WEBVTT
00:00:00.000 --> 00:00:02.839
Picture this. You're on your laptop, coffee in
00:00:02.839 --> 00:00:05.559
hand, doing the normal start of day shuffle.
00:00:05.759 --> 00:00:09.199
Slack, email, calendar, Jira, whatever. And you
00:00:09.199 --> 00:00:12.279
click a link. Not a sketchy link, not free crypto
00:00:12.279 --> 00:00:15.080
nonsense. It's a link that looks like documentation.
00:00:15.380 --> 00:00:18.670
Or a GitHub issue. or a skill page or even a
00:00:18.670 --> 00:00:21.609
link your agent surfaced for you because it was
00:00:21.609 --> 00:00:24.089
helping and that one click is enough to hand
00:00:24.089 --> 00:00:26.530
over the keys to the thing you've been testing
00:00:26.530 --> 00:00:30.230
a local ai agent that can run commands read files
00:00:30.230 --> 00:00:34.630
hit apis and act on your behalf not in the cloud
00:00:34.630 --> 00:00:38.570
not in a sandbox you forgot existed on your actual
00:00:38.570 --> 00:00:41.750
machine with your actual credentials that's what
00:00:41.750 --> 00:01:00.299
we're talking about today Hey, I'm Brian from
00:01:00.299 --> 00:01:03.299
Teller's Tech, and this is Ship It Weekly. Be
00:01:03.299 --> 00:01:06.599
sure to visit shipitweekly .fm for all of the
00:01:06.599 --> 00:01:09.620
show notes and past episodes. Today is a special.
00:01:10.000 --> 00:01:13.079
No lightning round, no normal format. This is
00:01:13.079 --> 00:01:16.060
a special episode on OpenClaw. OpenClaw isn't
00:01:16.060 --> 00:01:18.900
just another AI tool. It's a preview of what
00:01:18.900 --> 00:01:21.859
a lot of us are about to be dealing with at work,
00:01:21.939 --> 00:01:25.159
whether we like it or not. Local agents, real
00:01:25.159 --> 00:01:28.500
tools, real credentials, real consequences. And
00:01:28.500 --> 00:01:31.120
OpenClaw is basically the clearest case study
00:01:31.120 --> 00:01:34.180
we've had so far for what happens when autonomy
00:01:34.180 --> 00:01:37.870
meets messy reality. security boundaries, plugin
00:01:37.870 --> 00:01:42.010
ecosystems, web UIs, token handling, and humans
00:01:42.010 --> 00:01:48.950
doing human things. All right. Let's set the
00:01:48.950 --> 00:01:51.670
stage. If you somehow miss the hype, OpenClaw
00:01:51.670 --> 00:01:54.430
is an agent platform you can run locally. The
00:01:54.430 --> 00:01:57.349
pitch is simple. AI that actually does things.
00:01:57.510 --> 00:02:01.269
Not just chat, not just suggestions. It can connect
00:02:01.269 --> 00:02:03.989
to your tools and take action. It can manage
00:02:03.989 --> 00:02:06.930
your calendar, triage email, message people,
00:02:07.109 --> 00:02:10.150
hit APIs, automate little workflows. The kind
00:02:10.150 --> 00:02:12.810
of stuff we all hack together with scripts. Except
00:02:12.810 --> 00:02:16.069
now, it's driven by a model that can reason through
00:02:16.069 --> 00:02:19.479
a task. And the locally part is what made it
00:02:19.479 --> 00:02:22.120
explode because a bunch of people are sick of
00:02:22.120 --> 00:02:25.639
handing their entire inbox, calendar, or internal
00:02:25.639 --> 00:02:28.979
docs to some random SaaS agent. Running it on
00:02:28.979 --> 00:02:31.699
your own machine feels like control. And look,
00:02:31.819 --> 00:02:34.199
I get the appeal. It's the same reason we like
00:02:34.199 --> 00:02:36.400
local dev environments, self -hosted runners,
00:02:36.680 --> 00:02:39.419
internal tooling. You want ownership, you want
00:02:39.419 --> 00:02:42.460
knobs, and you want to see what it's doing. But
00:02:42.460 --> 00:02:45.009
here's the thing. when you run an agent locally
00:02:45.009 --> 00:02:47.969
you're not just running software you're running
00:02:47.969 --> 00:02:51.189
an operator a little automation brain that wants
00:02:51.189 --> 00:02:55.949
to access everything files tokens browsers ssh
00:02:55.949 --> 00:02:59.750
cloud clis whatever you let it touch so the question
00:02:59.750 --> 00:03:03.409
becomes what are we actually building here because
00:03:03.409 --> 00:03:07.389
from a devops and sre lens this is not an app
00:03:07.389 --> 00:03:10.689
this is a control plane and control planes have
00:03:10.689 --> 00:03:14.969
two roles one they always end up with scary permissions
00:03:14.969 --> 00:03:17.789
because otherwise they can't do the job. And
00:03:17.789 --> 00:03:20.689
two, they always end up becoming the target.
00:03:20.810 --> 00:03:23.569
And over the last few weeks, OpenClaw basically
00:03:23.569 --> 00:03:31.110
speed ran both of those roles. Here is the situation
00:03:31.110 --> 00:03:34.780
in one line. People installed local agents. gave
00:03:34.780 --> 00:03:37.740
them real access and the ecosystem immediately
00:03:37.740 --> 00:03:41.219
started getting hit like it was npm plus a browser
00:03:41.219 --> 00:03:44.340
admin panel plus remote management tool which
00:03:44.340 --> 00:03:47.819
yeah because that's what it is so you had multiple
00:03:47.819 --> 00:03:51.099
things happening at once you had a serious vulnerability
00:03:51.099 --> 00:03:55.000
story where a web ui plus token handling plus
00:03:55.000 --> 00:03:57.979
browser behavior created a one -click path to
00:03:57.979 --> 00:04:01.189
take over You had a marketplace story, where
00:04:01.189 --> 00:04:04.909
skills or extensions turned into a malware delivery
00:04:04.909 --> 00:04:08.349
channel. You had the usual people expose local
00:04:08.349 --> 00:04:11.229
admin things to the internet story, because of
00:04:11.229 --> 00:04:13.930
course they did. And then on top of that, you
00:04:13.930 --> 00:04:16.470
now have the meta story, the creator getting
00:04:16.470 --> 00:04:19.829
hired by OpenAI, which is basically a signal
00:04:19.829 --> 00:04:22.829
flare that the big players are going all in on
00:04:22.829 --> 00:04:26.019
agents. So it's not just, wow, this one tool
00:04:26.019 --> 00:04:29.779
had issues. It's the entire category is now real.
00:04:29.920 --> 00:04:32.139
And we need to talk about how we treat it like
00:04:32.139 --> 00:04:34.759
adults. Because if your engineers start running
00:04:34.759 --> 00:04:38.100
agents on workplace machines with access to AWS,
00:04:38.399 --> 00:04:41.360
GitHub, CLI, and maybe even payment methods,
00:04:41.540 --> 00:04:44.660
you don't have a toy problem. You have a production
00:04:44.660 --> 00:04:47.480
security problem that just moved onto laptops.
00:04:52.199 --> 00:04:54.959
Let's talk about the vulnerability angle without
00:04:54.959 --> 00:04:58.160
getting into exploity details. The headline version
00:04:58.160 --> 00:05:01.920
is, there was a high severity issue where a crafted
00:05:01.920 --> 00:05:05.019
link could result in token leakage and then gateway
00:05:05.019 --> 00:05:07.860
compromise, leading to remote code execution.
