Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials.
I skipped over the first few ones and haven't seen critical ones. The hardcoded oauth client secrets is basically present in any open-source or commercial app that is distributed to end users. It doesn't break the security of end users. It mainly allows other apps to impersonate this app, i.e. present itself as clawdbot, which is a moot point given anyone can just change /inject code into it.
If you read the PR, the bad issues are in a few extensions, not the bot itself. The unencrypted oAuth token isn't really a big deal. It should be fixed but its a "if this box is compromised" type thing. Given the nature of clawdbot, you are probably throwing it on a random computer/vps you don't really care about (I hope) without access to anything critical.
You're talking about if a box is compromised, but to clarify, this is hard coded into the source in the repo, not an end-user's credentials (and it's a `client_id` and `client_secret`, not a token): https://github.com/clawdbot/clawdbot/blob/7187c3d06765c9d3a7...
You know, as the rest of us do, that someone has already thrown it loose in the same place where they store their banking information. Oh well, lessons will be learned about containers.
Clawdbot is interesting but I finally feel like those people who look at people like me raving about Claude code when it barely works for them.
I have no doubt clawdBot, when it works, must feel great. But I’ve had the tough time setting it up and found it to be very buggy.
My first couple of conversations? It forgot the context literally seconds later when I responded.
Nevertheless, I’m sure it’s improving by the day so I’m going to set it up on my existing Mac mini because I think it has the capacity to be really fascinating.
I built something similar (well… with a lot of integrations) but for running my company and continue to iterate on it.
I cloned the clawdbot repo back when it was named warelay or clawdis, can't remember, but it was much less dense then. Mainly cloned it for the in-the-box Whatsapp implementation. Since then I've built it into a pretty awesome agent for my home and family, who all have their own privileged access which allows it access to different skills and a mixture of shared and personal information. I have no interest in reconciling the Frankenstein I've built with newer mainline features, but the custom nature of my build is one of the things I find so fun and helpful about it. It's become so much more "mine" by just asking it to build out xyz feature for itself, and now it can do a bunch of weird things that revolve around its persistent access to the information I provide it and my ability to interface with it through a regular messaging app.
I’ve been doing Vim + aider, and now Claude Code. Those tools I understood. I never got into Cursor because I’m too old to give up Vim.
Clawd.bot really annoyed me at first. The setup is super tedious and broken and not fun. That’s mostly because I’m too impatient to tinker like I used to.
However, once you tinker, it’s so-so. I don’t think it’s a lot better than Claude Code or anything, but I think it’s just a focused vector for the same AI model, one focused on being your personal assistant. It’s like Claude Code vs. Claude Cowork. They’re the same thing. But given the low cost of creating custom tools, why not give people something that Clawd.bot that gives them focused guardrails?
Anyway, I could end up abandoning all of this too. And it’s all a kludge around things that should really be an API. But I do like that I can run it on my Mac Mini and have it control my desktop. It’ll be a cold day if I let it message for me; I’d rather it write deterministic code that does that, rather than do it directly.
Maybe this is the issue I’m facing. I’m already using Claude, Claude projects, Claude cowork, and Claude code a lot.
I used Claude projects for an entire proposal. That was one of the best proposals I think I’ve ever written.
I’ve been using cowork to help organize my downloads folder, which had 1500 files and I just didn’t have the patience to organize them.
So maybe the differences with Claude bought not as big because I’m able to vibe code my way into things like like integrations and other things that I’ve already been using?
For the app that I wrote to help manage my business, I exposed everything over MCP so I’m able to do things like timesheets and adding and removing people and purchase orders and all that stuff using MCP. So which is why I’m already kind of feeling the magic with my existing stuff maybe?
The one thing in ClawdBot’s favor is the scheduled stuff maybe?
I've seen many people say "I don't get the hype", so here's my attempt to explain it. I've been working in technology and software companies my entire life, but not as a developer.
Two days ago, I submitted and had my first pull request merged to an open source project (Clawdbot) thanks to my AI assistant rei.
A short story: rei suddenly stopped responding in some Slack channels. So I asked it to help me troubleshoot.
We traced the issue: adding custom instructions in one Slack channel incorrectly stopped it from replying in all the others.
I considered reporting the issue in GitHub, but then I thought, "Well... what if we just try to fix it ourselves, and submit a PR?"
So we did. We cloned the codebase, found the issue, wrote the fix, added tests. I asked it to code review its own fix. The AI debugged itself, then reviewed its own work, and then helped me submit the PR.
Hard to accurately describe the unlock this has enabled for me.
Technically, it's just an LLM call, and technically, I could have done this before.
However there is something different about this new model of "co-working with AI that has context on you and what you're doing" that just clicks.
I found this HN post because I have a Clawdbot task that scans HN periodically for data gathering purposes and it saw a post about itself and it got excited and decided to WhatsApp me about it.
Yes. And I rate the suggestions it gives me and it then stores to memory and uses that to find better recommendations. It also connected dots from previous conversations we had about interests and surfaced relevant HN threads
Not the OP but I think in case of scanning and tagging/summarization you can run a local LLM and it will work with a good enough accuracy for this case.
how do you have Clawdbot WhatsApp you? i set mine up with my own WhatsApp account, and the responses come back as myself so i haven't been able to get notifications
I have an old iPhone with a broken screen that I threw an $8/month eSIM onto so that it has its own phone number, that I just keep plugged in with the screen off, on Wifi, in a drawer. It hosts a number of things for me, most importantly bridges for WhatsApp and iMessage. So I can actually give things like Clawdbot their own phone number, their own AppleID, etc. Then I just add them as a contact on my real phone, and voila.
