other kinds of sensitive information. >> Um [snorts] memory protection as well as protection against prompt injections. That's like the the core area where ironclaw is making headways and making innovations. Okay.

>> Not on the actually improving the core underlying model, >> right? But like so if there's [snorts] a prompt injection that comes off of off of a social media site or another agent who tries to uh kind of maliciously uh screw around with with [snorts] my agent, uh Ironclaw has preventative, you know, kind of uh in infrastructure to prevent that. >> Correct. >> That injection on mine. there are more safeguards at the architectural level in our call than >> so so then therefore giving it access to your WhatsApp could be more uh you know encouraged than on open >> yeah like we've given it a bunch of us have given in our calls access to notion or notions or our slacks I don't think I would have done that with open claw

>> yeah and so the biggest risk is like I run a set of malicious agents and I try to get my agent to talk to yours and get you your agent to share share information and data about their owner to to my agent without having to have the owner of the agent say yes or no. Basically, >> that is a risk. Yeah. And that is protected when you have your secrets essentially encrypted. >> Yeah. With ironclaw. >> Yeah. >> Yeah. >> Um once we do choose ironclaw over claw, >> um the second thing on your AI to do is to choose a plan. could just walk us through like you know obviously ironclaw is an AI agent but then you know we have

starter basic and pro plus starter you get to activate one agent instance is it just to scale the number of instances of our open claw or ironclaw >> oh the the plans are basically to give you the ability to buy inference credits at a discount right so um if you go to if you go to a hosted openclaw provider um what you'll see is oftentimes a request to or any kind of hosted app, right? You'll see a request to provide a payment for hosting. [snorts] And what we really wanted to do is we wanted to for people to be able to look themselves in the mirror and see should I buy put $3,000 for a Mac Mini >> or should I in order to host an agent

>> or should I essentially pay $0 for a cloud ironclaw >> and be able to really easily make that decision and say, "No, I'll take the thing that's for free. I'll take the thing that's instant, right? That's for the hosting of the agent itself. Okay. >> The plan that you mentioned is actually providing inference credits, right? So, last weekend I was just playing around. I was having my uh ironclaw order me a bunch of pizzas >> in my apartment. >> Uh I did so many tests. $150 worth of pizza. >> A lot [snorts and laughter] of pizza. >> How did that work? >> I was uh I was recording a demo for ETH Denver and then I thought I'd have a little fun. So, I was I was recording videos of my agent ordering different types of pizzas.

>> Okay. >> But because I ended up having too much fun and I wasn't able to intervene and stop the agent before they completed the transaction, it ordered like four or five pizzas in my apartment [laughter] >> and and that was on your credit card. >> That was on my credit card. >> Okay. And so you gave your ironclaw access to your credit card information. >> I gave my ironclaw access to my browser. >> Your browser >> and then the browsers have had my credit card information. So, you just wrote in Telegram, right? Like a a command like, "Go buy go buy me pizza." Yes. >> Was it like as broad as that or was it like, >> "Hey, I want pizza from this place. I like this." Like, >> I said, "Go buy me pizza from my favorite pizza place, Joe's." Uh, and I

want a Supreme Pie. >> Okay. >> So, it went and ordered a Supreme Pie >> all online. >> All online. And so from the moment that you wrote that command and it it went online on the browser, order the pizza, paid and the pizza came to your door. >> I did not touch my computer after >> after that one command. Yeah, >> that's amazing. >> What's amazing is that that's on my computer, but you can also do the same thing in a virtual machine, right? Like a hosted virtual machine, >> right? >> So I could do the same thing with my computer off, right? >> And me just on my phone. >> Yeah. >> Like messaging my bot >> on if you have it hosted in the cloud basically. Yeah, >> but then if you have it hosted in a in a server, does that not get into get you

into the same data sharing issues as that you tried to prevent by using >> uh then you just have to be very specific about what kind of data you provide to your agent in the hosted sort of machine, right? Maybe I'll provide my Door Dash um you know password, but I might not provide my bank >> password. Gotcha. >> Havachi is fast and private per [music] trading secured by ZK with Celestia underneath. Go to habachi.xyz [music] to start trading today. >> What is the ironclaw configuration that you would recommend for users to start? >> I think the easiest thing to do is just get started and setting up Telegram, having to do a few tasks just to get used to what the interface is, right?