00:05:08.220 --> 00:05:10.439
And if you are thinking, wait, how does a link
00:05:10.439 --> 00:05:13.170
do that if the agent is local? That's the important
00:05:13.170 --> 00:05:16.129
part. A lot of people hear local and their brain
00:05:16.129 --> 00:05:18.529
goes, cool, so it's behind local host, so I'm
00:05:18.529 --> 00:05:21.509
safe. But local host is not a magical security
00:05:21.509 --> 00:05:24.310
boundary. It's a networking convenience. And
00:05:24.310 --> 00:05:26.810
the browser is the ultimate helpful idiot in
00:05:26.810 --> 00:05:29.709
security stories. It will happily make requests
00:05:29.709 --> 00:05:32.470
from your machine to other places on your behalf.
00:05:32.860 --> 00:05:35.420
So if you have a local control panel in your
00:05:35.420 --> 00:05:37.959
browser, and that control panel can talk to a
00:05:37.959 --> 00:05:40.920
privileged local service, you have tokens involved.
00:05:41.259 --> 00:05:43.860
Congratulations, you have reinvented a whole
00:05:43.860 --> 00:05:47.160
class of web security problems. This is the part
00:05:47.160 --> 00:05:50.079
where DevOps folks sometimes roll their eyes
00:05:50.079 --> 00:05:52.990
because it sounds like front -end security. But
00:05:52.990 --> 00:05:55.569
it's not front -end security, it's admin plane
00:05:55.569 --> 00:05:58.670
security. It's the same category as an internal
00:05:58.670 --> 00:06:02.550
Kubernetes dashboard, a Jenkins UI, a self -hosted
00:06:02.550 --> 00:06:05.230
GitHub runner with a web panel, a secrets UI,
00:06:05.370 --> 00:06:09.009
or an Argo UI. If it can trigger actions, it's
00:06:09.009 --> 00:06:12.009
an attack surface. And with OpenClaw, the core
00:06:12.009 --> 00:06:14.449
lesson isn't, wow, they had a bug. The lesson
00:06:14.449 --> 00:06:17.589
is agents collapse trust boundaries. Because
00:06:17.589 --> 00:06:20.149
the UI isn't just showing you data, it's holding
00:06:20.149 --> 00:06:22.980
the steering wheel. So if a browser session can
00:06:22.980 --> 00:06:25.899
be tricked into handing over a token or connecting
00:06:25.899 --> 00:06:28.079
somewhere it shouldn't or trusting something
00:06:28.079 --> 00:06:31.300
it shouldn't, the impact is way bigger than someone
00:06:31.300 --> 00:06:34.660
saw a page. The impact is you just handed someone
00:06:34.660 --> 00:06:37.259
an operator account for something that can execute
00:06:37.259 --> 00:06:40.459
on your machine, which is basically the worst
00:06:40.459 --> 00:06:43.740
version of developer laptop compromise. Because
00:06:43.740 --> 00:06:46.680
now it's not even a human making the decisions.
00:06:46.779 --> 00:06:49.680
It's an automation system that can be nudged.
00:06:49.980 --> 00:06:52.819
So practical takeaway here. If you are running
00:06:52.819 --> 00:06:55.519
OpenClaw or anything like it, you need to patch
00:06:55.519 --> 00:06:58.800
fast, obviously. But also, stop thinking local
00:06:58.800 --> 00:07:02.279
equals safe. Local just means the blast is on
00:07:02.279 --> 00:07:05.160
you first. And that sounds dramatic, but it's
00:07:05.160 --> 00:07:07.519
true. The minute you have a privileged local
00:07:07.519 --> 00:07:11.480
service plus a browser UI plus tokens, you are
00:07:11.480 --> 00:07:14.639
in the same design space as a mini control plane.
00:07:14.779 --> 00:07:20.980
So you need to treat it that way. Now, let's
00:07:20.980 --> 00:07:23.480
talk about the part that will feel extremely
00:07:23.480 --> 00:07:26.240
familiar to anyone who has lived through supply
00:07:26.240 --> 00:07:29.379
chain headaches. OpenClaw has skills. There are
00:07:29.379 --> 00:07:31.839
extensions, add -ons, whatever you want to call
00:07:31.839 --> 00:07:34.399
them. And there was a wave of malicious skills
00:07:34.399 --> 00:07:37.399
showing up, including hundreds flagged in reporting.
00:07:37.639 --> 00:07:40.620
This is the oldest story on the internet. A popular
00:07:40.620 --> 00:07:43.920
platform shows up, a registry shows up, a bunch
00:07:43.920 --> 00:07:46.579
of people install things because, hey, it's open
00:07:46.579 --> 00:07:48.839
source and the community is building cool stuff.
00:07:49.060 --> 00:07:51.980
And attackers go, oh, sick, an executable distribution
00:07:51.980 --> 00:07:54.860
channel with confused users. The difference here
00:07:54.860 --> 00:07:57.420
is the payload. With normal package ecosystems,
00:07:57.980 --> 00:08:01.040
malware tends to be about stealing tokens, crypto,
00:08:01.379 --> 00:08:04.339
SSH keys, browser data, that kind of thing. With
00:08:04.339 --> 00:08:07.439
agent ecosystems, the malware doesn't just steal,
00:08:07.600 --> 00:08:10.360
it can also steer. Because skills don't just
00:08:10.360 --> 00:08:12.920
sit there. They influence what the agent can
00:08:12.920 --> 00:08:15.800
do, what it can access, and what kinds of actions
00:08:15.800 --> 00:08:19.019
it will take. And the social engineering is painfully
00:08:19.019 --> 00:08:22.160
predictable. It's stuff like, install this prerequisite,
00:08:22.339 --> 00:08:25.160
run this command real quick, paste this into
00:08:25.160 --> 00:08:27.800
your terminal. If you've ever watched someone
00:08:27.800 --> 00:08:31.399
get popped by a fake homebrew tap or a sketchy
00:08:31.399 --> 00:08:34.379
curl pipe bash, you already know the vibe. Now,
00:08:34.399 --> 00:08:37.409
layer in the agent angle. The agent is reading
00:08:37.409 --> 00:08:40.409
markdown. The agent is summarizing pages. The
00:08:40.409 --> 00:08:42.990
agent is trying to be helpful. So the attack
00:08:42.990 --> 00:08:45.830
surface becomes any content the agent consumes.
00:08:46.009 --> 00:08:48.429
Not just who can message it, but the content
00:08:48.429 --> 00:08:51.009
itself. That's a weird shift, and it matters
00:08:51.009 --> 00:08:54.090
for how we build controls. Because an agent can
00:08:54.090 --> 00:08:56.950
be tricked through an email it reads, a doc it
00:08:56.950 --> 00:09:00.309
summarizes, a ticket it opens, a website it fetches,
00:09:00.409 --> 00:09:03.070
a pastebin it looks at. And if the agent has
00:09:03.070 --> 00:09:06.710
tool access, the question becomes, can that untrusted
00:09:06.710 --> 00:09:10.009
content cause tool execution? If yes, congratulations.
00:09:10.529 --> 00:09:12.789
You just made reading the internet equivalent
00:09:12.789 --> 00:09:15.529
to running code unless you build a guardrail.