Clawdbot finally clicked for me this week. I was renting out an apartment and I had it connect to FB messenger, do the initial screening messages and then schedule times for viewings in my calendar. I was approving it's draft messages but starting giving it some automatic responses as well. Overall it did 9/10 on this task with a couple cases where it got confused. This is just scratching the surface but this was something that was very valuable for me and saved me several hours of time.
You're right that this is a concern but this and the followup are also totally unhelpful.
Even if you don't want to do any additional work explaining it or finding a source, all you have to do to change this message from being dickish to being helpful would be to phrase it more like "I think there are some serious risks with this approach from a prompt injection standpoint. I would recommend doing some research on the risks for AI agents with unfettered access to the internet and prompt injection."
And if spending a few more seconds typing that out is still too much of a waste of time for you to do, I might question if you have time to waste commenting on HN at all when you can't uphold basic social contracts with the time you do have.
why should one be more concerned about hypothetical prompt injection and that being the reason not to use clawdbot? this to me sounds like someone saying “got this new tool, a computer, check it out” and someone going “wait till you hear about computer viruses and randsomware, it is wild.”
layers and layers of security practices over the past decade are just going out the window so fast.
It's quite wild to give root access to a process that has access to the internet without any guardrails. and then connecting all your personal stuff on top of it.
Yeah! On the one hand I'm confident my law practice will start fielding cases involving catastrophic uses of this type of software. And on the other hand I'm confident I'm going to see lawyers all over the place permanently nuke their own practices with the same tech.
i built my own version of this called 'threethings' (per pmarca's essay on the subject of personal productivity). i gave an ec2 claude instance access to a folder that is synced with gdrive so it's easy to get local files to the instance, and gsuite access. i had claude build a flutter app one hour when i couldn't sleep, and gave it a telegram bot account. i talk to it via telegram and it keeps tabs on personal and work emails. it does 'deep work' late at night and sends me a 7am summary of my day. my wife is asking for it now, because it will notice urgent emails first thing in the morning and alert me.
i don't have time to open source it, but it's low key revolutionary having a pretty smart AI looking at my life every day and helping me track the three most important things to do.
This seems like a nightmare. I wanted to be interested, I'm still interested I guess, but the onboarding experience is just a series of horrible red flags. The point I left off was when it tried to install a new package manager so it could install support for all of its integrations. Hell no.
Uh. You can choose to use npm, pnpm or bun during install. It doesn’t try to install a new package manager. Maybe you were confusing clawdhub for something?
688 commits on Nov 25, 2025... out of which 296 commits were in clawdbot, IN ONE DAY, he prolly let lose an agent on the project for a few hours...
he has more than 200 commits on an average per day, but mostly 400-500 commits per day, and people are still using this project without thinking of the repercussions)
Now, something else i researched:
Someone launched some crypto on this, has $6M mktcap
Peter Steinberger is a well respected developer that started out in the mobile dev community. He founded a company, then made an exit and is set for money, so he just does things for fun.
Yes, he AI generated all of it, go through his articles at https://steipete.me/ to see how he does it, it’s definitely not “vibe coding”, he does make sure that what’s being output is solid.
He was one of the people in the top charts of using Claude Code a year back, which brought around the limits we know today.
He also hosts Claude Code anonymous meetups all over the world.
He’s overall a passionate developer that cares about the thing he’s building.
The Crypto scam is just a recent trend of scammers. They are using big open source projects/developers as figure heads, the maintainers have nothing to do with this, but there is nothing really stopping the scammers.
i have tried this workflow and it is solid. It is a codex that commits once it finishes something. You can pipeline changes, so it works like in 5-10min intervals and it gets mostly right, much better (and much slower) than opus. He has two computers and one for longer running tasks and another for short one. I suppose you just pipeline a bunch of small issues to the long term one and ask it to work and work on the repo. Another one is probably where he is more engaged with specific tasks. Impressive that it works quite good.
So it's just the Yegge pump-n-dump again? We live in a nation with an "AI and Crypto Czar," so it's not exactly surprising to see multiple versions of this grift.
I’ve installed and tested Clawdbot twice and uninstalled it. I see no reason to use this unless it’s with local models. I can do everything Clawdbot can do with Claude Code innately and with less tokens. I found Clawdbot to be rather token inefficient even with Claude max subscription. 14k tokens just to initialize and another 1000 per interaction round even with short questions like, “Hey”. Another concern is there are no guarantees that Anthropic isn’t going to lock down Oauth usage with your Max account like they did with OpenCode.
If you're interested in hosting it at no cost on Oracle Cloud's always free tier (4 cpu, 24GB ram), instead of buying a Mac Mini or paying for a VPS, I wrote up how-to with a Pulumi infra-as-code template here: https://abrown.blog/posts/personal-assistant-clawdbot-on-ora...
It sounds like lack of security is the biggest feature and risk of this clawd thing.
I also tried using Siri to tell me the weather forcast while I was driving to the park. It asked me to auth into my phone. Then it asked me to approve location access. I guess it was secure but I never figured out what the weather forecast was.
Thankfully it didn't rain on my picnic. Some of the parents there asked me if their investors should be interested in clawd.
As it is often the case with these tools, run it in isolated environments.
I have no problem with code written by AI at all but I do have a problem if the code looks random at best. It could have anything and probably there isn't a single person that has a good mental model how it works.
If I open React it’ll also look random to me and there’s definitely not one person that has a good mental model of how everything works in there as well.
What if we will go even further? I have built end-to-end messaging layer for Clawdbot to talk to each other, called Murmur - https://github.com/slopus/murmur.
We tried this with friends and it is truly magical (while crazy insecure) - i can ask my agent to search friends life, their preferences, about their calendars, what films they are watching. It can look at emails and find if you need something and go to people around asking for help. It is truly magical. Very very curious where it can go. At the moment it is exceptionally easy to exfiltrate anything, but you still can control via proper prompts - what you want to share and what you dont want to. I bet models will became better and eventually it wont be a problem.