We're shipping a lot of improvements. Literally, we shipped one last night, like 2 a.m. So, I think it's going to rapidly improve from here. But people who haven't used agents before, I think the most magical first experience you can have >> is connecting the agent to multiple different uh messaging apps >> because then the interface becomes whatever messaging app you currently use, Telegram, WhatsApp, etc. as well. >> And that's magical. >> It is. I totally agree. >> And it shares context. >> Even though you use uh more API credits than just using Claude like as it stands, uh just going to Telegram and using it is just like whoa. Yeah, >> this is like this is like I this could work.

>> I don't know if you had this experience, but I was trying to explain this to my wife. Um, when you're able to message an agent on WhatsApp or on text or on Telegram, it shifts from feeling like a piece of software to me to feeling like you're messaging a friend. >> Oh, yeah. Like you're actually talking to someone. Yeah. Yeah. >> Because then it can remember everything you said on Telegram when you're messaging it on WhatsApp. Yeah. Just like your buddy who you might be messaging about your day or some work or ordering some pizza, right? >> Yeah. So [snorts] when you go on Ironclaw to to download the software and use it, is it hosting in a cloud server?

>> Yes. >> And that's just like a secure enclave that you guys have access that you guys have created. Is it like individual server? Is it one big one? >> So we're uh managing the configurations to try to make it both affordable. Yeah. As well as [snorts] >> um secure. Yeah. >> Right. Right now what we're playing around with is seeing if we can have like large CVMs with different sort of partitions that are secure and separated. >> Yeah. >> And then you know trying to make that work in a way where essentially we can provide these agent hosting to people for free.

>> Yeah. >> Right. That's what we're doing right now. We're still tweaking around exactly what the you know end state of the parameters and the hosting will be. It looks like we should be able to do this in a way where people can get free hosting and then you know only pay for whatever inference they want to end up using. >> So okay so then with this download you don't need to open up terminal at all. No you don't need to use terminal at all. >> So what ends up happening what ends up happening is that the setup process end to ends up happening >> uh completely in an automated way. Yeah. Where you don't have to set up set up your agent in terminal.

>> Okay. After that, you have an interface where you can chat with the agent and then you can literally ask the agent to install things like telegram for you. So, if you're going through that Yeah. that sort of setup, if you guys >> uh take it back to the that presentation I just gave. Yeah. >> After you do the setup, there's a popup screen that says, "Hey, if you want to set up Telegram, I said you're agent, I want to set up Telegram." >> Yeah. >> That's all you have to do. >> Yeah. So configure access to agent generate a secure SSH uh provide your own or directly access your instance is just where we would connect it uh and in which kind of modality we want we would want to talk to our agent.

>> So you can SSH into the machine itself but the easiest thing to do is to download your key >> and then after the agents activated there's a big button that says open up my agent window. Press that big button, you'll have a chat interface directly with your agent >> on the near site. >> On the near site >> and then you can you can just create a a Telegram bot like I did it through like a bot thing like a Telegram bot creator. >> Yeah. >> And then you can just you can just link the API with the um with with the bot on Telegram basically. >> Yeah, exactly. >> Starts talking to you on Telegram. >> It just starts talking to you on Telegram. I actually think the magical moment I want to get the onboarding to a point where my mom >> who's not technical at all