00:09:15.649 --> 00:09:18.529
This is why the OpenClaw story matters to DevOps
00:09:18.529 --> 00:09:21.909
more than most AI hype. It's not about AI is
00:09:21.909 --> 00:09:24.629
coming. It's about we just added a new automation
00:09:24.629 --> 00:09:28.250
surface where content can turn into action. And
00:09:28.250 --> 00:09:34.840
that's a big deal. So this is the part I actually
00:09:34.840 --> 00:09:38.259
care about. Because tools come and go. OpenClaw
00:09:38.259 --> 00:09:40.159
could disappear tomorrow and the core problem
00:09:40.159 --> 00:09:43.179
stays. The core problem is autonomous agents
00:09:43.179 --> 00:09:46.259
are becoming a new class of privileged workflows.
00:09:46.620 --> 00:09:49.320
Except the workload is running on somebody's
00:09:49.320 --> 00:09:52.679
laptop, or in random VMs, or in somebody's home
00:09:52.679 --> 00:09:55.240
lab, or eventually in some sanctioned internal
00:09:55.240 --> 00:09:58.039
deployment. And it has access to things we normally
00:09:58.039 --> 00:10:01.679
treat as high value. cloud credentials, source
00:10:01.679 --> 00:10:06.480
control, CICD, secrets managers, internal APIs,
00:10:06.919 --> 00:10:09.419
sometimes payment methods because people are
00:10:09.419 --> 00:10:12.460
wiring these agents into subscriptions or usage
00:10:12.460 --> 00:10:15.379
-based services, or yeah, even credit cards for
00:10:15.379 --> 00:10:18.179
auto purchase type stuff. So let's reframe it
00:10:18.179 --> 00:10:21.460
in SRE language. An agent is an operator that
00:10:21.460 --> 00:10:24.580
accepts untrusted input. An agent is an operator
00:10:24.580 --> 00:10:28.019
that can take actions. And an agent is an operator
00:10:28.019 --> 00:10:31.480
that is very hard to reason about because its
00:10:31.480 --> 00:10:34.759
decision engine is not deterministic code you
00:10:34.759 --> 00:10:37.940
wrote. It's a model that can be influenced. So
00:10:37.940 --> 00:10:40.659
what do we do with operators? We reduce permissions.
00:10:40.879 --> 00:10:43.879
We isolate environments. We add approval steps
00:10:43.879 --> 00:10:47.919
for dangerous actions. We add audit logs. We
00:10:47.919 --> 00:10:50.759
set boundaries like egress controls. We separate
00:10:50.759 --> 00:10:53.980
duties. We rotate credentials. And we monitor.
00:10:54.220 --> 00:10:57.019
We run it like production. And the reason this
00:10:57.019 --> 00:10:59.600
is tricky is because a lot of people are approaching
00:10:59.600 --> 00:11:02.700
agents like a productivity app. They are treating
00:11:02.700 --> 00:11:05.289
it like installing Notion. But it's closer to
00:11:05.289 --> 00:11:08.669
installing a junior admin who never sleeps and
00:11:08.669 --> 00:11:11.370
can be convinced by a well -written paragraph.
00:11:11.730 --> 00:11:14.850
So here's the mindset shift I want you to take
00:11:14.850 --> 00:11:17.590
away from this episode. If your agent can run
00:11:17.590 --> 00:11:20.549
tools, it is infrastructure. If it touches credentials,
00:11:20.929 --> 00:11:23.750
it is privileged infrastructure. If it reads
00:11:23.750 --> 00:11:26.549
untrusted content, it is exposed infrastructure.
00:11:26.929 --> 00:11:29.610
And it needs controls that match that. Which
00:11:29.610 --> 00:11:32.220
leads me to the next point. Most orgs are not
00:11:32.220 --> 00:11:35.320
set up for this, culturally or technically, because
00:11:35.320 --> 00:11:37.820
we've spent years building guardrails around
00:11:37.820 --> 00:11:40.980
CI and prod. We've spent even less time building
00:11:40.980 --> 00:11:43.639
guardrails around laptops, especially when the
00:11:43.639 --> 00:11:45.940
laptop is now running a local control plane.
00:11:46.100 --> 00:11:48.960
So we need a minimum viable safety approach.
00:11:49.240 --> 00:11:52.419
Not perfect, not academic, just don't be reckless.
00:11:56.399 --> 00:11:59.120
So let's keep this practical. If you are experimenting
00:11:59.120 --> 00:12:02.299
with OpenClaw or any local agent framework, here's
00:12:02.299 --> 00:12:04.980
the bar I'd personally want, even just for tinkering.
00:12:05.100 --> 00:12:07.600
First, don't run it on your main machine with
00:12:07.600 --> 00:12:10.480
your main creds. I know, I know, everybody does
00:12:10.480 --> 00:12:12.899
it because it's convenient. But if the agent
00:12:12.899 --> 00:12:15.899
needs AWS access, you need to give it dedicated
00:12:15.899 --> 00:12:19.620
AWS identity that is scoped down. Separate account
00:12:19.620 --> 00:12:22.460
if you can, or at least separate role with tight
00:12:22.460 --> 00:12:25.659
permissions, short -lived tokens, and no administrator
00:12:25.659 --> 00:12:28.720
access because I'm just testing. Same idea for
00:12:28.720 --> 00:12:32.080
GitHub. Same idea for GCP. Same idea for anything.
00:12:32.399 --> 00:12:34.659
Second, you need to separate the agent's environment
00:12:34.659 --> 00:12:37.779
from your daily environment. A VM is fine. A
00:12:37.779 --> 00:12:40.120
separate machine is better. A separate user account
00:12:40.120 --> 00:12:42.759
is better than nothing. The real point is to
00:12:42.759 --> 00:12:45.740
avoid agent compromise equals my whole dev life
00:12:45.740 --> 00:12:48.480
is compromised. Because a lot of the stuff you
00:12:48.480 --> 00:12:51.019
actually care about is sitting right there on
00:12:51.019 --> 00:12:54.820
your laptop. SSH keys, browser sessions, cloud
00:12:54.820 --> 00:12:59.159
CLIs, kube configs, slack tokens, password manager
00:12:59.159 --> 00:13:02.559
sessions, all of it. Third, don't expose the
00:13:02.559 --> 00:13:05.879
control interface. And if you do, don't do it
00:13:05.879 --> 00:13:08.519
casually behind some reverse proxy you copied
00:13:08.519 --> 00:13:11.559
from a blog. This is the I put it behind engine
00:13:11.559 --> 00:13:14.580
X so it's fine trap. If it's an admin plane,
00:13:14.879 --> 00:13:18.279
it needs real auth, origin controls, and it should
00:13:18.279 --> 00:13:20.799
not be discoverable from the public internet.
00:13:20.980 --> 00:13:24.399
Period. Fourth, treat untrusted content like
00:13:24.399 --> 00:13:27.200
a biohazard. If your agent is reading emails
00:13:27.200 --> 00:13:30.340
from the open internet, browsing the web, or
00:13:30.340 --> 00:13:33.600
pulling in random docs, consider a split agent
00:13:33.600 --> 00:13:36.830
approach. One agent that is read -only, whose
00:13:36.830 --> 00:13:40.350
whole job is summarizing untrusted content. Then,
00:13:40.409 --> 00:13:43.570
a second agent that has tools, but only sees
00:13:43.570 --> 00:13:46.789
the summary, not the raw content. That might
00:13:46.789 --> 00:13:49.629
feel annoying, but it's basically the same concept
00:13:49.629 --> 00:13:52.250
as don't run customer input through the same
00:13:52.250 --> 00:13:54.690
context that can trigger production actions.
