Ok so not that many months ago, the consensus seemed to be that the smart take on openclaw was "don't trust it; don't give it write or delete access to anything you care about; don't give it read access to anything sensitive; expect that it may go off the rails and delete your inbox and send checks to that prince in your spam folder at any time. If you still have tasks that it can do within those restrictions, have fun."

Today the models are better, but they don't seem trustworthy or reliable enough that I want to give them them a lot of access or freedom. My coding agents sometimes still go off in the wrong direction, or say they did something other than what they did, or say they will do something and then immediately stop without doing anything.

The always-running (so almost never supervised) agent that is meant to do the same work as a person (and therefore needs _access_ like a person) seems like a notorious footgun from earlier this year was just made more powerful, and the companies that are supposed to know the most are telling you to connect it to everything.