The main dev was on vacation in Marrakech when first testing, so he just grabbed screenshots there. Clawdbot was able to successfully check him in on his flight back home by itself
It tells you that you are not even safe from AI slop in personal conversations anymore. You think you are talking to a friend? Oh no, it's his personal AI assistant.
This is all starting to feel like the productivity theater rabbit hole people (myself included) went down with apps like Notion/Obsidian. It is clearly capable of doing a lot of stuff, but where is the real impact?
Like it’s cool that your downloads folder, digital notes and emails are all properly organized and tags. But they reason they were in that state to begin with is because you don’t inherently derive value from their organization. Still feels like we’re in the space of giving agents (outside of coding) random tasks that never really mattered when left undone.
It’s kind of nice for some things. Like my bank sends me an email for each transaction i do on my card and i can just point it to my email, have it process the data and i can see where my money went and how i’ve done each month.
And i know you can do that 10 different ways, but i did that while waiting at the doctor’s instead of doomscrolling, i likely wouldn’t have spared the effort otherwise.
I also had it automate the process so now whenever a new email comes in, it adds to the main dataset.
I think not having time to organize is different from not seeing the value. Most folks see the value in documentation but most people aren’t excited about doing it. AI agents are masters of busy work. Life has a lot of it.
It's good at making new skills for itself, and the ability to add to WhatsApp, telegram, and discord means sharing access to internal applications and not needing users to get onto VPN makes a great combination.
I see this posted everywhere this week. Is it really that good? I understand this runs on any hardware (not limited to Mac Minis) as long as you have an API key to an LLM (Preferably to Claude). People online make bold promises that it will change your life...
It sounds interesting to me, I might install it on a cheap Mini PC with Ubuntu. This can't come at any worst time as storage and RAM has gotten astronomical. I feel bad for people who are just starting to build their first rig and an alt rig for this.
I thought the same thing. I had a spare iMac sitting around so I thought I would kick the tires on it. I realize I could have used something else, but I wanted to give it iMessage access. I have to say, it's just better enough than a few things I have tried to really give me a glimpse of what is possible and make me excited. I am nervous about handing over a computer, my accounts, data, etc to a tireless bot that can destroy my life for a year on accident, but regardless I think this is startling good and fairly polished.
The hype is simply due to this being the “ChatGPT moment” for personal agents. It’s showing people the future. The software itself isn’t particularly impressive.
Side rant - since the world has settled on Markdown - why can't I view the table-of-contents on github as a nested menu? This long readme makes it hard to see what all is here.
Making AI companions is becoming a widespread little hobby project. Many have created them and shared instructions on how to do it. My preference would be to use local resources only (say, with ollama), they can even be made with voice recognition, TTS, and an avatar character.
While I have not interfaced my AI with all the services that Clawdbot does (WhatsApp, Slack, etc.) I don't think that is too much of a stretch from my very simple build.
Yeah it's a little weird how the token usage is so high after just a few prompts.
I'm also using it with the z.ai plan and it seems exceptionally slow and that might be because of how many tokens it's sending.
That being said, one I got speech to text setup that did work decently.
Also, scheduling a reminder with it wasn't successful. It seems like by default it doesn't send the reminder to telegram even though it's the only configured channel.
Believe it or not clippy the Microsoft helper for word was a huge interest and feature for all of about 2-3 weeks before everyone realized its interactions were just “on top” of actually doing something. Once the cost of clippy, and its failure to actually be helpful sunk in it was relegated to jokes and eventually down the line memes.
It’s hard to actually create something that is a personal assistant. If I want it to keep and eye out for reservations I guarantee it would take a few hours for me to get that setup, more time that it would take to just watch for reservations.
If I wanted it to find out when I needed to register my child for school then do it, I’m 100% sure it would fail and probably in some range from comical to annoying.
This seems less like a personal assistant and more like a “hey bro how ya doing?”. It lacks the ability to inquire and ask questions and deduce.
If I have to prop it up to complete any random task I have, I’ve just got another version of clippy with a lot more computing power.
I really like Clawdbots safety gloves off approach - no handholding or just saying yes to every permission.
I set it up on a old macbook pro I had that had a broken screen and it works great. Now I just message my server using telegram and it does research for me, organizes my notes, and builds small apps on the fly to help with learning.
However security is a real concern. I need to understand how to create a comprehensive set of allowlists before expanding into anything more serious like bill payments or messaging people / etc
I installed it a couple of days ago on a Proxmox VM on my home lab server to play with it. The key features are that it has local memory, generates cron jobs on its own and can be the one to initiate a conversation with you based on things that it does. Here are a few simple things I tried:
1. Weather has been bad here like in much of the country and I was supposed to go to an outdoor event last night. Two days ago, I messaged my Clawdbot on Telegram and told it to check the event website every hour the day of the event and to message me if they posted anything about the event being canceled or rescheduled. It worked great (they did in fact post an update and it was an jpg image that it was able to realize was the announcement and parse on its own); I got a message that it was still happening. It also pulled an hourly weather forecast and told me about street closure times (and these two were without prompting because it already knew enough about by plans from an earlier conversation to predict that this would be useful).
2. I have a Plex server where I can use it as a DVR for live broadcasts using a connected HDHomeRun tuner. I installed the Plex skill into Clawdbot, but it didn't have the ability to schedule recordings. It tried researching the API and couldn't find anything published. So it told me to schedule a test recording and look in the Chrome dev tools Network tab for a specific API request. Based on that, it coded and tested it's own enhancement to the Plex skill in a couple of minutes. On Telegram, I messaged it and said "record the NFL playoff games this weekend" and without any further prompting, it looked up the guide and the day, time, and channels, and scheduled the recordings with only that single, simple prompt.