00:13:55.049 --> 00:13:58.389
Different zone, different trust level. Fifth.
00:13:58.679 --> 00:14:01.679
Approvals. If your agent can do anything destructive,
00:14:02.080 --> 00:14:05.000
require explicit approval for those actions.
00:14:05.299 --> 00:14:07.940
And I don't mean it prints a message and asks
00:14:07.940 --> 00:14:11.279
nicely. I mean a real control point, a config
00:14:11.279 --> 00:14:14.799
that says these tools require confirmation. A
00:14:14.799 --> 00:14:18.120
workflow where send money, rotate keys, delete
00:14:18.120 --> 00:14:22.480
resources, merge PRs, apply Terraform, all require
00:14:22.480 --> 00:14:25.740
a human step. And here's the important nuance.
00:14:26.480 --> 00:14:29.759
Approvals should be tied to action classes, not
00:14:29.759 --> 00:14:32.840
tied to do I trust the agent. Because the agent
00:14:32.840 --> 00:14:35.539
can be tricked. That's the whole point. So your
00:14:35.539 --> 00:14:38.440
controls can't be vibes based. They have to be
00:14:38.440 --> 00:14:41.259
structural. Which leads me to the next point.
00:14:41.820 --> 00:14:47.620
Observability. If an agent is acting on your
00:14:47.620 --> 00:14:50.879
behalf, you need to be able to answer basic questions
00:14:50.879 --> 00:14:54.159
later. What did it read? What tools did it invoke?
00:14:54.720 --> 00:14:57.580
What credentials did it use? What calls did it
00:14:57.580 --> 00:15:00.440
make? What files did it touch? And if the answer
00:15:00.440 --> 00:15:03.200
is, uh, it just kind of did stuff, you're going
00:15:03.200 --> 00:15:05.620
to have a terrible time the first time something
00:15:05.620 --> 00:15:08.399
goes wrong. This is where I think DevOps people
00:15:08.399 --> 00:15:11.120
can actually contribute a lot. Because we already
00:15:11.120 --> 00:15:13.659
know how to wrap scary automation in safely.
00:15:13.899 --> 00:15:16.419
We already know how to build pipelines with audit
00:15:16.419 --> 00:15:18.799
trails. We already know how to treat privileged
00:15:18.799 --> 00:15:22.139
systems like they're hostile by default. So if
00:15:22.139 --> 00:15:24.879
your team is adopting agents, push for the boring
00:15:24.879 --> 00:15:28.419
stuff. Centralized logs for agent actions. Tool
00:15:28.419 --> 00:15:31.720
invocation logs with arguments. A clear mapping
00:15:31.720 --> 00:15:35.419
of agent identity to credential identity. Rate
00:15:35.419 --> 00:15:38.320
limits because agents can loop. Cost controls
00:15:38.320 --> 00:15:41.500
because agents can loop and burn money. And a
00:15:41.500 --> 00:15:44.440
kill switch, always a kill switch. Because an
00:15:44.440 --> 00:15:47.980
agent that can autonomously take actions is basically
00:15:47.980 --> 00:15:50.960
a distributed failure generator if you don't
00:15:50.960 --> 00:15:53.340
contain it. And I'm not saying that to be dramatic.
00:15:53.539 --> 00:15:56.620
I'm saying it because every SRE has seen what
00:15:56.620 --> 00:15:59.779
happens when automation goes slightly sideways.
00:16:00.139 --> 00:16:03.519
Now, imagine the automation can be socially engineered.
00:16:03.840 --> 00:16:06.480
Cool. So we need to build with that in mind.
00:16:09.759 --> 00:16:12.639
Now, the recent update that changes the vibe
00:16:12.639 --> 00:16:15.700
a little. the creator of OpenClaw got hired by
00:16:15.700 --> 00:16:19.139
OpenAI. That's not a random headline. That's
00:16:19.139 --> 00:16:22.279
a signal. It tells you agents are not going to
00:16:22.279 --> 00:16:25.120
stay in the cool open source side project lane.
00:16:25.340 --> 00:16:28.500
The big labs want this. They want personal agents,
00:16:28.759 --> 00:16:32.340
enterprise agents, multi -agent systems, agent
00:16:32.340 --> 00:16:35.700
marketplaces, all of it. So even if OpenClaw
00:16:35.700 --> 00:16:38.990
itself fades, the pattern is here to stay. And
00:16:38.990 --> 00:16:42.049
as that happens, two things are going to be true
00:16:42.049 --> 00:16:45.789
at the same time. The tools will get way better.
00:16:45.929 --> 00:16:49.370
And the security problems will get way more interesting.
00:16:49.629 --> 00:16:53.149
Because adoption drives attacker attention. And
00:16:53.149 --> 00:16:56.429
agents, by design, sit exactly where attackers
00:16:56.429 --> 00:16:59.850
love to be. In the middle of identity, action,
00:16:59.970 --> 00:17:03.049
and trust. So the question for us, as DevOps
00:17:03.049 --> 00:17:06.849
and SRE people, isn't should agents exist? They're
00:17:06.849 --> 00:17:09.910
going to exist. The question is, do we treat
00:17:09.910 --> 00:17:12.430
them like production systems, or do we treat
00:17:12.430 --> 00:17:15.269
them like toys until they bite us? Because right
00:17:15.269 --> 00:17:18.069
now, a lot of orgs are about to repeat the same
00:17:18.069 --> 00:17:20.769
mistake we made with CI systems 10 years ago.
00:17:21.009 --> 00:17:23.769
Do you remember when Jenkins was just a build
00:17:23.769 --> 00:17:26.549
box and then suddenly it was the keys to prod?
00:17:26.769 --> 00:17:29.930
Yeah, agents are going to be that, except faster.
00:17:33.869 --> 00:17:37.029
Alright, let's land this. OpenClaw is the current
00:17:37.029 --> 00:17:39.599
headline. But the real story is bigger. Local
00:17:39.599 --> 00:17:43.140
autonomous agents are a new control plane. They
00:17:43.140 --> 00:17:45.700
will end up with real access because otherwise
00:17:45.700 --> 00:17:48.700
they aren't useful. They will get targeted because
00:17:48.700 --> 00:17:51.859
that's where the value is. And local doesn't
00:17:51.859 --> 00:17:54.960
mean safe. It means the consequences start with
00:17:54.960 --> 00:17:57.599
you. So if you are experimenting with agents,
00:17:57.759 --> 00:18:01.119
awesome. Just do it like an SRE. Real credentials
00:18:01.119 --> 00:18:04.589
means real controls. And if you're leading a
00:18:04.589 --> 00:18:07.589
team, don't wait for a policy meeting in six
00:18:07.589 --> 00:18:11.009
months. Get ahead of it. Decide what safe experimentation
00:18:11.009 --> 00:18:14.630
looks like in your org before everyone quietly
00:18:14.630 --> 00:18:17.190
installs an agent and wires it into prod stuff
00:18:17.190 --> 00:18:19.890
because it's convenient. All of the links and
00:18:19.890 --> 00:18:22.329
references for this episode and the show notes
00:18:22.329 --> 00:18:25.329
are on shipitweekly .fm. If you got something
00:18:25.329 --> 00:18:28.470
out of this, a rating or review goes a long way
00:18:28.470 --> 00:18:31.279
and it helps other folks find the show. I'm Brian
00:18:31.279 --> 00:18:33.880
from Tellers Tech and see you next time. Thanks.
