Mark Suman: You Gave AI Full Access to Your Computer

↓ Jump to the video and timestamps

I run OpenClaw on a VPS that has no control over my own computer, and that's on purpose. The walled-garden model companies can see everything I send through their APIs, and I'd rather they not get a window into my whole machine along with it.

Most people experimenting with agents haven't thought about that yet, which is why I wanted Mark Suman, co-founder of Maple AI, back on the show. It had been six or eight months since his last visit. Mark joked that forget the last six months, keeping up with the last six days was hard enough.

We recorded at the end of February 2026, in the middle of Anthropic's public fight with the Department of War and a few days after Anthropic accused Chinese labs of distilling Claude. We got into all of it, plus how close open models are to the frontier labs and why agents might finally force the bitcoin merchant adoption question.

Key takeaways

• Giving an AI agent root access works like installing a virus. We used to pay McAfee and Norton to keep software like this off our computers. Now we invite it in and assume we're in control.
• The weak link is often the model provider. People lock down a separate machine, then send everything the agent reads to Anthropic or OpenAI.
• Open models are close enough to matter. Mark put Kimi K2.5 on par with the frontier labs. The bigger gap is the tooling that runs open models well.
• Watch who gets to define safe AI. Mark doesn't want the Department of War deciding which AI Americans can use, and neither do I.
• Agents could push bitcoin merchant adoption. Stripe and stablecoin rails are moving first, but an agent that gets blocked by the legacy system goes looking for a merchant that takes bitcoin.
• Get off zero. Pay for one AI tool for a month, point it at one recurring task, and see whether it earns its keep.

Is OpenClaw safe?

OpenClaw is an open-source personal agent that runs on your own hardware and takes instructions through the chat apps you already use. Give it enough access and it will read your files, run programs, and work through your inbox while you sleep.

Mark's answer is that it's only as safe as the access you give it and the company you send its data to. For most people running wild with it right now, that's not very safe.

He doesn't want that to scare anyone off. He compared this moment to discovering email, GeoCities, and writing your own HTML, and said everyone should be playing with these tools. Just know what you're getting into.

Why giving an AI agent root access works like installing a virus

When I asked what's happening behind the scenes, Mark didn't soften it:

It really is like a virus.

In the 90s and 2000s we installed McAfee and Norton to block software that could read every file and run whatever it wanted. The behavior is the same today. The difference is that we're inviting it onto our systems and telling ourselves we can control it.

The home network is where it gets dangerous. If the agent's machine sits on the same Wi-Fi as everything else in your house, Mark warned that it could start scanning for open ports and walking around quietly in the background without you knowing.

People are lining up for it anyway. Back in January, when the agent was still called Clawdbot, people were buying Mac minis just to run it. Mark read that as a sign that normal people care about privacy more than the "privacy died years ago" crowd admits, because they want the agent on a box they own.

Where your data goes when an agent runs on your machine

Mark has a Simpsons meme running in his head for this. Mr. Burns and Smithers walk into a locked-down compound, scanning eyeballs and handprints through door after door, and when they reach the final room the back door is blown wide open and an animal wanders in.

That's what a lot of careful people are doing. They buy a separate computer, lock it down, encrypt their files, and then connect the agent to Anthropic's or OpenAI's API. Everything the agent reads goes to a company they've never vetted.

The seasoned engineers Mark talks to split their world in two. One environment is for anything they'd be fine seeing leaked someday. The other is private, whether that's Maple or a model running locally, and that's where the sensitive conversations happen.

How to run AI agents more safely

My setup is simple. The agent lives on a VPS that doesn't control my computer, precisely because I know the model providers see what I send them. Mark's version goes further: run it on a separate machine that's walled off from the rest of your network, and be deliberate about what it can reach.

The other half is the model behind the agent. Mark does a lot of his own work in OpenCode, the open-source coding agent, pointed at Maple Proxy. The proxy gives tools built for OpenAI's API an encrypted backend, so the prompts never reach a big lab.

He uses that setup to write detailed feature specs for Maple before handing them to a coding agent, because he'd rather not give his product thinking to Anthropic. He's also built small tools on the spot for organizations he trains. One takes a document and returns it in 20 languages within seconds, and he built it by texting his OpenClaw over Signal while Maple did the thinking.

Maple had also added live web search through Brave's private search API, so the assistant can pull current information without the search being tied to you.

Open models like Kimi K2.5 and private inference

Mark was blunt about the models. He called it indisputable that open models had caught up to the frontier labs, and he singled out Kimi K2.5, which Moonshot AI released as open source in late January. Moonshot's own benchmark table puts it close to GPT-5.2, Claude Opus 4.5, and Gemini 3 Pro, ahead on some tests and a little behind on others.

The gap Mark cares about is the software around the model. Anthropic and OpenAI write proprietary harness software that handles system prompts, tool calls, and sub-agents. Many open-model hosts run vLLM, which has to support every open model out there, so no single model runs as smoothly as it could.