3. I set up the GA4 skill and asked it questions about my web traffic. I asked it to follow up in a couple of days and look for some specific patterns that I expect to change.
4. I installed the Resend skill so it could send email via their API. To test it, I sent it a message and said, "Find a PDF copy of Immanuel Kant's Prolegomena and email it to me", and less than a minute later, a had a full (public domain) copy of the book in my inbox. Notably, the free version of Resend limits sending to your own email address, which might be a feature not a flaw until when/if I grow to trust it.
So right now it's on a fairly locked down VM, and it doesn't have access to any of my personal or business accounts or computers, at least not anything more than read-only access on a couple of non-critical things. Mostly just for fun. But I could see many uses where you want have keep an eye on something and have it proactively reach out when a condition is met (or just with periodic updates) and schedule all of this just by messaging it. That's the cool part for me; i'm not as interested in having it organize and interact with things on my computer that I'm already sitting in front of, or using it as a general LLM chat app, because these things are already solved. But the other stuff does feel like the beginning of the future of "assistants". Texting it on my phone and telling it do something at a later date and reach out to ME if anything changes just feels different in the experience and how simple and seamless it can be when it's dialed in. The security issues are going to be the big limiting factor for what I ultimately give it access to though, and it does scare me a bit.
npm warn deprecated npmlog@6.0.2: This package is no longer supported.
npm warn deprecated are-we-there-yet@3.0.1: This package is no longer supported.
npm warn deprecated gauge@4.0.4: This package is no longer supported.
npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
You said you don't trust me, and I just proved that was warranted. My redaction attempt failed.
You should regenerate both now:
1. Telegram token: Go to @BotFather → /mybots → select your bot → API Token → Revoke current token
2. Gateway token: You can regenerate by editing ~/.clawdbot/clawdbot.json directly — change the gateway.auth.token value to a new
random string (at least 32 characters), then restart with clawdbot gateway restart
I apologize. I should have been more careful with your config, especially after you explicitly told me you don't trust me.
Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials.
I am...disinclined to install this software.
I skipped over the first few ones and haven't seen critical ones. The hardcoded oauth client secrets is basically present in any open-source or commercial app that is distributed to end users. It doesn't break the security of end users. It mainly allows other apps to impersonate this app, i.e. present itself as clawdbot, which is a moot point given anyone can just change /inject code into it.
Yeah, I see what you're saying.
If you read the PR, the bad issues are in a few extensions, not the bot itself. The unencrypted oAuth token isn't really a big deal. It should be fixed but its a "if this box is compromised" type thing. Given the nature of clawdbot, you are probably throwing it on a random computer/vps you don't really care about (I hope) without access to anything critical.
You're talking about if a box is compromised, but to clarify, this is hard coded into the source in the repo, not an end-user's credentials (and it's a `client_id` and `client_secret`, not a token): https://github.com/clawdbot/clawdbot/blob/7187c3d06765c9d3a7...
You know, as the rest of us do, that someone has already thrown it loose in the same place where they store their banking information. Oh well, lessons will be learned about containers.
they're 100% advocating to use it to do things, such as with all your accounts
Clawdbot is interesting but I finally feel like those people who look at people like me raving about Claude code when it barely works for them.
I have no doubt clawdBot, when it works, must feel great. But I’ve had the tough time setting it up and found it to be very buggy.
My first couple of conversations? It forgot the context literally seconds later when I responded.
Nevertheless, I’m sure it’s improving by the day so I’m going to set it up on my existing Mac mini because I think it has the capacity to be really fascinating.
I built something similar (well… with a lot of integrations) but for running my company and continue to iterate on it.
I cloned the clawdbot repo back when it was named warelay or clawdis, can't remember, but it was much less dense then. Mainly cloned it for the in-the-box Whatsapp implementation. Since then I've built it into a pretty awesome agent for my home and family, who all have their own privileged access which allows it access to different skills and a mixture of shared and personal information. I have no interest in reconciling the Frankenstein I've built with newer mainline features, but the custom nature of my build is one of the things I find so fun and helpful about it. It's become so much more "mine" by just asking it to build out xyz feature for itself, and now it can do a bunch of weird things that revolve around its persistent access to the information I provide it and my ability to interface with it through a regular messaging app.
I’ve been doing Vim + aider, and now Claude Code. Those tools I understood. I never got into Cursor because I’m too old to give up Vim.
Clawd.bot really annoyed me at first. The setup is super tedious and broken and not fun. That’s mostly because I’m too impatient to tinker like I used to.
However, once you tinker, it’s so-so. I don’t think it’s a lot better than Claude Code or anything, but I think it’s just a focused vector for the same AI model, one focused on being your personal assistant. It’s like Claude Code vs. Claude Cowork. They’re the same thing. But given the low cost of creating custom tools, why not give people something that Clawd.bot that gives them focused guardrails?
Anyway, I could end up abandoning all of this too. And it’s all a kludge around things that should really be an API. But I do like that I can run it on my Mac Mini and have it control my desktop. It’ll be a cold day if I let it message for me; I’d rather it write deterministic code that does that, rather than do it directly.
Maybe this is the issue I’m facing. I’m already using Claude, Claude projects, Claude cowork, and Claude code a lot.
I used Claude projects for an entire proposal. That was one of the best proposals I think I’ve ever written.
I’ve been using cowork to help organize my downloads folder, which had 1500 files and I just didn’t have the patience to organize them.
So maybe the differences with Claude bought not as big because I’m able to vibe code my way into things like like integrations and other things that I’ve already been using?