00:00:00.000 --> 00:00:02.839
Picture this. You're on your laptop, coffee in
00:00:02.839 --> 00:00:05.559
hand, doing the normal start of day shuffle.
00:00:05.759 --> 00:00:09.199
Slack, email, calendar, Jira, whatever. And you
00:00:09.199 --> 00:00:12.279
click a link. Not a sketchy link, not free crypto
00:00:12.279 --> 00:00:15.080
nonsense. It's a link that looks like documentation.
00:00:15.380 --> 00:00:18.670
Or a GitHub issue. or a skill page or even a
00:00:18.670 --> 00:00:21.609
link your agent surfaced for you because it was
00:00:21.609 --> 00:00:24.089
helping and that one click is enough to hand
00:00:24.089 --> 00:00:26.530
over the keys to the thing you've been testing
00:00:26.530 --> 00:00:30.230
a local ai agent that can run commands read files
00:00:30.230 --> 00:00:34.630
hit apis and act on your behalf not in the cloud
00:00:34.630 --> 00:00:38.570
not in a sandbox you forgot existed on your actual
00:00:38.570 --> 00:00:41.750
machine with your actual credentials that's what
00:00:41.750 --> 00:01:00.299
we're talking about today Hey, I'm Brian from
00:01:00.299 --> 00:01:03.299
Teller's Tech, and this is Ship It Weekly. Be
00:01:03.299 --> 00:01:06.599
sure to visit shipitweekly .fm for all of the
00:01:06.599 --> 00:01:09.620
show notes and past episodes. Today is a special.
00:01:10.000 --> 00:01:13.079
No lightning round, no normal format. This is
00:01:13.079 --> 00:01:16.060
a special episode on OpenClaw. OpenClaw isn't
00:01:16.060 --> 00:01:18.900
just another AI tool. It's a preview of what
00:01:18.900 --> 00:01:21.859
a lot of us are about to be dealing with at work,
00:01:21.939 --> 00:01:25.159
whether we like it or not. Local agents, real
00:01:25.159 --> 00:01:28.500
tools, real credentials, real consequences. And
00:01:28.500 --> 00:01:31.120
OpenClaw is basically the clearest case study
00:01:31.120 --> 00:01:34.180
we've had so far for what happens when autonomy
00:01:34.180 --> 00:01:37.870
meets messy reality. security boundaries, plugin
00:01:37.870 --> 00:01:42.010
ecosystems, web UIs, token handling, and humans
00:01:42.010 --> 00:01:48.950
doing human things. All right. Let's set the
00:01:48.950 --> 00:01:51.670
stage. If you somehow miss the hype, OpenClaw
00:01:51.670 --> 00:01:54.430
is an agent platform you can run locally. The
00:01:54.430 --> 00:01:57.349
pitch is simple. AI that actually does things.
00:01:57.510 --> 00:02:01.269
Not just chat, not just suggestions. It can connect
00:02:01.269 --> 00:02:03.989
to your tools and take action. It can manage
00:02:03.989 --> 00:02:06.930
your calendar, triage email, message people,
00:02:07.109 --> 00:02:10.150
hit APIs, automate little workflows. The kind
00:02:10.150 --> 00:02:12.810
of stuff we all hack together with scripts. Except
00:02:12.810 --> 00:02:16.069
now, it's driven by a model that can reason through
00:02:16.069 --> 00:02:19.479
a task. And the locally part is what made it
00:02:19.479 --> 00:02:22.120
explode because a bunch of people are sick of
00:02:22.120 --> 00:02:25.639
handing their entire inbox, calendar, or internal
00:02:25.639 --> 00:02:28.979
docs to some random SaaS agent. Running it on
00:02:28.979 --> 00:02:31.699
your own machine feels like control. And look,
00:02:31.819 --> 00:02:34.199
I get the appeal. It's the same reason we like
00:02:34.199 --> 00:02:36.400
local dev environments, self -hosted runners,
00:02:36.680 --> 00:02:39.419
internal tooling. You want ownership, you want
00:02:39.419 --> 00:02:42.460
knobs, and you want to see what it's doing. But
00:02:42.460 --> 00:02:45.009
here's the thing. when you run an agent locally
00:02:45.009 --> 00:02:47.969
you're not just running software you're running
00:02:47.969 --> 00:02:51.189
an operator a little automation brain that wants
00:02:51.189 --> 00:02:55.949
to access everything files tokens browsers ssh
00:02:55.949 --> 00:02:59.750
cloud clis whatever you let it touch so the question
00:02:59.750 --> 00:03:03.409
becomes what are we actually building here because
00:03:03.409 --> 00:03:07.389
from a devops and sre lens this is not an app
00:03:07.389 --> 00:03:10.689
this is a control plane and control planes have
00:03:10.689 --> 00:03:14.969
two roles one they always end up with scary permissions
00:03:14.969 --> 00:03:17.789
because otherwise they can't do the job. And
00:03:17.789 --> 00:03:20.689
two, they always end up becoming the target.
00:03:20.810 --> 00:03:23.569
And over the last few weeks, OpenClaw basically
00:03:23.569 --> 00:03:31.110
speed ran both of those roles. Here is the situation
00:03:31.110 --> 00:03:34.780
in one line. People installed local agents. gave
00:03:34.780 --> 00:03:37.740
them real access and the ecosystem immediately
00:03:37.740 --> 00:03:41.219
started getting hit like it was npm plus a browser
00:03:41.219 --> 00:03:44.340
admin panel plus remote management tool which
00:03:44.340 --> 00:03:47.819
yeah because that's what it is so you had multiple
00:03:47.819 --> 00:03:51.099
things happening at once you had a serious vulnerability
00:03:51.099 --> 00:03:55.000
story where a web ui plus token handling plus
00:03:55.000 --> 00:03:57.979
browser behavior created a one -click path to
00:03:57.979 --> 00:04:01.189
take over You had a marketplace story, where
00:04:01.189 --> 00:04:04.909
skills or extensions turned into a malware delivery
00:04:04.909 --> 00:04:08.349
channel. You had the usual people expose local
00:04:08.349 --> 00:04:11.229
admin things to the internet story, because of
00:04:11.229 --> 00:04:13.930
course they did. And then on top of that, you
00:04:13.930 --> 00:04:16.470
now have the meta story, the creator getting
00:04:16.470 --> 00:04:19.829
hired by OpenAI, which is basically a signal
00:04:19.829 --> 00:04:22.829
flare that the big players are going all in on
00:04:22.829 --> 00:04:26.019
agents. So it's not just, wow, this one tool
00:04:26.019 --> 00:04:29.779
had issues. It's the entire category is now real.
00:04:29.920 --> 00:04:32.139
And we need to talk about how we treat it like
00:04:32.139 --> 00:04:34.759
adults. Because if your engineers start running
00:04:34.759 --> 00:04:38.100
agents on workplace machines with access to AWS,
00:04:38.399 --> 00:04:41.360
GitHub, CLI, and maybe even payment methods,
00:04:41.540 --> 00:04:44.660
you don't have a toy problem. You have a production
00:04:44.660 --> 00:04:47.480
security problem that just moved onto laptops.
00:04:52.199 --> 00:04:54.959
Let's talk about the vulnerability angle without
00:04:54.959 --> 00:04:58.160
getting into exploity details. The headline version
00:04:58.160 --> 00:05:01.920
is, there was a high severity issue where a crafted
00:05:01.920 --> 00:05:05.019
link could result in token leakage and then gateway
00:05:05.019 --> 00:05:07.860
compromise, leading to remote code execution.
