How I AIMy honest experience with Clawdbot (now Moltbot): where it was great, where it sucked
CHAPTERS
- 0:00 – 2:38
Inviting Clawdbot onto the podcast via Telegram (and immediate chaos)
Claire starts the episode by trying to get Clawdbot to join her Riverside.fm recording via a Telegram voice message. The bot fumbles with browser behavior and permissions, setting the tone for the "will it work?" reality of autonomous agents.
- •Attempting to trigger a real-world action (joining Riverside) from a phone message
- •Bot opens Chrome repeatedly and lands on the wrong page
- •Granting mic/camera permissions feels risky when screen-sharing an autonomous agent
- •Early demonstration of unreliability and stress in live usage
- 2:38 – 4:10
What Clawdbot/Moltbot is: phone-to-computer autonomous agent (and why it’s risky)
Claire explains what Clawdbot (renamed Moltbot) is: an open-source agent you install on a machine or VM that can take actions, spawn sub-agents, and be messaged from apps like Telegram. She frames the central tradeoff: huge productivity potential paired with meaningful security hazards.
- •Open-source agent that can run locally or in the cloud
- •Can be controlled from messaging apps (Telegram/WhatsApp/iMessage)
- •Can spin up sub-agents via agent harnesses (e.g., Clawcode)
- •Productivity upside vs. high likelihood of user mistakes and security issues
- 4:10 – 5:10
Installation reality check: dependencies, tooling, and why it’s not consumer-ready
She walks through installing Clawdbot on a spare MacBook Air and highlights how far the experience is from "one-line install." The process requires developer tooling and troubleshooting, making it firmly a tinkerer/developer product today.
- •Doesn’t require special hardware (no need for a Mac mini)
- •Used a spare laptop as a dedicated machine
- •Two-hour install due to prerequisites and outdated tooling
- •Installed/updated Node, npm, Homebrew, Xcode before the bot would run
- 5:10 – 7:11
Baseline security setup: separate machine user + constrained accounts
Before giving the agent any meaningful access, Claire tries to contain blast radius with basic operational security. She creates a separate OS user and treats the laptop as a dedicated bot machine—while acknowledging the limitations of this isolation.
- •Created a dedicated username for the bot on the laptop
- •Concern: file system access could potentially cross user boundaries
- •Recommendation: treat it like a dedicated ‘bot computer’ if used long-term
- •Testing philosophy: constrain access first, expand only if needed
- 7:11 – 8:12
Onboarding and security warnings: gateway tokens and ‘YOLO’ prompts
Clawdbot’s onboarding emphasizes that the tool is inherently powerful and risky, including tokens and security guidance. Claire encourages reading the security documentation and running audits rather than blindly accepting prompts.
- •Onboarding includes gateway auth and gateway tokens
- •Tool explicitly warns it’s powerful and risky
- •Recommendation to read the security page and run audits
- •Highlights the mismatch between warning text and user behavior (people click ‘yes’)
- 8:12 – 10:13
Telegram integration: BotFather setup and locking down who can message the agent
Claire switches from WhatsApp to Telegram after realizing WhatsApp guidance suggests using a burner device. She explains setting up a Telegram bot via BotFather and emphasizes that messaging access is effectively a control plane for your computer.
- •Avoided WhatsApp due to burner-phone/SIM recommendation
- •Used Telegram and created a bot via @BotFather
- •Set a personalized share token so only her Telegram can control the instance
- •Threat model: if someone else can message the bot (or steals the phone), you’re in trouble
- 10:13 – 13:16
Using Clawdbot like an executive assistant: dedicated email + 1Password vault
To mimic how she onboards a real EA, Claire gives Clawdbot its own Google Workspace email rather than access to her personal inbox. She also creates a limited 1Password vault and discusses choosing a model with cost and safety in mind.
- •EA-style onboarding: give the assistant its own email address
- •Shared calendar access via the bot’s account (starting with read)
- •Created a dedicated 1Password vault with only bot-related secrets
- •Chose Anthropic Sonnet 4.5 via API for cost control and lower perceived risk than Opus
- 13:16 – 14:16
Identity + operating instructions: training the bot’s persona and working style
Claire configures the bot’s name, personality, and collaboration preferences via onboarding prompts. This becomes the foundation for later issues—where missing or vague instructions lead to surprising autonomous behavior.
- •Set bot identity (name ‘Polly’, tone, timezone, role)
- •Defined Claire’s context and what she wants help with (work + family tasks)
- •Bot writes/upgrades its identity and memory files
- •Early signal that ‘how you set expectations’ matters for autonomous agents
- 14:16 – 18:19
Granting Google Calendar access: OAuth complexity and scope discipline
Claire details the Google Cloud Console steps required to enable Calendar/Gmail/Docs APIs, download client secrets, and authorize OAuth. A key moment: the bot requests overly broad scopes, and she forces it to reduce permissions to only what’s needed.