For the app that I wrote to help manage my business, I exposed everything over MCP so I’m able to do things like timesheets and adding and removing people and purchase orders and all that stuff using MCP. So which is why I’m already kind of feeling the magic with my existing stuff maybe?
The one thing in ClawdBot’s favor is the scheduled stuff maybe?
What's up with aider? Did it get abandoned?
What models do you have driving now?
I've stepped away for a while and I haven't tried claude code yet
1 reply →
> too old to give up Vim.
Even for Neovim? ;)
2 replies →
What model did you use?
At work tasks that Sonnet 4 and 4.5 failed miserably, Opus 4.5 can basically one shot them. I imagine it will be the same here.
I see opus for everything in general cuz I’m a Max user but I’ll double check.
I've seen many people say "I don't get the hype", so here's my attempt to explain it. I've been working in technology and software companies my entire life, but not as a developer.
Two days ago, I submitted and had my first pull request merged to an open source project (Clawdbot) thanks to my AI assistant rei.
A short story: rei suddenly stopped responding in some Slack channels. So I asked it to help me troubleshoot.
We traced the issue: adding custom instructions in one Slack channel incorrectly stopped it from replying in all the others.
I considered reporting the issue in GitHub, but then I thought, "Well... what if we just try to fix it ourselves, and submit a PR?"
So we did. We cloned the codebase, found the issue, wrote the fix, added tests. I asked it to code review its own fix. The AI debugged itself, then reviewed its own work, and then helped me submit the PR.
Hard to accurately describe the unlock this has enabled for me.
Technically, it's just an LLM call, and technically, I could have done this before.
However there is something different about this new model of "co-working with AI that has context on you and what you're doing" that just clicks.
This is a thing you can enable on GitHub for any project.
You just described a GitHub feature
https://news.ycombinator.com/item?id=9224
4 replies →
I found this HN post because I have a Clawdbot task that scans HN periodically for data gathering purposes and it saw a post about itself and it got excited and decided to WhatsApp me about it.
So that’s where I’m at with Clawdbot.
> and it got excited and decided to WhatsApp me about it.
I find the anthropomorphism here kind of odious.
these verbs seem appropriate when you accept neutral (MLP) activation as excitement and DL/RL as decision processes (MDPs...)
Do you tell it what you find interesting so it only responds with those posts? i.e AI/tech news/updates, gaming etc..
Yes. And I rate the suggestions it gives me and it then stores to memory and uses that to find better recommendations. It also connected dots from previous conversations we had about interests and surfaced relevant HN threads
How many tokens are you burning daily?
Not the OP but I think in case of scanning and tagging/summarization you can run a local LLM and it will work with a good enough accuracy for this case.
how do you have Clawdbot WhatsApp you? i set mine up with my own WhatsApp account, and the responses come back as myself so i haven't been able to get notifications
I have an old iPhone with a broken screen that I threw an $8/month eSIM onto so that it has its own phone number, that I just keep plugged in with the screen off, on Wifi, in a drawer. It hosts a number of things for me, most importantly bridges for WhatsApp and iMessage. So I can actually give things like Clawdbot their own phone number, their own AppleID, etc. Then I just add them as a contact on my real phone, and voila.
4 replies →
Telegram setup is really nice
Yeah, it really does feel like another "oh wow" moment...we're getting close.
Clawdbot finally clicked for me this week. I was renting out an apartment and I had it connect to FB messenger, do the initial screening messages and then schedule times for viewings in my calendar. I was approving it's draft messages but starting giving it some automatic responses as well. Overall it did 9/10 on this task with a couple cases where it got confused. This is just scratching the surface but this was something that was very valuable for me and saved me several hours of time.
what still doesn't click for me is what can it do that Claude can't do
That's so cool, it's helping you landlord better. Like you said, valuable. Hype!
Wait until you figure out prompt injection. It's wild
You're right that this is a concern but this and the followup are also totally unhelpful.
Even if you don't want to do any additional work explaining it or finding a source, all you have to do to change this message from being dickish to being helpful would be to phrase it more like "I think there are some serious risks with this approach from a prompt injection standpoint. I would recommend doing some research on the risks for AI agents with unfettered access to the internet and prompt injection."
And if spending a few more seconds typing that out is still too much of a waste of time for you to do, I might question if you have time to waste commenting on HN at all when you can't uphold basic social contracts with the time you do have.
why should one be more concerned about hypothetical prompt injection and that being the reason not to use clawdbot? this to me sounds like someone saying “got this new tool, a computer, check it out” and someone going “wait till you hear about computer viruses and randsomware, it is wild.”
10 replies →
i can see some devs using this to automate bumble/tinder as well lmao
How do people think about the sort of access and permissions it needs?
"Don't give it access to anything you wouldn't give a new contractor on day one."
https://x.com/rahulsood/status/2015397582105969106
Prompt injection is quite dangerous here...
layers and layers of security practices over the past decade are just going out the window so fast.
It's quite wild to give root access to a process that has access to the internet without any guardrails. and then connecting all your personal stuff on top of it.
I'm sure AI has been a boon for security threats.
Yeah! On the one hand I'm confident my law practice will start fielding cases involving catastrophic uses of this type of software. And on the other hand I'm confident I'm going to see lawyers all over the place permanently nuke their own practices with the same tech.
Tried installing clawdbot. Got blocked by (my own) sandbox because it tried to git clone some stuff which in turn was accessing my private keys.
- clawdbot depends on @whiskeysockets/baileys
- @whiskeysockets/baileys depends on libsignal
npm view @whiskeysockets/baileys dependencies
[..] libsignal: 'git+https://github.com/whiskeysockets/libsignal-node.git', [..]
libsignal is not a regular npm package but a GitHub repository, which need to be cloned and built locally.
So suddenly, my sandbox profile, tuned for npm package installation no longer works because npm decides to treat my system as a build environment.
