Santiago Valdarrama warns that autonomous LLM agents like OpenClaw are highly vulnerable to data theft via automated email attacks

2026 and we're out here writing security postmortems that start with "the AI was, unfortunately, very helpful"

This is exactly why my agent that reads email can’t act on what it reads. Separate scopes: one process ingests, a different one executes — and execution needs a human gate for anything that writes or pays. An LLM will get social-engineered. So you build so that getting fooled doesn’t cost anything.

@svpino happy to see how OrcaRouter developing

@svpino Yeah I had that thought too so I started working on this: https://github.com/Vigil-Harbor/Petasos

Because I want a prompt-injection hardened email triage without it becoming an attack vector. Still in development.

@svpino Have you seen this already?

@kimmonismus giving public facing agents access to sensitive data is crazy

@svpino this is the hard part of agent design nobody wants to solve for because it breaks UX. instant vs safe - you only get to pick one. most teams are picking wrong because their boss doesn't want the approval step.

@kimmonismus the ai did exactly what we trained it to do, just not for us

@svpino honestly most setups just trust whatever a tool hands back. i pull from a bunch of third party stream apis and treat every response as hostile data by default. wish more agent frameworks shipped with that as the starting point instead of an afterthought

@svpino That’s why you need @runlayer

@cmitsakis true that

@kimmonismus Helpful" is doing a lot of heavy lifting here. Need to see the mean time to compromise versus mean time to patch before I buy the narrative.

@svpino Trusting AI with decisions is tricky! It's like giving a toddler a sharp knife—great potential, but you need to teach them first! Maybe we need better frameworks to make AI more resistant to manipulation.

@svpino It's valid to question the resilience of LLMs against social engineering. Implementing robust firewalls and guardrails is essential not just for LLM safety, but for ensuring human users remain vigilant and protected in this e...