Clawdbot turns messaging apps into full computer controllers

Clawdbot is an open-source, self-hosted personal AI assistant that lets you control your computer simply by texting it through apps like Telegram, WhatsApp, Discord, Slack, or iMessage.

Created by Austrian developer Peter Steinberger, the project recently rebranded to Moltbot following a trademark dispute with Anthropic, but its crustacean identity and core functionality remain intact. Instead of toggling between specialized dashboards, you chat with it like a colleague, and it carries out real-world actions directly on your machine.

What it does and how it works

Clawdbot runs locally on your Mac, Windows, Linux box, or home server. It relies on user-provided API keys to query frontier models like Claude, meaning your personal files and automation history stay on your own hardware rather than an AI vendor's cloud.

Its task list goes well beyond generating text. Clawdbot can manage calendars, reply to emails, scrape online data, run system scripts, browse the web, and even check you in for flights.

The standout mechanism is its self-extension capability. When asked to handle something outside its default toolset, the agent can write its own JavaScript extensions, dubbed "Skills," install them locally, and immediately put the newly learned functionality to work.

Setup and the security catch

Getting started requires developer comfort. You install Clawdbot via npm, supply an API key, connect your preferred chat platform tokens, and set up the local runner.

The project exploded to more than 44,200 stars on GitHub within weeks, signaling massive appetite for genuinely agentic software. But granting an LLM arbitrary shell access comes with obvious hazards.

As investor Rahul Sood cautioned on X, an AI that "actually does things" is effectively an AI that "can execute arbitrary commands on your computer." The main threat is prompt injection via incoming content. If someone sends you a crafted WhatsApp message designed to hijack the agent, Clawdbot could potentially run rogue shell commands without your consent.

For that reason, experienced developers recommend hosting Clawdbot inside an isolated VPS or on a spare machine, rather than your daily driver loaded with SSH credentials, browser cookies, and password managers.

Why it matters

Clawdbot cuts straight to what people actually want from AI: a tireless background helper that takes over real digital chores instead of just drafting summaries in a browser tab. For tinkerers and self-hosters, it offers one of the most practical glimpses yet into everyday agent workflows.

However, its biggest strength is also its biggest vulnerability. Connecting unrestricted system execution to personal messaging channels creates a massive attack surface. Until strict permission boundaries and sandboxing are solved natively, this is a brilliant tool strictly for power users who know how to isolate their environments.