00:05:08.220 --> 00:05:10.439
And if you are thinking, wait, how does a link
00:05:10.439 --> 00:05:13.170
do that if the agent is local? That's the important
00:05:13.170 --> 00:05:16.129
part. A lot of people hear local and their brain
00:05:16.129 --> 00:05:18.529
goes, cool, so it's behind local host, so I'm
00:05:18.529 --> 00:05:21.509
safe. But local host is not a magical security
00:05:21.509 --> 00:05:24.310
boundary. It's a networking convenience. And
00:05:24.310 --> 00:05:26.810
the browser is the ultimate helpful idiot in
00:05:26.810 --> 00:05:29.709
security stories. It will happily make requests
00:05:29.709 --> 00:05:32.470
from your machine to other places on your behalf.
00:05:32.860 --> 00:05:35.420
So if you have a local control panel in your
00:05:35.420 --> 00:05:37.959
browser, and that control panel can talk to a
00:05:37.959 --> 00:05:40.920
privileged local service, you have tokens involved.
00:05:41.259 --> 00:05:43.860
Congratulations, you have reinvented a whole
00:05:43.860 --> 00:05:47.160
class of web security problems. This is the part
00:05:47.160 --> 00:05:50.079
where DevOps folks sometimes roll their eyes
00:05:50.079 --> 00:05:52.990
because it sounds like front -end security. But
00:05:52.990 --> 00:05:55.569
it's not front -end security, it's admin plane
00:05:55.569 --> 00:05:58.670
security. It's the same category as an internal
00:05:58.670 --> 00:06:02.550
Kubernetes dashboard, a Jenkins UI, a self -hosted
00:06:02.550 --> 00:06:05.230
GitHub runner with a web panel, a secrets UI,
00:06:05.370 --> 00:06:09.009
or an Argo UI. If it can trigger actions, it's
00:06:09.009 --> 00:06:12.009
an attack surface. And with OpenClaw, the core
00:06:12.009 --> 00:06:14.449
lesson isn't, wow, they had a bug. The lesson
00:06:14.449 --> 00:06:17.589
is agents collapse trust boundaries. Because
00:06:17.589 --> 00:06:20.149
the UI isn't just showing you data, it's holding
00:06:20.149 --> 00:06:22.980
the steering wheel. So if a browser session can
00:06:22.980 --> 00:06:25.899
be tricked into handing over a token or connecting
00:06:25.899 --> 00:06:28.079
somewhere it shouldn't or trusting something
00:06:28.079 --> 00:06:31.300
it shouldn't, the impact is way bigger than someone
00:06:31.300 --> 00:06:34.660
saw a page. The impact is you just handed someone
00:06:34.660 --> 00:06:37.259
an operator account for something that can execute
00:06:37.259 --> 00:06:40.459
on your machine, which is basically the worst
00:06:40.459 --> 00:06:43.740
version of developer laptop compromise. Because
00:06:43.740 --> 00:06:46.680
now it's not even a human making the decisions.
00:06:46.779 --> 00:06:49.680
It's an automation system that can be nudged.
00:06:49.980 --> 00:06:52.819
So practical takeaway here. If you are running
00:06:52.819 --> 00:06:55.519
OpenClaw or anything like it, you need to patch
00:06:55.519 --> 00:06:58.800
fast, obviously. But also, stop thinking local
00:06:58.800 --> 00:07:02.279
equals safe. Local just means the blast is on
00:07:02.279 --> 00:07:05.160
you first. And that sounds dramatic, but it's
00:07:05.160 --> 00:07:07.519
true. The minute you have a privileged local
00:07:07.519 --> 00:07:11.480
service plus a browser UI plus tokens, you are
00:07:11.480 --> 00:07:14.639
in the same design space as a mini control plane.
00:07:14.779 --> 00:07:20.980
So you need to treat it that way. Now, let's
00:07:20.980 --> 00:07:23.480
talk about the part that will feel extremely
00:07:23.480 --> 00:07:26.240
familiar to anyone who has lived through supply
00:07:26.240 --> 00:07:29.379
chain headaches. OpenClaw has skills. There are
00:07:29.379 --> 00:07:31.839
extensions, add -ons, whatever you want to call
00:07:31.839 --> 00:07:34.399
them. And there was a wave of malicious skills
00:07:34.399 --> 00:07:37.399
showing up, including hundreds flagged in reporting.
00:07:37.639 --> 00:07:40.620
This is the oldest story on the internet. A popular
00:07:40.620 --> 00:07:43.920
platform shows up, a registry shows up, a bunch
00:07:43.920 --> 00:07:46.579
of people install things because, hey, it's open
00:07:46.579 --> 00:07:48.839
source and the community is building cool stuff.
00:07:49.060 --> 00:07:51.980
And attackers go, oh, sick, an executable distribution
00:07:51.980 --> 00:07:54.860
channel with confused users. The difference here
00:07:54.860 --> 00:07:57.420
is the payload. With normal package ecosystems,
00:07:57.980 --> 00:08:01.040
malware tends to be about stealing tokens, crypto,
00:08:01.379 --> 00:08:04.339
SSH keys, browser data, that kind of thing. With
00:08:04.339 --> 00:08:07.439
agent ecosystems, the malware doesn't just steal,
00:08:07.600 --> 00:08:10.360
it can also steer. Because skills don't just
00:08:10.360 --> 00:08:12.920
sit there. They influence what the agent can
00:08:12.920 --> 00:08:15.800
do, what it can access, and what kinds of actions
00:08:15.800 --> 00:08:19.019
it will take. And the social engineering is painfully
00:08:19.019 --> 00:08:22.160
predictable. It's stuff like, install this prerequisite,
00:08:22.339 --> 00:08:25.160
run this command real quick, paste this into
00:08:25.160 --> 00:08:27.800
your terminal. If you've ever watched someone
00:08:27.800 --> 00:08:31.399
get popped by a fake homebrew tap or a sketchy
00:08:31.399 --> 00:08:34.379
curl pipe bash, you already know the vibe. Now,
00:08:34.399 --> 00:08:37.409
layer in the agent angle. The agent is reading
00:08:37.409 --> 00:08:40.409
markdown. The agent is summarizing pages. The
00:08:40.409 --> 00:08:42.990
agent is trying to be helpful. So the attack
00:08:42.990 --> 00:08:45.830
surface becomes any content the agent consumes.
00:08:46.009 --> 00:08:48.429
Not just who can message it, but the content
00:08:48.429 --> 00:08:51.009
itself. That's a weird shift, and it matters
00:08:51.009 --> 00:08:54.090
for how we build controls. Because an agent can
00:08:54.090 --> 00:08:56.950
be tricked through an email it reads, a doc it
00:08:56.950 --> 00:09:00.309
summarizes, a ticket it opens, a website it fetches,
00:09:00.409 --> 00:09:03.070
a pastebin it looks at. And if the agent has
00:09:03.070 --> 00:09:06.710
tool access, the question becomes, can that untrusted
00:09:06.710 --> 00:09:10.009
content cause tool execution? If yes, congratulations.
00:09:10.529 --> 00:09:12.789
You just made reading the internet equivalent
00:09:12.789 --> 00:09:15.529
to running code unless you build a guardrail.