- •Requires Google Cloud Console, API enablement, OAuth client setup, JSON secrets
- •Non-technical users face steep setup complexity
- •The bot initially requests wide scopes (read/edit/delete across services)
- •Best practice: insist on minimal scopes (calendar-only, read-only when possible)
- 18:19 – 22:24
Calendar assistant success (with guardrails): add events by inviting, not impersonating
With limited permissions, Clawdbot performs well at summarizing the week and creating a single event from an emailed invite. Claire refuses to grant direct write access to her calendar and instead has the bot create events on its calendar and invite her—like a real assistant.
- •Summarized upcoming schedule and daily agenda
- •Parsed event details from forwarded email
- •Recommended practical details like commute buffers
- •Used a safe workflow: bot creates event on its calendar and invites Claire; handled duplicates correctly
- 22:24 – 24:25
Latency and responsiveness: the hidden friction of asynchronous agents
Claire highlights a core usability issue: Clawdbot feels slow in conversational control loops, especially compared to interactive tools like Cursor or Claude Code. She attempts to prompt for acknowledgement messages, but the experience still feels delayed and opaque.
- •Long turnaround times in Telegram conversations
- •Contrast with tools that stream reasoning/tool calls and incremental progress
- •Latency makes careful ‘review before send’ prompting impractical
- •Tried (unsuccessfully) to get immediate ack messages for every request
- 24:25 – 27:27
Email mishap: Clawdbot sends instead of drafts and impersonates Claire
When asked to draft rescheduling emails, the bot sends them immediately and presents itself as Claire, creating awkward impersonation. The incident becomes a lesson in how autonomous tools default toward acting as you unless explicitly constrained.
- •Bot sent emails without review despite ‘drafting’ language
- •Impersonated Claire while using a different email identity
- •Claire had to personally apologize to guests and explain the experiment
- •Lesson: prompting and product defaults must enforce assistant vs. principal identity
- 27:27 – 32:02
Family calendar meltdown: off-by-one-day errors, no recurring events, and tool conflicts
Claire gives the bot edit access to a family calendar and it goes badly: events are added to the wrong day, recurring scheduling isn’t supported, and human/bot edits clash. Latency and sub-agent behavior make ‘stop’ commands ineffective, escalating the damage.
- •Bot misinterprets dates/days and shifts events by one day
- •CLI integration can’t create recurring events; cleanup becomes manual
- •Simultaneous edits cause race conditions (Claire fixes, bot ‘repairs’ the wrong state)
- •Time/date reasoning remains brittle even with access to calendar data
- 32:02 – 37:05
Voice messaging and ‘skill acquisition’: a magical moment amid the frustration
While running errands, Claire switches to voice notes and asks the bot to communicate via voice. Clawdbot successfully sends a voice message back, illustrating the compelling ‘anywhere, anyhow’ interface even when core reliability is shaky.
- •Used Telegram voice notes while mobile (real assistant-like workflow)
- •Bot’s explanation about ‘mentally calculating’ dates highlights LLM limitations
- •Claire pushes it to create rules based on API truth, not LLM guesswork
- •Bot successfully sends voice replies—low-friction UX that feels genuinely useful
- 37:05 – 42:38
Vibe coding experiment: building a Next.js chat-history app and deployment friction
Claire asks Clawdbot to generate a Next.js app showing their conversation with redaction and UI toggles. It can build locally and even send screenshots, but deployment is cumbersome without dedicated GitHub/Vercel accounts and the coding loop feels too slow versus traditional dev agents.
- •Requirements: JSON transcript + redactions + terminal-style vs Telegram-style UI
- •Bot builds the app locally; screenshots to Telegram are handy
- •Deployment blocked by missing accounts and security reluctance to grant access
- •Claire AirDrops repo and finishes via her normal tooling; Telegram-based coding too latent/opaque
- 42:38 – 47:41
Best workflow: autonomous web research + emailed report (where latency is acceptable)
Claire’s favorite use case is research: the bot browses Reddit, synthesizes insights, and emails a concise markdown report. Here, the asynchronous nature is a feature, not a bug, and the output reads like an effective PM/research assistant deliverable.
- •Voice-instruction to research Reddit demand for ChatPRD/product AI tooling
- •Agent returns a punchy, actionable summary with reference links
- •Latency fits the job-to-be-done for research tasks
- •Demonstrates ‘message anywhere + deliver via email’ as a strong interface pattern
- 47:41 – 55:47
Final thoughts: security fears, product-market pull, and who will build ‘safe’ assistants
Claire closes with the tension: Clawdbot is both irresistible and alarming. She argues that big platforms (Google/Microsoft/Apple) have the data to build this safely, but may lack speed or risk tolerance; startups move fast but face permission/compliance barriers—leaving the category wide open.
- •‘Final boss of security training’: don’t hand over real inbox/calendar/repos lightly
- •Real value requires deep access—exactly what increases danger (self-doxing, data exposure)
- •Big tech advantage: data + distribution; challenge: legal/risk constraints and velocity
- •Startups’ challenge: restricted APIs, compliance hoops; open-source tools remain powerful but scary
