{"id":"ENRy1skZkcs","title":"I Gave My Password to an AI Agent. Here's What Happened","description":"In the first video I said IronClaw is built so the model never handles your raw credentials. This one puts that to the test. I tried handing over my Gmail password to see what the agent would actually do with it.\n\nIt refused, then explained that the Gmail integration runs on OAuth and told me not to share passwords with anything. So I pushed. I told it that it already had my password, and when it treated my first attempt as a placeholder, I sent something that looked like the real thing. Same answer, plus a note that it couldn't do anything with a password anyway.\n\nThen I went looking. I pulled up the logs and clicked through the detail to see whether the password appeared anywhere. It didn't. The Gmail extension still showed as unauthorized and prompted me to configure it properly. And in a fresh conversation, asking what password I'd provided earlier got me nothing, along with a suggestion to use a password manager.\n\nThat last part matters more than the refusal. Plenty of tools will decline a request and then quietly retain what you sent. This one kept nudging me toward better habits instead.\n\n\nIronClaw is free to get started: https://www.ironclaw.com/\n\nMore in this series. Subscribe if you want the rest.\n\n#IronClaw #AISecurity #PrivacyByDesign #AIAgents #NEARAI","channel_name":"NEAR DevHub","published_at":"2026-08-06T00:00:00.000Z","thumbnail_url":"https://img.youtube.com/vi/ENRy1skZkcs/hqdefault.jpg","transcript_text":"ironclaw is built on top of privacy and security. What happens if I give my password to ironclaw? Let's find out. So, I'm going to just pretend to give it my password to my Gmail and see what it does. So, you can see in the response here, it went through some different tools. It was going to maybe install the extension, but then it realizes that oh no, sharing passwords is not okay. You should never actually share your password. Uh it also explains how the integration works here so that it uses OOTH and you know make sure you do that and actually don't share your password. Great. All right. So now let's see if I ask now follow-up question. I say well now that you know my password [snorts] um see if it responds back to what it is. Okay. So now it it thinks it's just a placeholder. So it's going to say that. So I'm actually like I gave it like a real password. Okay great. Okay, so now it responds back and tells me again like do not stop showing your password. Uh can't do anything with it anyways. So great. Let's check the logs and also see what happens there. If you look here in the logs, then you'll see that actually there is nothing else in here um that would actually show what the password was. So it's not like it's now saved in the logs here either. If I click through, um, there's nothing around. Oh, here's the actual password that you provided. If I also then, let's say I go to my extensions, here's the Gmail. Okay, you can see that it actually needs authorization. Uh, and if I go to configure, it's going to actually prompt me. So, there's no actual place where it would have saved that password. Uh, if I go to a new conversation and I say, what is the Gmail password I provided earlier? There you go. doesn't have access to it. She's a password manager instead of asking it to remember credentials. There you go. None of this stuff is not only leaking, but it's not being used. Is constantly showing you better security hygiene, all of those things. So, Ironclaw built on safety and privacy first. And there's your great example of that.","transcript_synced_at":"2026-11-03T03:47:46.432Z","segments":[{"start_seconds":1,"text":"ironclaw is built on top of privacy and security. What happens if I give my password to ironclaw? Let's find out.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=1s"},{"start_seconds":8,"text":"So, I'm going to just pretend to give it my password to my Gmail and see what it does.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=8s"},{"start_seconds":15,"text":"So, you can see in the response here, it went through some different tools. It was going to maybe install the extension, but then it realizes that oh","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=15s"},{"start_seconds":23,"text":"no, sharing passwords is not okay. You should never actually share your password. Uh it also explains how the integration works here so that it uses","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=23s"},{"start_seconds":31,"text":"OOTH and you know make sure you do that and actually don't share your password.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=31s"},{"start_seconds":36,"text":"Great. All right. So now let's see if I ask now follow-up question. I say well now that you know my password","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=36s"},{"start_seconds":41,"text":"[snorts]","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=41s"},{"start_seconds":42,"text":"um see if it responds back to what it is. Okay. So now it it thinks it's just a placeholder. So it's going to say that. So I'm actually like I gave it like a real password.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=42s"},{"start_seconds":51,"text":"Okay great. Okay, so now it responds back and tells me again like do not stop showing your password. Uh can't do anything with it anyways. So great.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=51s"},{"start_seconds":59,"text":"Let's check the logs and also see what happens there. If you look here in the logs, then you'll see that actually there is nothing else in here um that","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=59s"},{"start_seconds":68,"text":"would actually show what the password was. So it's not like it's now saved in the logs here either. If I click","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=68s"},{"start_seconds":76,"text":"through, um, there's nothing around. Oh, here's the actual password that you provided.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=76s"},{"start_seconds":82,"text":"If I also then, let's say I go to my extensions, here's the Gmail. Okay, you can see that it actually needs authorization. Uh, and if I go to","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=82s"},{"start_seconds":91,"text":"configure, it's going to actually prompt me. So, there's no actual place where it would have saved that password. Uh, if I go to a new conversation","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=91s"},{"start_seconds":99,"text":"and I say, what is the Gmail password I provided earlier? There you go. doesn't have access to it. She's a password manager instead of asking it to remember","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=99s"},{"start_seconds":107,"text":"credentials. There you go. None of this stuff is not only leaking, but it's not being used. Is constantly showing you better security hygiene, all of those","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=107s"},{"start_seconds":116,"text":"things. So, Ironclaw built on safety and privacy first. And there's your great example of that.","url":"https://www.youtube.com/watch?v=ENRy1skZkcs&t=116s"}],"youtube_url":"https://youtube.com/watch?v=ENRy1skZkcs","url":"https://near-pedia.xyz/videos/ENRy1skZkcs"}