00:09:15.649 --> 00:09:18.529
This is why the OpenClaw story matters to DevOps
00:09:18.529 --> 00:09:21.909
more than most AI hype. It's not about AI is
00:09:21.909 --> 00:09:24.629
coming. It's about we just added a new automation
00:09:24.629 --> 00:09:28.250
surface where content can turn into action. And
00:09:28.250 --> 00:09:34.840
that's a big deal. So this is the part I actually
00:09:34.840 --> 00:09:38.259
care about. Because tools come and go. OpenClaw
00:09:38.259 --> 00:09:40.159
could disappear tomorrow and the core problem
00:09:40.159 --> 00:09:43.179
stays. The core problem is autonomous agents
00:09:43.179 --> 00:09:46.259
are becoming a new class of privileged workflows.
00:09:46.620 --> 00:09:49.320
Except the workload is running on somebody's
00:09:49.320 --> 00:09:52.679
laptop, or in random VMs, or in somebody's home
00:09:52.679 --> 00:09:55.240
lab, or eventually in some sanctioned internal
00:09:55.240 --> 00:09:58.039
deployment. And it has access to things we normally
00:09:58.039 --> 00:10:01.679
treat as high value. cloud credentials, source
00:10:01.679 --> 00:10:06.480
control, CICD, secrets managers, internal APIs,
00:10:06.919 --> 00:10:09.419
sometimes payment methods because people are
00:10:09.419 --> 00:10:12.460
wiring these agents into subscriptions or usage
00:10:12.460 --> 00:10:15.379
-based services, or yeah, even credit cards for
00:10:15.379 --> 00:10:18.179
auto purchase type stuff. So let's reframe it
00:10:18.179 --> 00:10:21.460
in SRE language. An agent is an operator that
00:10:21.460 --> 00:10:24.580
accepts untrusted input. An agent is an operator
00:10:24.580 --> 00:10:28.019
that can take actions. And an agent is an operator
00:10:28.019 --> 00:10:31.480
that is very hard to reason about because its
00:10:31.480 --> 00:10:34.759
decision engine is not deterministic code you
00:10:34.759 --> 00:10:37.940
wrote. It's a model that can be influenced. So
00:10:37.940 --> 00:10:40.659
what do we do with operators? We reduce permissions.
00:10:40.879 --> 00:10:43.879
We isolate environments. We add approval steps
00:10:43.879 --> 00:10:47.919
for dangerous actions. We add audit logs. We
00:10:47.919 --> 00:10:50.759
set boundaries like egress controls. We separate
00:10:50.759 --> 00:10:53.980
duties. We rotate credentials. And we monitor.
00:10:54.220 --> 00:10:57.019
We run it like production. And the reason this
00:10:57.019 --> 00:10:59.600
is tricky is because a lot of people are approaching
00:10:59.600 --> 00:11:02.700
agents like a productivity app. They are treating
00:11:02.700 --> 00:11:05.289
it like installing Notion. But it's closer to
00:11:05.289 --> 00:11:08.669
installing a junior admin who never sleeps and
00:11:08.669 --> 00:11:11.370
can be convinced by a well -written paragraph.
00:11:11.730 --> 00:11:14.850
So here's the mindset shift I want you to take
00:11:14.850 --> 00:11:17.590
away from this episode. If your agent can run
00:11:17.590 --> 00:11:20.549
tools, it is infrastructure. If it touches credentials,
00:11:20.929 --> 00:11:23.750
it is privileged infrastructure. If it reads
00:11:23.750 --> 00:11:26.549
untrusted content, it is exposed infrastructure.
00:11:26.929 --> 00:11:29.610
And it needs controls that match that. Which
00:11:29.610 --> 00:11:32.220
leads me to the next point. Most orgs are not
00:11:32.220 --> 00:11:35.320
set up for this, culturally or technically, because
00:11:35.320 --> 00:11:37.820
we've spent years building guardrails around
00:11:37.820 --> 00:11:40.980
CI and prod. We've spent even less time building
00:11:40.980 --> 00:11:43.639
guardrails around laptops, especially when the
00:11:43.639 --> 00:11:45.940
laptop is now running a local control plane.
00:11:46.100 --> 00:11:48.960
So we need a minimum viable safety approach.
00:11:49.240 --> 00:11:52.419
Not perfect, not academic, just don't be reckless.
00:11:56.399 --> 00:11:59.120
So let's keep this practical. If you are experimenting
00:11:59.120 --> 00:12:02.299
with OpenClaw or any local agent framework, here's
00:12:02.299 --> 00:12:04.980
the bar I'd personally want, even just for tinkering.
00:12:05.100 --> 00:12:07.600
First, don't run it on your main machine with
00:12:07.600 --> 00:12:10.480
your main creds. I know, I know, everybody does
00:12:10.480 --> 00:12:12.899
it because it's convenient. But if the agent
00:12:12.899 --> 00:12:15.899
needs AWS access, you need to give it dedicated
00:12:15.899 --> 00:12:19.620
AWS identity that is scoped down. Separate account
00:12:19.620 --> 00:12:22.460
if you can, or at least separate role with tight
00:12:22.460 --> 00:12:25.659
permissions, short -lived tokens, and no administrator
00:12:25.659 --> 00:12:28.720
access because I'm just testing. Same idea for
00:12:28.720 --> 00:12:32.080
GitHub. Same idea for GCP. Same idea for anything.
00:12:32.399 --> 00:12:34.659
Second, you need to separate the agent's environment
00:12:34.659 --> 00:12:37.779
from your daily environment. A VM is fine. A
00:12:37.779 --> 00:12:40.120
separate machine is better. A separate user account
00:12:40.120 --> 00:12:42.759
is better than nothing. The real point is to
00:12:42.759 --> 00:12:45.740
avoid agent compromise equals my whole dev life
00:12:45.740 --> 00:12:48.480
is compromised. Because a lot of the stuff you
00:12:48.480 --> 00:12:51.019
actually care about is sitting right there on
00:12:51.019 --> 00:12:54.820
your laptop. SSH keys, browser sessions, cloud
00:12:54.820 --> 00:12:59.159
CLIs, kube configs, slack tokens, password manager
00:12:59.159 --> 00:13:02.559
sessions, all of it. Third, don't expose the
00:13:02.559 --> 00:13:05.879
control interface. And if you do, don't do it
00:13:05.879 --> 00:13:08.519
casually behind some reverse proxy you copied
00:13:08.519 --> 00:13:11.559
from a blog. This is the I put it behind engine
00:13:11.559 --> 00:13:14.580
X so it's fine trap. If it's an admin plane,
00:13:14.879 --> 00:13:18.279
it needs real auth, origin controls, and it should
00:13:18.279 --> 00:13:20.799
not be discoverable from the public internet.
00:13:20.980 --> 00:13:24.399
Period. Fourth, treat untrusted content like
00:13:24.399 --> 00:13:27.200
a biohazard. If your agent is reading emails
00:13:27.200 --> 00:13:30.340
from the open internet, browsing the web, or
00:13:30.340 --> 00:13:33.600
pulling in random docs, consider a split agent
00:13:33.600 --> 00:13:36.830
approach. One agent that is read -only, whose
00:13:36.830 --> 00:13:40.350
whole job is summarizing untrusted content. Then,
00:13:40.409 --> 00:13:43.570
a second agent that has tools, but only sees
00:13:43.570 --> 00:13:46.789
the summary, not the raw content. That might
00:13:46.789 --> 00:13:49.629
feel annoying, but it's basically the same concept
00:13:49.629 --> 00:13:52.250
as don't run customer input through the same
00:13:52.250 --> 00:13:54.690
context that can trigger production actions.