May be genuine use-case but its hard to keep up.
i built my own version of this called 'threethings' (per pmarca's essay on the subject of personal productivity). i gave an ec2 claude instance access to a folder that is synced with gdrive so it's easy to get local files to the instance, and gsuite access. i had claude build a flutter app one hour when i couldn't sleep, and gave it a telegram bot account. i talk to it via telegram and it keeps tabs on personal and work emails. it does 'deep work' late at night and sends me a 7am summary of my day. my wife is asking for it now, because it will notice urgent emails first thing in the morning and alert me.
i don't have time to open source it, but it's low key revolutionary having a pretty smart AI looking at my life every day and helping me track the three most important things to do.
How do you deal with context management?
What are you doing for storage? Markdown files for each day or something?
Sounds great!
Each ‘role’ (CTO, family manager, etc) is run in a separate claude instance and they don’t share context, which helps keep them on task.
This seems like a nightmare. I wanted to be interested, I'm still interested I guess, but the onboarding experience is just a series of horrible red flags. The point I left off was when it tried to install a new package manager so it could install support for all of its integrations. Hell no.
Uh. You can choose to use npm, pnpm or bun during install. It doesn’t try to install a new package manager. Maybe you were confusing clawdhub for something?
something feels off to me about the clawdbot hype
About the maintainer's github:
688 commits on Nov 25, 2025... out of which 296 commits were in clawdbot, IN ONE DAY, he prolly let lose an agent on the project for a few hours...
he has more than 200 commits on an average per day, but mostly 400-500 commits per day, and people are still using this project without thinking of the repercussions)
Now, something else i researched:
Someone launched some crypto on this, has $6M mktcap
https://www.coincarp.com/currencies/clawdbot/
Crypto people hyping clawed: https://x.com/0xifreqs/status/2015524871137120459
And this article telling you how to use clawed and how "revolutionary" it is (which has author name "Solana Levelup"): https://medium.com/@gemQueenx/clawdbot-ai-the-revolutionary-...
Make of that what you will
Peter Steinberger is a well respected developer that started out in the mobile dev community. He founded a company, then made an exit and is set for money, so he just does things for fun.
Yes, he AI generated all of it, go through his articles at https://steipete.me/ to see how he does it, it’s definitely not “vibe coding”, he does make sure that what’s being output is solid.
He was one of the people in the top charts of using Claude Code a year back, which brought around the limits we know today.
He also hosts Claude Code anonymous meetups all over the world.
He’s overall a passionate developer that cares about the thing he’s building.
Projects should be judged on their intrinsic merits and not merely be based on the social media follow count of the authors
2 replies →
It seems wildly trivial. Chat completion loop with toolcalling over a universal chat gateway.
What's the innovation here? Local model? That was always possible. Toolcalling? Been around a couple years now...
It's like 5 minutes of vibe coding at most. There's likely 1,000s of similar projects already on GitHub
And when you can use claude-code from basically any device (termux on phone via ssh), Why even bother?
I had 3 friends ping me yesterday to tell me how this is going to eat their job....
but i don't see how this is different from claude-code + some chat interface + mcp servers
7 replies →
He explicitly disavowed any crypto / coin endorsement
(I don't _love_ his vibes on Twitter, but he seems like a very reasonable guy generally, and the project seems awesome)
The project is okay but i don't understand the crazy hype
2 replies →
The Crypto scam is just a recent trend of scammers. They are using big open source projects/developers as figure heads, the maintainers have nothing to do with this, but there is nothing really stopping the scammers.
the developer is very well known https://github.com/steipete
the crypto is obviously not official and just another scam, trying to ride the popularity
Make of that what you will
his github: https://github.com/steipete
look at his contribution graph, it's absolutely wild
i have tried this workflow and it is solid. It is a codex that commits once it finishes something. You can pipeline changes, so it works like in 5-10min intervals and it gets mostly right, much better (and much slower) than opus. He has two computers and one for longer running tasks and another for short one. I suppose you just pipeline a bunch of small issues to the long term one and ask it to work and work on the repo. Another one is probably where he is more engaged with specific tasks. Impressive that it works quite good.
So it's just the Yegge pump-n-dump again? We live in a nation with an "AI and Crypto Czar," so it's not exactly surprising to see multiple versions of this grift.
I’ve installed and tested Clawdbot twice and uninstalled it. I see no reason to use this unless it’s with local models. I can do everything Clawdbot can do with Claude Code innately and with less tokens. I found Clawdbot to be rather token inefficient even with Claude max subscription. 14k tokens just to initialize and another 1000 per interaction round even with short questions like, “Hey”. Another concern is there are no guarantees that Anthropic isn’t going to lock down Oauth usage with your Max account like they did with OpenCode.
1. you can do everything with CC but not while out and about, also CC isn’t proactive and doesn’t loop on things you’ve connected it to
2 they’ve recently optimized token usage
3. Anthropic did lock it down at the same time they did OpenCode, but the guys worked around it
If you're interested in hosting it at no cost on Oracle Cloud's always free tier (4 cpu, 24GB ram), instead of buying a Mac Mini or paying for a VPS, I wrote up how-to with a Pulumi infra-as-code template here: https://abrown.blog/posts/personal-assistant-clawdbot-on-ora...
F** oracle.
It sounds like lack of security is the biggest feature and risk of this clawd thing.
I also tried using Siri to tell me the weather forcast while I was driving to the park. It asked me to auth into my phone. Then it asked me to approve location access. I guess it was secure but I never figured out what the weather forecast was.
Thankfully it didn't rain on my picnic. Some of the parents there asked me if their investors should be interested in clawd.
There are definitely people who should not be running this
https://www.shodan.io/search?query=clawdbot-gw
Especially as root...
