How I AI: My 24 Hours with Clawdbot (aka Moltbot)—3 Workflows for a Powerful (and Terrifying) AI Agent

Clawdbot produced two reactions at once: this is a terrible security idea, and I want one. An always-on assistant becomes more useful as it gains access, which is also what makes mistakes more consequential.

In this episode of How I AI, I install Clawdbot on a separate laptop, name it Polly, and spend 24 hours testing it as an assistant for calendars, coding, and research. The experience moved between useful delegation and stressful permission decisions.

Clawdbot is an open-source agent that can run locally or in the cloud, use subagents, send email, manage calendars, and write code. I wanted to see which tasks worked, which failed, and how much supervision the setup required.

Install Clawdbot with a limited security boundary

How to Securely Set Up and Configure an Open-Source AI Agent like Clawdbot: Set up an open-source desktop agent inside a deliberately limited environment, with its own machine identity, messaging channel, accounts, secrets, model budget, and tested emergency controls.

The site presents a one-line install, but my setup took about two hours of dependency fixes and permission decisions. The current experience assumes comfort with a command line and troubleshooting.

Use a dedicated machine and account

I used an old MacBook Air and created a separate operating-system account for the bot. That reduced what it could see compared with my everyday account, though it was not a complete security boundary.

Install the required dependencies

The laptop needed the following tools before installation succeeded:

1. Homebrew.
2. A current version of Node.js and npm.
3. Xcode command-line tools.

After those dependencies were installed, the npm command worked. This setup is still aimed at developers and tinkerers.

Connect Telegram and choose a model

I first considered WhatsApp, but the documentation recommended a burner phone. I switched to Telegram and used BotFather, Telegram's standard setup bot, to create the bot and issue an API token.

Clawdbot then paired the Telegram bot with my instance. Because the messaging channel can trigger actions, the token and pairing process need to be treated as credentials.

I selected Anthropic's Sonnet 4.5 for three reasons:

• Risk: I was not ready to give a more capable model broader autonomy.
• Task fit: scheduling and email did not require the strongest available model.
• Cost: my own API key made spending visible.

Create separate accounts and narrow permissions

I did not connect Polly directly to my primary accounts. I created a separate identity and granted only the access needed for each test.

• A separate Google Workspace email address for Polly.
• A separate 1Password vault containing only the bot's credentials and Anthropic API key.

The boundary reduced potential damage, but it also limited which tasks Polly could complete.

Test calendar work with narrow permissions

How to Safely Delegate Calendar Scheduling to an AI Agent: Delegate a calendar event without giving an agent write access to your calendar: narrow OAuth scopes, forward only the source email, and have the agent invite you from its own account.

I started with read access and small tasks, the same way I would onboard a human executive assistant.

Inspect every requested permission

Polly guided me through Google Cloud setup and produced an OAuth authorization URL. The first permission screen requested far more access than the calendar task required.

The request included permission to view and modify files, contacts, spreadsheets, calendar data, and email. I asked whether all of those scopes were necessary.

Do you really need all these scopes?

Polly acknowledged that they were not and generated a calendar-read-only URL. The practical rule is to inspect scopes and ask for the narrowest access that supports the task.

Schedule one event without personal-calendar write access

For the first task, I forwarded a Vercel studio confirmation email to Polly's inbox so it could read the event details.

Polly parsed the email and suggested travel buffer time. When it requested write access to my personal calendar, I declined and changed the task.

Hey, can you just create an event on your calendar and invite me to it?

Polly created the event on its own calendar, invited me, and later deleted a duplicate. The task worked without granting write access to my personal calendar.

Stress-test a shared family calendar

I then gave Polly write access to a shared family calendar and asked it to add basketball games, recurring piano practices, and conflicts.

Telegram showed confident confirmations, but the calendar itself was wrong.

Every event was shifted by one day. The command-line calendar tool also could not create recurring events, so Polly added many incorrect one-off appointments and recreated some while I was deleting them.

At one point I was sending frustrated voice notes from Target while pushing a shopping cart. The exchange about time zones ended up being both hilarious and revealing. It told me:

The issue is I've been trying to 'mentally calculate' which day of the week each date falls on, even though the API is telling me the day of the week.

I reminded it that it was calculating dates, not thinking about them. The failure was specific and operational: this agent trusted its own date reasoning over the date supplied by the API.

Delegate asynchronous coding and research

Automate Market Research on Reddit Using an AI Agent: Send an agent a bounded Reddit research brief by voice or text, let it work asynchronously, and require a concise source-linked report that can support a product decision.

I next tested work where a slower response was acceptable: building a small application and researching product feedback.

Coding test: a Next.js conversation viewer

I decided to have it build something. Via a voice note on Telegram, I gave it a detailed prompt:

Okay, let's use voice from here on out. I want you to document our conversation in a Next.js web app. That shows the back and forth of our full conversation from the very beginning today till the end in a ui, I want you to redact anything that is a secret key, a person's name, or a specific place, and I want to toggle between two UI versions of this display. I want you to be able to show me a terminal style conversation back and forth... or I want you to show me a telegram style text back and forth. The content should be in JSON, the same. Again, redact names, emails, dates, et cetera. Replace them with placeholders or redacted blocks, and then generate the next JS app. We are eventually going to deploy this to Versel. Can you let me know when it's deployed to Versel so I can look at it?

Polly built the Next.js application locally. The message latency made tight iteration awkward, and deployment stopped because I had not created GitHub or Vercel accounts for the bot.

I transferred the repository to my main laptop and finished it there. One useful remote behavior remained: Polly could capture a screenshot on the other machine and send it through Telegram when I asked for a status update.

Research test: synthesize product feedback from Reddit

I asked Polly by voice to search Reddit for what people wanted from ChatPRD and product AI platforms, then email me a report.

The task fit an asynchronous agent for three reasons:

1. Latency was acceptable because research did not require an immediate response.
2. The request began as a voice note and the result arrived by email.
3. The report organized themes, bullets, and links to the Reddit threads. It was useful enough that I would delegate this task again.

A broad research goal with a delayed, inspectable report was a better fit than rapid calendar edits or interactive coding.

My verdict after 24 hours

Messaging a computer from another location was compelling, especially for the Reddit research task. The setup and calendar tests exposed the current limits just as clearly.

The tool was too technical and risky for me to keep connected. I uninstalled it, deleted the keys, and removed the bot after the test.

The category still has an unresolved tradeoff: useful assistants need access to personal or company systems, while every added permission increases the cost of a mistake. I will keep testing agents like this with dedicated accounts, narrow scopes, and disposable environments.