Dark Mode Toggle

2026 Apr 02 See all posts My self-sovereign / local / private / secure LLM setup, April 2026

Warning: please do not simply copy the tools and techniques described in this post, and assume that they are secure. This post is meant as a starting point for a space that desperately needs to exist, not as a description of a finished product.

Special thanks to Dave, Micah Zoltu, Liraz Siri, Luozhu Zhang, Ron Turetzky, Tina Zhen, Phil Daian, Hsiao-wei Wang and others for assistance and advice up to this point.

Around the start of this year, we saw a transition in AI from chatbots - you ask an LLM a question, it gives you an answer - to agents - you give an LLM a task, and it thinks for a long time and uses hundreds of tools to perform a best-effort job at completing that task. OpenClaw, now the fastest-growing Github repo in history, has played a central role in this trend. At the same time, much of the mainstream part of the AI space, even the local open-source AI space, is completely and utterly cavalier about things like privacy and security. Take, for example, some of the recent criticism from more security-minded people about OpenClaw (here I do not blame the team, but rather the whole surrounding ecosystem and its culture):

OpenClaw agents are able to modify critical settings — including adding new communication channels and modify its system prompt — without requiring confirmation from a human. Parsing any malicious external input — such as a website, in this example — can lead to the easy takeover of a user's OpenClaw instance ... in one demonstration, researchers at AI security firm HiddenLayer directed their instance of OpenClaw to summarize Web pages, among which was a malicious page that commanded the agent to download a shell script and execute it The tool facilitated active data exfiltration. The skill explicitly instructs the bot to execute a curl command that sends data to an external server controlled by the skill author. The ne