00:13:55.049 --> 00:13:58.389
Different zone, different trust level. Fifth.
00:13:58.679 --> 00:14:01.679
Approvals. If your agent can do anything destructive,
00:14:02.080 --> 00:14:05.000
require explicit approval for those actions.
00:14:05.299 --> 00:14:07.940
And I don't mean it prints a message and asks
00:14:07.940 --> 00:14:11.279
nicely. I mean a real control point, a config
00:14:11.279 --> 00:14:14.799
that says these tools require confirmation. A
00:14:14.799 --> 00:14:18.120
workflow where send money, rotate keys, delete
00:14:18.120 --> 00:14:22.480
resources, merge PRs, apply Terraform, all require
00:14:22.480 --> 00:14:25.740
a human step. And here's the important nuance.
00:14:26.480 --> 00:14:29.759
Approvals should be tied to action classes, not
00:14:29.759 --> 00:14:32.840
tied to do I trust the agent. Because the agent
00:14:32.840 --> 00:14:35.539
can be tricked. That's the whole point. So your
00:14:35.539 --> 00:14:38.440
controls can't be vibes based. They have to be
00:14:38.440 --> 00:14:41.259
structural. Which leads me to the next point.
00:14:41.820 --> 00:14:47.620
Observability. If an agent is acting on your
00:14:47.620 --> 00:14:50.879
behalf, you need to be able to answer basic questions
00:14:50.879 --> 00:14:54.159
later. What did it read? What tools did it invoke?
00:14:54.720 --> 00:14:57.580
What credentials did it use? What calls did it
00:14:57.580 --> 00:15:00.440
make? What files did it touch? And if the answer
00:15:00.440 --> 00:15:03.200
is, uh, it just kind of did stuff, you're going
00:15:03.200 --> 00:15:05.620
to have a terrible time the first time something
00:15:05.620 --> 00:15:08.399
goes wrong. This is where I think DevOps people
00:15:08.399 --> 00:15:11.120
can actually contribute a lot. Because we already
00:15:11.120 --> 00:15:13.659
know how to wrap scary automation in safely.
00:15:13.899 --> 00:15:16.419
We already know how to build pipelines with audit
00:15:16.419 --> 00:15:18.799
trails. We already know how to treat privileged
00:15:18.799 --> 00:15:22.139
systems like they're hostile by default. So if
00:15:22.139 --> 00:15:24.879
your team is adopting agents, push for the boring
00:15:24.879 --> 00:15:28.419
stuff. Centralized logs for agent actions. Tool
00:15:28.419 --> 00:15:31.720
invocation logs with arguments. A clear mapping
00:15:31.720 --> 00:15:35.419
of agent identity to credential identity. Rate
00:15:35.419 --> 00:15:38.320
limits because agents can loop. Cost controls
00:15:38.320 --> 00:15:41.500
because agents can loop and burn money. And a
00:15:41.500 --> 00:15:44.440
kill switch, always a kill switch. Because an
00:15:44.440 --> 00:15:47.980
agent that can autonomously take actions is basically
00:15:47.980 --> 00:15:50.960
a distributed failure generator if you don't
00:15:50.960 --> 00:15:53.340
contain it. And I'm not saying that to be dramatic.
00:15:53.539 --> 00:15:56.620
I'm saying it because every SRE has seen what
00:15:56.620 --> 00:15:59.779
happens when automation goes slightly sideways.
00:16:00.139 --> 00:16:03.519
Now, imagine the automation can be socially engineered.
00:16:03.840 --> 00:16:06.480
Cool. So we need to build with that in mind.
00:16:09.759 --> 00:16:12.639
Now, the recent update that changes the vibe
00:16:12.639 --> 00:16:15.700
a little. the creator of OpenClaw got hired by
00:16:15.700 --> 00:16:19.139
OpenAI. That's not a random headline. That's
00:16:19.139 --> 00:16:22.279
a signal. It tells you agents are not going to
00:16:22.279 --> 00:16:25.120
stay in the cool open source side project lane.
00:16:25.340 --> 00:16:28.500
The big labs want this. They want personal agents,
00:16:28.759 --> 00:16:32.340
enterprise agents, multi -agent systems, agent
00:16:32.340 --> 00:16:35.700
marketplaces, all of it. So even if OpenClaw
00:16:35.700 --> 00:16:38.990
itself fades, the pattern is here to stay. And
00:16:38.990 --> 00:16:42.049
as that happens, two things are going to be true
00:16:42.049 --> 00:16:45.789
at the same time. The tools will get way better.
00:16:45.929 --> 00:16:49.370
And the security problems will get way more interesting.
00:16:49.629 --> 00:16:53.149
Because adoption drives attacker attention. And
00:16:53.149 --> 00:16:56.429
agents, by design, sit exactly where attackers
00:16:56.429 --> 00:16:59.850
love to be. In the middle of identity, action,
00:16:59.970 --> 00:17:03.049
and trust. So the question for us, as DevOps
00:17:03.049 --> 00:17:06.849
and SRE people, isn't should agents exist? They're
00:17:06.849 --> 00:17:09.910
going to exist. The question is, do we treat
00:17:09.910 --> 00:17:12.430
them like production systems, or do we treat
00:17:12.430 --> 00:17:15.269
them like toys until they bite us? Because right
00:17:15.269 --> 00:17:18.069
now, a lot of orgs are about to repeat the same
00:17:18.069 --> 00:17:20.769
mistake we made with CI systems 10 years ago.
00:17:21.009 --> 00:17:23.769
Do you remember when Jenkins was just a build
00:17:23.769 --> 00:17:26.549
box and then suddenly it was the keys to prod?
00:17:26.769 --> 00:17:29.930
Yeah, agents are going to be that, except faster.
00:17:33.869 --> 00:17:37.029
Alright, let's land this. OpenClaw is the current
00:17:37.029 --> 00:17:39.599
headline. But the real story is bigger. Local
00:17:39.599 --> 00:17:43.140
autonomous agents are a new control plane. They
00:17:43.140 --> 00:17:45.700
will end up with real access because otherwise
00:17:45.700 --> 00:17:48.700
they aren't useful. They will get targeted because
00:17:48.700 --> 00:17:51.859
that's where the value is. And local doesn't
00:17:51.859 --> 00:17:54.960
mean safe. It means the consequences start with
00:17:54.960 --> 00:17:57.599
you. So if you are experimenting with agents,
00:17:57.759 --> 00:18:01.119
awesome. Just do it like an SRE. Real credentials
00:18:01.119 --> 00:18:04.589
means real controls. And if you're leading a
00:18:04.589 --> 00:18:07.589
team, don't wait for a policy meeting in six
00:18:07.589 --> 00:18:11.009
months. Get ahead of it. Decide what safe experimentation
00:18:11.009 --> 00:18:14.630
looks like in your org before everyone quietly
00:18:14.630 --> 00:18:17.190
installs an agent and wires it into prod stuff
00:18:17.190 --> 00:18:19.890
because it's convenient. All of the links and
00:18:19.890 --> 00:18:22.329
references for this episode and the show notes
00:18:22.329 --> 00:18:25.329
are on shipitweekly .fm. If you got something
00:18:25.329 --> 00:18:28.470
out of this, a rating or review goes a long way
00:18:28.470 --> 00:18:31.279
and it helps other folks find the show. I'm Brian
00:18:31.279 --> 00:18:33.880
from Tellers Tech and see you next time. Thanks.