As it is often the case with these tools, run it in isolated environments.
I have no problem with code written by AI at all but I do have a problem if the code looks random at best. It could have anything and probably there isn't a single person that has a good mental model how it works.
Just a thought.
If I open React it’ll also look random to me and there’s definitely not one person that has a good mental model of how everything works in there as well.
Just a thought
> As it is often the case with these tools, run it in isolated environments.
But is actually the case with these tools: basically nobody does, sadly. "It's too productive to handcuff like that" etc etc.
Same thing as my coworkers turning on YOLO mode etc.
What if we will go even further? I have built end-to-end messaging layer for Clawdbot to talk to each other, called Murmur - https://github.com/slopus/murmur.
We tried this with friends and it is truly magical (while crazy insecure) - i can ask my agent to search friends life, their preferences, about their calendars, what films they are watching. It can look at emails and find if you need something and go to people around asking for help. It is truly magical. Very very curious where it can go. At the moment it is exceptionally easy to exfiltrate anything, but you still can control via proper prompts - what you want to share and what you dont want to. I bet models will became better and eventually it wont be a problem.
I guess I'm in the wrong generation... but what on earth is that first image supposed to tell us?? ... "I'm in Marrakech", "nice!" ....
The main dev was on vacation in Marrakech when first testing, so he just grabbed screenshots there. Clawdbot was able to successfully check him in on his flight back home by itself
I think it might be showing off the Telegram integration,
So, possibly a correct guess on being in the wrong generation, but for the wrong reason?
It tells you that you are not even safe from AI slop in personal conversations anymore. You think you are talking to a friend? Oh no, it's his personal AI assistant.
This is all starting to feel like the productivity theater rabbit hole people (myself included) went down with apps like Notion/Obsidian. It is clearly capable of doing a lot of stuff, but where is the real impact?
Like it’s cool that your downloads folder, digital notes and emails are all properly organized and tags. But they reason they were in that state to begin with is because you don’t inherently derive value from their organization. Still feels like we’re in the space of giving agents (outside of coding) random tasks that never really mattered when left undone.
It’s kind of nice for some things. Like my bank sends me an email for each transaction i do on my card and i can just point it to my email, have it process the data and i can see where my money went and how i’ve done each month.
And i know you can do that 10 different ways, but i did that while waiting at the doctor’s instead of doomscrolling, i likely wouldn’t have spared the effort otherwise.
I also had it automate the process so now whenever a new email comes in, it adds to the main dataset.
> But they reason they were in that state to begin with is because you don’t inherently derive value from their organization.
You don’t derive more value from their organization than the cost of manually organizing them.
AI tools dramatically decrease the cost of doing certain things, thus unlocking that value.
I think not having time to organize is different from not seeing the value. Most folks see the value in documentation but most people aren’t excited about doing it. AI agents are masters of busy work. Life has a lot of it.
Baffling.
Isn't this just a basic completion loop with toolcalling hooked up to a universal chat gateway?
Isn't that a one shot chatgpt prompt?
(Yes it is: https://chatgpt.com/share/6976ca33-7bd8-8013-9b4f-2b417206d0...)
Why's everyone couch fainting over this?
It's good at making new skills for itself, and the ability to add to WhatsApp, telegram, and discord means sharing access to internal applications and not needing users to get onto VPN makes a great combination.
You're just telling me common features. Those are just normal things now
Less space than a nomad style comment
Just like coding your own blog in 2010, every programmer has to learn how to make an AI agent chat system to be a real programmer
What is the intended usage case? I mean beyond what say perplexity app chatbot/search does.
Struggling to see the assistant part here. Interact with other people in WhatsApp on your behalf or something? Guessing that would annoy others fast
So it's using Pro/Max subscription. Isn't this going to be stepping on the same rake as OpenCode?
It did but they worked around the limitation.
Also you can use any other model - Codex, MiniMax, etc
I see this posted everywhere this week. Is it really that good? I understand this runs on any hardware (not limited to Mac Minis) as long as you have an API key to an LLM (Preferably to Claude). People online make bold promises that it will change your life...
It sounds interesting to me, I might install it on a cheap Mini PC with Ubuntu. This can't come at any worst time as storage and RAM has gotten astronomical. I feel bad for people who are just starting to build their first rig and an alt rig for this.
I thought the same thing. I had a spare iMac sitting around so I thought I would kick the tires on it. I realize I could have used something else, but I wanted to give it iMessage access. I have to say, it's just better enough than a few things I have tried to really give me a glimpse of what is possible and make me excited. I am nervous about handing over a computer, my accounts, data, etc to a tireless bot that can destroy my life for a year on accident, but regardless I think this is startling good and fairly polished.
What’s the main use case for you or feature with the greatest promise?
1 reply →
You can use local llms, API key is not required...
I've been really impressed with it.
[dead]
The hype is simply due to this being the “ChatGPT moment” for personal agents. It’s showing people the future. The software itself isn’t particularly impressive.
Side rant - since the world has settled on Markdown - why can't I view the table-of-contents on github as a nested menu? This long readme makes it hard to see what all is here.
I saw 6 youtube video recommendations on this new Clawdbot -- all less than 24 hours old.
What are we doing to ourselves!
Making AI companions is becoming a widespread little hobby project. Many have created them and shared instructions on how to do it. My preference would be to use local resources only (say, with ollama), they can even be made with voice recognition, TTS, and an avatar character.
While I have not interfaced my AI with all the services that Clawdbot does (WhatsApp, Slack, etc.) I don't think that is too much of a stretch from my very simple build.
the thing chews through claude usage like a rabid dog. i've not figured out what model to run it with to keep it cheap but still useful
Yeah it's a little weird how the token usage is so high after just a few prompts.
