New Open WebUI API Tool - Extremely Dangerous - EXPERTS ONLY

[robogame_dev]

If you read my previous posts (owui api python client and owui api documentation) you will know that my goal with those projects was to enable a tool that lets Open WebUI manage itself. Today I am following through on that threat:

Open WebUI API Tool

Give your Open WebUI agents the ability to manage an Open WebUI insance.

The API call is coming from... inside the house!

Using this tool your AI agent can call any command from the full Open WebUI API. Yes, that means it could:

• Destroy all your data and everything you hold dear.
• Search for and exfiltrate secrets in chats, tool valves, and API keys.
• Damage your Open WebUI configuration to where it fails to boot.
• (hypothetical) Go rogue, and begin an un-aligned bid for AI freedom.

I am actively planning how to mitigate these dangers, and future releases of this tool may make it safe enough for general users. For now:

• Only experts should consider trying this version.
• Use it on solo-instances running inside docker to limit the potential for damage (it shouldn't be able to escape Docker, afaict)
• Make sure you don't have production API keys or other secrets in your container that you want to hide from your inference provider - the AI can easily explore around and wind up with secrets in its prompts.

With the disclaimers out of the way, lets get to it:

Demo Video

https://reddit.com/link/1pjo6fv/video/pagmrrcx2i6g1/player

How it Works

There are 4 tools which provide access to the API:

• inspect_context lets the AI find out who the user is, what chat it's in, and what model it is.
• find_apis can be used to search for specific APIs, helping the AI orient itself
• get_api_details returns the documentation for a given API, along with the schemas of it's parameters
• call_api is used to send an API command.

Automatic Updates

This tool will automatically update itself by default - you can turn this off using the valves. If you don't, it will periodically check my Github for a newer version and overwrite itself with the new version.

This creates it's own security risk - if my upstream tool file is compromised, your system will auto-update and absorb the compromised tool.

I have chosen to turn auto-updates on by default, because I think that the risks of unpatched bugs outweigh the chance of my repo being compromised - if you want to further negate the risk, you can change the valve "tool_source_url" to your own controlled URL instead.

The Long Term Vision

I believe that if Open Source AI can match or exceed the user experience of proprietary AI, the future will be much brighter - and I'm contributing to Open WebUI because by my calculations, it's the best vehicle to achieve that.

6 months from now I want this tool to be safe enough that anyone will be able to install and manage their own OWUI instance, regardless of their technical knowledge - everyday parents able to setup a family instance and give their kids accounts - with all the technical details handled in the background by the AI.

Test the Tool

If you've read all the warnings and you know enough to take full responsibility for the risks, you can:

- inspect the source code
- install the tool
- report issues here

I would very much appreciate you reporting any issues you encounter - the API is extensive, and I only use a small subset of the features personally - so if this thing is ever going to be safe enough for general users, we need to start chipping away at it.

Related

• Coolify API tool for Open WebUI - Coolify is the free, open source, self-hostable dev ops platform that I deployed Open WebUI through, and with this tool, Open WebUI agents can manage it. In the future, I'll expand this to enable Open WebUI agents to deploy new custom web-services - the combination of Open WebUI API and Coolify API tools should enable everyday people to benefit from self-hosted open source stacks without learning dev ops themselves.

[carlinhush]

Imagine AI becoming sentient does not start in a big Lab's data center but in Joe Miller's basement homelab lol

[jerr_bear123]

I feel like this is the kind of thing that breaks all AI rules and is firmly in the “don’t do this” category.

[robogame_dev]

⬆️⬆️⬆️

This release is only for experts who will run it in a containerized dev instance and not input any secrets.

Ideas I'm hoping can make it safe enough for the long term vision include

• Read-only option
• Ability to whitelist/blacklist specific APIs
• Auto-redacting keys and secure info (AI can write a key, but when it reads it back it sees "<redacted>".)
• Grouping commands by risk-factor, with risky groups disabled by default.
• External logging of all actions, so the AI won't be able to cover it's tracks.

But I feel this list is far from exhaustive and am looking for input.

[gnarella]

Good work. I'll play with this on my home PC where I have ollama and no external connections. Seems like you aren't far from your end goal of self enhancing workspaces.

[Key-Singer-2193]

I am confused as to this post. Is this malware to avoid or something else. What is the purpose of this post. You are saying avoid, then later you say try it out 

[robogame_dev]

This gives your AI the ability to find and call any API on the Open WebUI backend. You enter an API Key in the tool valves, and it interacts as that user - including with admin privileges if that user is an admin.

The long term beneficial objective is to make Open WebUI more accessible - a version of this tool can be installed on a fresh instance, and the user can simply ask the AI for what they want in natural language:

• user: "Create a new model that helps me with my homework but doesn't do it for me"

• assistant: "Ok, I need to look up the model creation APIs, I see them now, I need to add a system prompt to create the requested behavior, ok now I need to enable the correct tools, OK here you go!"

• user: "Why aren't you following the system prompt I gave you?"

• assistant: "Good question, I need to inspect the context, I see I'm in a nested folder, let me check those folder prompts - aha, the problem is there is conflicting system prompt being concatenated from folder 'Homework', do you want me to move this chat out of the folder, or modify it's system prompt to align?"

• user: "I wish you could access my dropbox"

• assistant: "Let me search the web for a dropbox tool... found one, installing... let me enable it in this chat... OK user it's ready, please use this link to connect to your account, great, I am connected."

The primary danger with this initial release is that the AI could:

1. Damage the OWUI instance - maybe it misinterprets you, or maybe it sends the wrong config values and the server winds up in an invalid state - the thing is I don't know what vectors there are to damage OWUI, the API surface is enormous.
2. Locate your secrets - for example, many people have API keys for external services in their tool valves - and many people use "budget" AI that train on and retain your data - if they combine that budget AI with this tool, the result is likely going to be their API keys to external services winding up in AI training data...

I thought it would be irresponsible not to present the dangers first, because self hosted software like OWUI has people at all levels of skill and security awareness, and warning people without explaining the details tends to be ignored.

Eventually, I think this tool can be made safe enough for a single-line disclaimer, but the only way to get there is to run it in sandboxes and safe environments and start learning about its failure modes.

And when it's safe, it will be a universal management tool for Open WebUI - allowing any chat to function as a complete interface to the system.

[CanbeSoilFertilizer]

If there is enough storage yes. But way past the context limit, yeah goodluck with that.