In general, the Academic Cloud offers a chatbot ((https://chat-ai.academiccloud.de)) that utilises various language models. These include both internally operated models and those from external providers. The internal models should be used in preference to the others, as this ensures that no data from the University of Oldenburg is transferred abroad. Furthermore, external models may incur a charge.

Below is a selection of available models (over 30 in total):

The external models can be used for ‘non-sensitive’ data, i.e. risk class ‘Low’ (see https://uol.de/f/5/inst/icbm/ICBM-IT/IT security/cloud-3.png?v=1785148657 ). This includes, for example:

• Your own data that has already been published.
• Material from the ICBM, UOL or other websites.

The user wishes to apply an AI agent to data stored on their own computer. In doing so, the agent accesses an external AI service (specifically, Anthropic Claude). This gives rise to two implications and risks:

• The user’s own data is processed on servers that are not subject to the GDPR (e.g. in the USA).
• Depending on the tool (OpenClaw, Hermes, etc.), the agent may have high (administrator) privileges on the user’s own computer. The agent may, under certain circumstances, be able to read, modify or delete all data on the computer without restriction.

The following setup mitigates both risks:

• Setting up a virtual environment on your own computer, e.g. VirtualBox.
• Set up a VM within this environment (Windows, Linux, etc.)
• This VM exchanges data with the host (i.e. your own computer) via a single shared folder; see, for example, https://docs.oracle.com/en/virtualization/virtualbox/6.0/user/sharedfolders.html.
• Install the agent on the VM. The agent has administrator rights on the VM, but this is not a concern.
• Only data classified as ‘low’ risk is stored in the exchange folder, which the agent can process.

The security of this setup relies on the integrity of the application used to create the virtual machine. VirtualBox is a well-established and well-maintained product. Alternatives include, for example, VMware or Proxmox, but these require considerably more effort to operate.