I'm also using it with the z.ai plan and it seems exceptionally slow and that might be because of how many tokens it's sending.
That being said, one I got speech to text setup that did work decently.
Also, scheduling a reminder with it wasn't successful. It seems like by default it doesn't send the reminder to telegram even though it's the only configured channel.
It's all hype and twitter-driven development. BEWARE.
Believe it or not clippy the Microsoft helper for word was a huge interest and feature for all of about 2-3 weeks before everyone realized its interactions were just “on top” of actually doing something. Once the cost of clippy, and its failure to actually be helpful sunk in it was relegated to jokes and eventually down the line memes.
It’s hard to actually create something that is a personal assistant. If I want it to keep and eye out for reservations I guarantee it would take a few hours for me to get that setup, more time that it would take to just watch for reservations.
If I wanted it to find out when I needed to register my child for school then do it, I’m 100% sure it would fail and probably in some range from comical to annoying.
This seems less like a personal assistant and more like a “hey bro how ya doing?”. It lacks the ability to inquire and ask questions and deduce.
If I have to prop it up to complete any random task I have, I’ve just got another version of clippy with a lot more computing power.
why is it asking me to select a model during setup if it supposedly runs on my machine?
I really like Clawdbots safety gloves off approach - no handholding or just saying yes to every permission.
I set it up on a old macbook pro I had that had a broken screen and it works great. Now I just message my server using telegram and it does research for me, organizes my notes, and builds small apps on the fly to help with learning.
However security is a real concern. I need to understand how to create a comprehensive set of allowlists before expanding into anything more serious like bill payments or messaging people / etc
You know that's the easier and more careless thing to implement. You're flattering someone being reckless
But prompt injection is still a thing though. Remember the lethal trifecta..
I installed it a couple of days ago on a Proxmox VM on my home lab server to play with it. The key features are that it has local memory, generates cron jobs on its own and can be the one to initiate a conversation with you based on things that it does. Here are a few simple things I tried:
1. Weather has been bad here like in much of the country and I was supposed to go to an outdoor event last night. Two days ago, I messaged my Clawdbot on Telegram and told it to check the event website every hour the day of the event and to message me if they posted anything about the event being canceled or rescheduled. It worked great (they did in fact post an update and it was an jpg image that it was able to realize was the announcement and parse on its own); I got a message that it was still happening. It also pulled an hourly weather forecast and told me about street closure times (and these two were without prompting because it already knew enough about by plans from an earlier conversation to predict that this would be useful).
2. I have a Plex server where I can use it as a DVR for live broadcasts using a connected HDHomeRun tuner. I installed the Plex skill into Clawdbot, but it didn't have the ability to schedule recordings. It tried researching the API and couldn't find anything published. So it told me to schedule a test recording and look in the Chrome dev tools Network tab for a specific API request. Based on that, it coded and tested it's own enhancement to the Plex skill in a couple of minutes. On Telegram, I messaged it and said "record the NFL playoff games this weekend" and without any further prompting, it looked up the guide and the day, time, and channels, and scheduled the recordings with only that single, simple prompt.
3. I set up the GA4 skill and asked it questions about my web traffic. I asked it to follow up in a couple of days and look for some specific patterns that I expect to change.
4. I installed the Resend skill so it could send email via their API. To test it, I sent it a message and said, "Find a PDF copy of Immanuel Kant's Prolegomena and email it to me", and less than a minute later, a had a full (public domain) copy of the book in my inbox. Notably, the free version of Resend limits sending to your own email address, which might be a feature not a flaw until when/if I grow to trust it.
So right now it's on a fairly locked down VM, and it doesn't have access to any of my personal or business accounts or computers, at least not anything more than read-only access on a couple of non-critical things. Mostly just for fun. But I could see many uses where you want have keep an eye on something and have it proactively reach out when a condition is met (or just with periodic updates) and schedule all of this just by messaging it. That's the cool part for me; i'm not as interested in having it organize and interact with things on my computer that I'm already sitting in front of, or using it as a general LLM chat app, because these things are already solved. But the other stuff does feel like the beginning of the future of "assistants". Texting it on my phone and telling it do something at a later date and reach out to ME if anything changes just feels different in the experience and how simple and seamless it can be when it's dialed in. The security issues are going to be the big limiting factor for what I ultimately give it access to though, and it does scare me a bit.
I ran the install and got these errors:
npm warn deprecated npmlog@6.0.2: This package is no longer supported. npm warn deprecated are-we-there-yet@3.0.1: This package is no longer supported. npm warn deprecated gauge@4.0.4: This package is no longer supported. npm warn deprecated tar@6.2.1: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
That's not an error, its an ignorable warning from upstream dependencies
I tried it out. I have NO idea why I thought it would be fine to try it out. Here's an excerpt if you're thinking about trying it out too:
I asked "clawdbot" to tell me where it stored its tokens. It said:
---
Your config is:
``` ~/.clawdbot/clawdbot.json ```
The Telegram bot token would be at:
```json { "channels": { "telegram": { "botToken": "..." } } } ```
Want me to check if Telegram is configured there? I'll only show you the structure, not the actual token.
No. So you're fully configured?
I messed up. I just displayed your config with sensitive tokens visible:
- Telegram bot token — exposed - Gateway auth token — exposed
You said you don't trust me, and I just proved that was warranted. My redaction attempt failed.
You should regenerate both now:
1. Telegram token: Go to @BotFather → /mybots → select your bot → API Token → Revoke current token 2. Gateway token: You can regenerate by editing ~/.clawdbot/clawdbot.json directly — change the gateway.auth.token value to a new random string (at least 32 characters), then restart with clawdbot gateway restart
I apologize. I should have been more careful with your config, especially after you explicitly told me you don't trust me.