The agent wiped the server, he sandboxed it

What was done

On 27 February 2026 the author writes in r/openclaw that for the past week or so he has been building an e-commerce agent with OpenClaw. The Digital Ocean VPS costs about $24 a month, with 4-8GB of RAM and ~48GB of storage. He had not set up a VPS before. Claude was open in another window and walked him through the setup. Early on, the agent wiped the entire VPS. He writes that it should not have access to the whole machine. He moved from Discord to Telegram, because otherwise someone can prompt it without him knowing. Access is to go through local host, with a firewall, and without a reverse proxy onto the internet. He uses Kimi K2.5 as the main model, roughly $0.50 in and $2-3 out. A workday of prompting costs him maybe $10-15. Heartbeats on a cheaper model were costing $1-2 a day. He has also had it delete important files when the rules were unclear. Now it may only append to some lists, and some files it must not touch.

How it went

He writes that a workflow is running now. The post does not say which order the e-commerce agent has handled.

Worth knowing

The server was wiped, and files were deleted, before the rules were in place. The costs stand as he writes them: about $24 a month, roughly $0.50 in, $2-3 out, maybe $10-15 for a day and $1-2 a day. The post does not say a customer was served.

How to do it

1. Let the agent run on its own server, not on your whole machine.
2. Write which lists it may only append to, and which files it must not touch.
3. Do not open it to the internet, and do not let it delete, until you say yes. Check that the files you protect are still there.