The fundamental issue is that AI agents operate with a broken security model. They need access to do their job, but current frameworks grant that access without proper sandboxing, permission models, or audit trails.

Traditional software has spent decades developing security boundaries. Operating systems have user permissions, file system protections, and sandboxing for untrusted code. Browsers have same-origin policies and content security restrictions. These weren't built overnight—they emerged from decades of security incidents.

AI agents are speedrunning those security lessons in reverse. Give the AI broad access to make it useful, then act surprised when attackers exploit that access. We're building a new attack surface before securing the old one.

1Password's recommendations are sensible but telling:

For users: - Never run OpenClaw on company devices - If you've already run it, treat your machine as compromised - Rotate all credentials immediately - Use isolated machines with no corporate access for AI experiments

That's pretty harsh guidance. "Assume compromise" is what security teams say about ransomware, not developer tools.

For framework builders: - Default-deny shell execution - Sandbox browser and credential access - Implement time-bound, revocable permissions - Log all actions end-to-end

Those are all good practices. They're also exactly what should have been built from the start. The fact that 1Password has to recommend them suggests agent frameworks shipped without basic security considerations.

The broader problem is incentive misalignment. AI agent frameworks are racing to ship capabilities. Security slows things down. So security gets treated as a "nice to have" rather than a foundational requirement.

We've seen this pattern before—move fast and break things, ship features first and fix security later. It works until it doesn't. In this case, "doesn't work" means malware distribution networks using AI agent frameworks as delivery mechanisms.

The technology is genuinely useful. AI agents that can automate complex workflows have real value. But "useful" and "secure" aren't the same thing. Right now we're optimizing for the former and hoping the latter works out.

It won't. Security doesn't happen by accident. It requires intentional design choices that prioritize safety over convenience. That means sandboxing, permission models, audit trails—all the boring infrastructure work that slows down feature development.

Until agent frameworks implement real security boundaries, 1Password's advice is correct: don't run these tools on devices with data you care about. Treat AI agents like you'd treat random executables from the internet, because that's essentially what they are.

The good news is this is fixable. Security models exist. Sandboxing works. Permission systems are well-understood. Framework builders just need to implement them before shipping, not after malware campaigns demonstrate why they're necessary.

The bad news is that requires slowing down in a space where everyone is racing to ship. And historically, security doesn't win that race until after something breaks. Looks like we're right on schedule.