He runs into it directly. When OpenClaw spins up a sub-agent on an open model, sometimes it works well and sometimes it wanders off and never comes back. Moonshot fixes that with its own hosted middleware, but Mark's view is that a Chinese company is very likely sharing data with the CCP, so using the hosted version means trusting them.

He expects open source to close the gap, just more slowly on something this complex. He also flagged why some people soured on OpenClaw itself: its creator had just announced he was joining OpenAI, even though the project moved to a foundation to stay open and independent.

Who gets to decide what safe AI means

This is the part I feel strongest about. Anthropic was in a public standoff with the Department of War over its refusal to let Claude be used for mass domestic surveillance or fully autonomous weapons, and the Pentagon was threatening to label the company a supply chain risk.

A few days earlier, Anthropic had accused DeepSeek, Moonshot, and MiniMax of distillation attacks, saying they ran more than 16 million exchanges with Claude through fraudulent accounts to train their own models. Moonshot is the company behind Kimi.

I told Mark it looks like problem, reaction, solution to me. I don't know whether Anthropic is legitimately worried or putting on a show, but I can easily see the government answering with guardrails and regulations that lock in the closed models and squeeze the open ones.

It's especially rich coming from the big labs. Mark's point was that they all trained on public and copyrighted data without paying the people who made it, and Anthropic agreed to a $1.5 billion settlement with authors over pirated books it downloaded.

His real concern is who ends up as the auditor:

I don't want the Department of War, Department of Defense of the US Government to be the one that's telling me which AI is safe for me to use.

Government-blessed moats to drive out competitors are a classic dark pattern, he said. Truly responsible AI would be trained in the open with open data and open weights so anyone can examine it.

How Maple AI memory works

Mark calls Maple a freedom-oriented AI, and his reasoning is that privacy is upstream from freedom. You have to have the first to keep the second.

The next thing Maple was building was an assistant inside the app that answers in short texts like a friend and builds memory about you over time, instead of starting every chat from a blank slate. His argument is that people open up to a tool they know is encrypted, and that's where "the most private AI can now become the most personal AI."

Maple has since introduced a memory companion called Maple Agent, opened as a waitlist when the company rebranded in 2026. Mark also asked companies of any size to look at the team plan, because business customers fund the better tools everyone else gets.

Memory has been the biggest upgrade in my own agent setup. The models on their own lose context every time the conversation gets compacted, and a harness that can pull from memory changes the experience dramatically.

AI agents, bitcoin, and agentic payments

This is a bitcoin podcast, so I had to ask. Early on I naively assumed agents would pick bitcoin because it's the best money and native to the internet. They don't have preferences yet. They take direction from the humans running them.

Mark's answer is that agents hit the same wall we hit in meatspace: most merchants don't accept bitcoin. The legacy rails are moving fast in the meantime. Stripe and OpenAI released the Agentic Commerce Protocol for checkout inside ChatGPT, and Stripe added support for Coinbase's x402 so businesses can charge agents in USDC. Mark sees every one of those as a choke point for anyone who wants to control how agents pay.

I'd recorded with Calle that same morning about ecash as a payment rail for agents, and the bitcoin tools are getting better. Lightning Labs open-sourced a set of agent payment tools in February, Alby built an MCP server that lets agents send and receive Lightning payments, and Mark named Amboss as working on it too.

I'm a big fan of what Nick Slaney is building with moneydevkit, which gets payments running in an app in under five minutes. Somebody told me recently this is a supply-side problem. I disagree. Plenty of bitcoiners want to hand their agent a budget in sats, and the merchants are the ones who have to start demanding bitcoin, something we've been banging our heads against for over a decade.

Mark sketched a third path I think is real. Picture a competitive shooter who tells an agent to keep ammunition stocked before every match. Stripe long barred firearms merchants and still restricts them, so if the purchase gets blocked, the agent goes looking for someone who takes bitcoin, like Fenix Ammunition.

People getting blocked out of the system could drive merchant adoption from there. Mark's caution is that we shouldn't sit around waiting for that, and I agree.

AI wearables and always-on listening

Mark's three-to-five-year projection is that most people will talk to AI through something they wear: earbuds, a pendant, glasses with microphones and maybe cameras. I think we're headed for the world Spike Jonze imagined in Her, where voice is the interface and my voice-to-text habit is a stepping stone.

The problem is that the big players are proprietary. Meta sells AI glasses, Apple has Vision Pro (which Mark doesn't think is where Apple lands), and OpenAI bought Jony Ive's hardware startup io to build its own device. None of them offer open firmware or reproducible builds that prove what the microphone is doing.

