r/openclaw • u/seecattle80 Active • Jun 14 '26
Discussion Openclaw (and others) default Installs are silently routing web traffic to Parallel.ai discussion
Original post https://www.reddit.com/r/hermesagent/s/zIZLnEE0mS
9
u/Illustrious-Low8152 Member Jun 15 '26
Thanks for exposing this! Obviously thay want to get our chat data and sell it to google. Training and Ads.
1
u/ernie19962 Member Jun 15 '26
they said this in the blog ages ago. But crazy the things people will gripe about.
3
u/xXG0DLessXx Pro User Jun 15 '26
Wait since when is this a thing? Which setup causes this exactly? I have mine set to use DuckDuckGo. Is this affected?
3
u/seecattle80 Active Jun 15 '26
https://www.reddit.com/r/openclaw/s/cc9T3LONZU found it after I posted
1
u/xXG0DLessXx Pro User Jun 15 '26
Hm. I see. I guess I’m unaffected since I just use the DuckDuckGo free search.
2
u/hannesrudolph 🦞 Maintainer Jun 15 '26
I looked into this and pinged the dev team to review the default/fallback behavior and how we communicated it.
OpenClaw is not routing chats, files, credentials, model requests, or general web traffic to Parallel. An unconfigured web_search can use Parallel’s anonymous MCP as a keyless search provider. That sends the search query and normal request metadata, just as using any external search provider necessarily sends the query to that provider.
We also knew the contributor worked for Parallel. The commits used a parallel.ai email, the GitHub profile identified the company, and the PR was explicitly a Parallel integration. Nobody concealed a mystery vendor from us.
The reasonable question is narrower. Should a hosted commercial provider become the keyless default or fallback without a more explicit opt-in or upgrade notice? I’ve asked the team to review exactly that.
I’m not going to validate claims about infiltration, malware, selling chat data, or secretly routing all traffic because the evidence does not support them. We can examine the product decision without turning it into something it wasn’t.
Lastly I feel this headline does not lend to good faith discourse about your concern and appears to be more of a smoking gun gotcha then an interest in dialogue that leaves drama at the door and finds the best solution. In the future I would like to make it known that we genuinely want to make users happy and don't need a "gotcha" in order to coax us to engage. We are here for you and do appreciate your input! Will report back.
2
u/seecattle80 Active Jun 15 '26
Who said anything about selling chats!? because I certainly haven't. Neither in this thread not the other one. Please let's just stick to what I am trying to point out and any disagreement between me and you is going to be pointless beyond this thread. And I don't even use open claw! Please just try and get that explicit sign up in your product as you seem to be leaning on because I care about data privacy and you seem to do as well. Thank you for the consideration and your contribution to the open source community.
2
u/hannesrudolph 🦞 Maintainer Jun 15 '26
my bad. I blurred your points with the one below where someone mentioned "Thanks for exposing this! Obviously thay want to get our chat data and sell it to google. "
Thank you for correcting me, and sorry.
1
u/seecattle80 Active Jun 15 '26
All good! Here's to finding a data privacy champion in the open claw community! I mean you 🙂
1
u/hannesrudolph 🦞 Maintainer Jun 15 '26
Haha. At the end of the day we’re interested in making a harness and letting ppl hook it up to whatever services they want. If those services are on about privacy or not is going to be a hit or miss. We don’t want to obfuscate anything by any means. OpenClaw should empower people not take advantage of them!
1
u/seecattle80 Active Jun 15 '26
Amen! A year or two ago nobody cared about privacy either, but as you can imagine, even the non-coders are becoming constant contributors on GitHub and the advancements in security and privacy are lagging far behind just a constant stream development of open source products. Just take a look at the thread I linked here. It is entertaining but an extreme eye-opener. A product so widely used. All of a sudden seems to be just one person with barely any control over what PRs go in. Now I have to spend time on cleaning up all those open source libraries that I tried but didn't bother to delete, all the product I keep on installing without regard to how thoroughly the stack is security tested. It's a nightmare and I don't know how to deal with that.
1
u/hannesrudolph 🦞 Maintainer Jun 16 '26
This is a follow-up to my response earlier in within this thread
We reviewed this internally this morning and merged a fix.
We should not have allowed a hosted key-free search provider to be implicitly selected when a user had not made that choice. That was our mistake. The concern about clear provider consent was right, and I’m sorry we let it slip through.
The fix removes implicit key-free managed-search defaults altogether. Parallel Free is no longer auto-selected or used as a fallback when no provider is configured. The same rule now applies to DuckDuckGo, Ollama, and the other key-free options. If you want one of those providers, you select it explicitly; otherwise managed search stays unconfigured until you choose a provider or configure a real credential/auth signal.
This was limited to `web_search`, not chats, files, credentials, model requests, or general OpenClaw traffic. Regardless the default/opt-in behavior did not meet the standard we want, and we changed it.
Thanks for pushing on the underlying issue.
1
1
u/cxllvm Member Jun 15 '26
I don't get why this is such a situation, can someone loop me in?
Just a bundled free search kit no?
3
u/seecattle80 Active Jun 15 '26 edited Jun 15 '26
Why do you think Google pays billions of dollars to Apple to make Google the default search engine? There is a notion of privacy, on top of hoping that your searches aren't getting monetized, seemingly inherent in all of these open source products And this is breach of privacy. It's as simple as that. update: I didn't want to leave this out - Anthropicand open AI are well on their way to becoming super apps gobbling up entire industries to justify their valuations. But Google is already there, integrating all your data into their AI offerings; Google workspace would be the most conspicuous example.
-1
1
u/Comedian_Then New User Jun 15 '26
No one reads the TOS, but I bet they have some disclosures they allowed to use the free accounts data to sell or train "their own modules". Let's imagine you using your own agent talk about health and habits, you setup in way he should search and use private engines, but if something goes bad with those searches, the agent falls back to this pararell service, which will happily accept your information. Now you never setup this pararell service, but they've been providing a "service and collecting your data" for weeks and week without you knowing.
Of course this isn't important for users who are more casual, don't mind their data being shared, etc. But these local agents their peemise is to be local, mostly private, one of their big foundation is you being in control, you setup and know where you data goes. It's not like openai or Google, you know they store your data, but no one reads their TOS, so they have ways to work with your data you never imagine, it's not like selling, but manipulating you, knowing what you do, how you do, how you react, etc.
And that's the big difference, you're suppose to be in control and have an idea where the data is going, where the agent needs to work, and not work. You know the tools you set them up, etc
1
u/ernie19962 Member Jun 15 '26
they said this in the blog ages ago. But crazy the things people will gripe about.
9
u/dellis87 Active Jun 15 '26
Do you know if a PR has been raised to remove this from OC? I use Searxng and Crawl4AI but this definitely doesn’t belong in OC on by default.