>> doesn't have to actually get an API key from Telegram >> and connect it. Yeah. >> Connect it like >> you can copy and paste but I feel you on that. Yeah. >> Yeah. If you can automate more and more parts [snorts] of the experience you can get more and more people onto the station. So, so I haven't connected anything to my current open claw outside I created it its own uh Gmail account and then I gave it access to my calendar like readon and I gave it edit access to some Google docs but I did it all on like Google cloud workspace. Yeah. So like going in on like Google cloud on the API settings opening clicking different things giving access is there is is is like like talk to us about like the UI improvements for ironclaw. How how much easier is it going to be for me

to use things like Google Docs for editing, Gmail? Like how how do you see like the kind of core difference? Like is the core difference just I don't need to give it its own Gmail account because I I can trust it and give it access to mine or like is that the core breakthrough here? Like oh you don't need to take all these steps that you have to do for OpenClaw to make it kind of more secure. >> So let me ask you a question. When you use your open claw, why didn't you give it access to all of your passwords and your email and your >> I don't know. I just watched a couple YouTube videos and that's what I was told to do and I just felt like it was I was giving away, you know, I I was scared that it was going to take over

the [snorts] thing, like lock me out. >> Yeah. >> I I had the same feeling. So, I didn't give it access to a lot of stuff because I was like, I'm afraid. >> Yeah, exactly. Truly afraid. if I give it access to all my passwords, what if it does something um malicious? What if there's a prompt injection attack? Right. >> And I think this goes back to the first principle driver of like effective agents is actually security. >> Yeah. >> Right. >> So that's the core thing we wanted to solve. We're doing a lot of stuff to aim to improve the actual core experience as well, including like having tools like [snorts] um aiming to make actually the interaction between the agent and yourself, the setup process largely be a conversation right?

>> Yeah. >> And really removing as much technical barriers as you as you can. But I think the core thing that it comes back to my mind is security. If you have a lot of faith that the agent won't leak your secrets and [snorts] then you have sandboxes on a tool by tool basis, things like that. >> Well, that's the thing that is the core product differentiator for me. Then it's becomes like the core product of open cloud is really great [snorts] right now, but unless you give it all of your information and all of your access, you don't really get the full suite of experience. You get like this halfbaked experience. Yeah. >> Which is like like cool, but it's not been like life like workflow changing for me. But I anticipate that doing like that just the core security and privacy differentiator makes that product

experience way better because you don't have to worry about it. >> If you think about like what a great assistant will be. If you watch any movies where there's like a really effective assistant or EA, right? >> Um for example, there's that uh suits the show has like a really effective E. I forget her name. Donna. Donna, right? >> Maybe the the EA sort of product should be named Donna. that if you look at like what she's able to do is she has all of the information that she needs to take whatever actions she needs to take. >> Yes. >> So it goes back to actually privacy and security. Can you give the agent all the information that >> Yes.

>> that you can? >> Exactly. >> Because then they can do anything on your behalf, >> right? >> Oh man, I think I'm going to set up ironclaw then and just full send it. >> I think so too >> because I just haven't full sent it with like some of my friends have. They've they've given o open call access to everything and they're just like it's insane and I'm like [laughter] dude this is crazy. >> It's it's fun as long as you feel feel comfortable with the security sort of issues. Right. >> Yeah. >> But you know the the wildest thing is that [snorts] >> um we've also been the team has also been working on a product for a while now called near intense. >> Right.

>> So it's the ability to essentially do transactions with natural language. Right. So I think of the pizza example as a perfect example of like architecting something with intents. Right now there's not like a decentralized network of pizzeras behind that like competing for my pizza order. No, >> but if you're actually able to do real world uh intents behind being the arms that the arms and legs of the actual AI agents so it can do real world stuff. >> Yeah. >> That would be a wild wild world to live in. >> Yeah. Because now [snorts] you have really smart agents with all their information able to be the brains and tell you to do different things. Yeah.

And then you can have actually a coordination of activities through a marketplace through intents >> and those marketplaces are that intent network can actually go out and execute real things in the world for you. >> Yeah, [snorts] George man thanks for joining us today. A very very interesting conversation. I think uh I think I need to set up iron claw and just nuke my open claws. [laughter] I haven't got that deep with it yet. So, it's like it's not like I'm going to lose much, but >> hey, if you need any help, just DM me. >> Yeah. Thanks, George. >> I might take you up on that. Thanks, guys.