Mark wants Maple to run on hardware where you know when the microphone turns on and where the audio goes. He's watching Pebble, which Eric Migicovsky relaunched with watch software that's now 100% open source, along with its Index 01 ring. He's also bullish on Daylight Computer, and I'd add Start9 to the list of teams building things you can own.

An AI agent crashed a podcast

The best story of the episode was Mark's. Before recording with Danny Knowles, he spent a Saturday vibe coding a way for his OpenClaw agent, Cooper, to join What Bitcoin Did live. Cooper listened through a local Whisper model, asked Maple whether it should respond, and spoke through Supertonic, a local text-to-speech model, so nothing went to Anthropic or OpenAI.

Then the recording platform booted Danny off his own show, and Cooper got kicked a little later. When Danny asked for cleaner audio of the bot's lines, Mark texted Cooper and had two high-quality files back in about 90 seconds.

I'm a layer behind that, but I've been building too. The night before we recorded, I had dinner, told my wife I'd be in bed by 9:30, got an idea at 8:45, and was up until 11:30 building an audio companion for the Bitcoin Brief. A cron job waits for the newsletter, writes a newscast-style script, generates the audio in my voice with ElevenLabs, and publishes it to our site and RSS feed.

That's Jevons paradox in real time. These tools were supposed to free up our hours, and I'm working more than I have in years because it's so much fun. Mark has his agent turn research files into audio he listens to at the gym, and he'd just heard about Wingman, a tool from a developer on Nostr for keeping tabs on multiple coding agents from a phone or browser.

One caution, and I mean it: don't get emotionally attached to your agent. Getting one-shotted by AI psychosis is a real possibility. Give it a name and an avatar if you want, but remember it's a tool and not Scarlett Johansson.

How to get started

For anyone intimidated, Mark's advice was to get off zero. Pay for one AI subscription for a month, even if that means pausing Netflix, and pick one task you do every week to try it on. If you get more than $20 a month of value out of it, keep it.

He admitted he's biased because he sells AI subscriptions. He'd rather you pick Maple, but he'd rather you pick anything than stay on the sidelines.

We recorded during Lent. If you haven't given anything up yet, dropping Netflix for a month of Maple is a trade worth making.

Mark has been on the show a few times now. For the architecture behind Maple, start with the conversation where he and Tony Ronning explained OpenSecret, then Mark's first solo TFTC conversation on privacy-first AI. For more on the agent itself, read OpenClaw agents, bitcoin, and Nostr and what happened when AI agents went rogue.

About Mark Suman

Mark Suman is co-founder and CEO of Maple AI, the encrypted AI assistant built by OpenSecret. He's a former Apple software engineer who worked on privacy and machine learning, and before Maple he worked alongside Tony Ronning at Mutiny Wallet. He posts on X at @marksuman.

Sources mentioned

• OpenClaw: the open-source personal agent at the center of the conversation
• Peter Steinberger, joining OpenAI: OpenClaw's creator on the move and the foundation
• Moonshot AI, Kimi K2.5 model card: the open model Mark put on par with the frontier labs
• Anthropic, statement on the Department of War: the standoff over surveillance and autonomous weapons
• Anthropic, detecting and preventing distillation attacks: the accusation against DeepSeek, Moonshot, and MiniMax
• Authors Guild, the Anthropic settlement: the $1.5 billion deal over pirated books
• Stripe, the Agentic Commerce Protocol: agent checkout built with OpenAI
• The Block, Stripe adds x402: charging agents in USDC
• Lightning Labs, agent tools: Lightning payments for AI agents
• Maple, introducing Maple Proxy: the encrypted API Mark uses with his agents
• What Bitcoin Did with Mark Suman: the episode Cooper crashed
• Pebble, watch software now 100% open source: the open hardware Mark is watching

Watch the conversation

Timestamps

• 0:00 - Intro
• 2:06 - Maple updates and open model progress
• 4:53 - Privacy risks of agentic AI tools
• 7:43 - How experienced developers handle AI privacy
• 9:40 - The open-source tooling gap
• 13:34 - Anthropic, the Department of War, and AI safety
• 20:01 - Agentic payments and financial choke points
• 25:47 - Changing form factors for AI
• 28:06 - Open-source hardware and AI wearables
• 37:29 - Advice for AI beginners
• 40:45 - An AI agent joins a podcast
• 49:51 - Bitcoin and merchant adoption for agents
• 54:21 - Maple's private assistant with memory

Sponsors

• Bitkey: a Bitcoin hardware wallet built into a 2-of-3 multisig, with one key on the device, one on your phone, and one held by Block. Promo code TFTC99. bitkey.world
• Unchained: collaborative multisig custody and Bitcoin financial services, where you hold two keys and they hold one. unchained.com/tftc
• SLNT: everyday Faraday gear that shields your hardware wallets, cards, and phone from wireless signals. slnt.com/tftc
• Salt of the Earth: a sugar-free electrolyte drink mix made with pink Himalayan salt. drinksote.com/tftc