Post

I'm reasonably bought into AI tooling, but this whole Clawdbot/OpenClaw/whatever seems like crazy town to me. Anything that inserts untrusted input into an LLM (via MCP or tool calls), and has "write access" to any other tool (file system, cli, email, etc) is just ripe for prompt injection attacks

Oops! Someone sent me an email that coerces it to dump the contents of every slack channel im in into a public github issue!