https://patrik.re/tags/openclaw/ Vulnerability writeups and security research by Patrik Grobshäuser, Security Researcher at Assetnote / Searchlight Cyber. en-GB Wed, 25 Feb 2026 00:00:00 +0000 https://patrik.re/daily-workflows-with-the-email-agent/ https://patrik.re/daily-workflows-with-the-email-agent/ Wed, 25 Feb 2026 00:00:00 +0000 Real usage patterns for an AI email agent — morning triage, thread summaries, draft replies, and where the human stays in the loop. patrik.reai-security https://patrik.re/gmail-api-credentials-the-paranoid-way/ https://patrik.re/gmail-api-credentials-the-paranoid-way/ Wed, 25 Feb 2026 00:00:00 +0000 Setting up Google Cloud OAuth credentials with minimal scopes for an AI email agent — because 'full access' is never the right default. patrik.reai-security https://patrik.re/guardrails-that-actually-work/ https://patrik.re/guardrails-that-actually-work/ Wed, 25 Feb 2026 00:00:00 +0000 A four-layer defense model for AI email agents — because no single safety measure is enough when your inbox is on the line. patrik.reai-security https://patrik.re/wiring-gmail-into-openclaw/ https://patrik.re/wiring-gmail-into-openclaw/ Wed, 25 Feb 2026 00:00:00 +0000 Installing the Gmail MCP server, configuring agent tools, and filtering down to only the operations you actually want. patrik.reai-security https://patrik.re/writing-a-soul-md-for-email/ https://patrik.re/writing-a-soul-md-for-email/ Wed, 25 Feb 2026 00:00:00 +0000 Defining hard rules, tone guidelines, and PII handling for an AI email agent — because 'be helpful' isn't a security policy. patrik.reai-security https://patrik.re/syncing-obsidian-to-a-headless-server/ https://patrik.re/syncing-obsidian-to-a-headless-server/ Fri, 20 Feb 2026 00:00:00 +0000 Running Obsidian in a headless Docker container with Obsidian Sync, giving AI agents direct access to your vault. patrik.reai-security https://patrik.re/connecting-claude-max-and-telegram/ https://patrik.re/connecting-claude-max-and-telegram/ Thu, 19 Feb 2026 00:00:00 +0000 Using OAuth credentials from a Claude Max subscription to power OpenClaw agents, and wiring up a Telegram bot for mobile access. patrik.reai-security https://patrik.re/securing-the-dashboard-with-nginx-proxy-manager/ https://patrik.re/securing-the-dashboard-with-nginx-proxy-manager/ Wed, 18 Feb 2026 00:00:00 +0000 Putting the OpenClaw Control UI behind HTTPS with basic auth, WebSocket passthrough, and a proper Content Security Policy — all through Nginx Proxy Manager. patrik.reai-security https://patrik.re/setting-up-openclaw-on-hetzner-arm64/ https://patrik.re/setting-up-openclaw-on-hetzner-arm64/ Tue, 17 Feb 2026 00:00:00 +0000 Getting Node.js 22 and OpenClaw running on a fresh Hetzner CAX ARM64 Ubuntu Noble server — including the ARM64 gotchas nobody warns you about. patrik.reai-security