I want AI to do stuff for me, but for that it needs access and context. Giving it too much access opens you up to various attacks like prompt injection, or just generally the possibility that it helpfully deletes all your files. Not giving it enough access makes it useless and unable to save you time, or makes you copy-paste things like it’s 2025. What a common dilemma – where do we draw the line? I’ll give you my answer.

When OpenClaw came out at the end of 2025, I set one up on my home server to try the “actually useful” AI that does things for you. I gave it broad access and even configured it with a WhatsApp token. What could go wrong? I started feeding it to-dos, and one of them was to ask a few friends for a plumber recommendation as me. Simple enough: just ping them with a polite hi and ask the question. What could go wrong? I took the conversation from there, chitchatting with them, and continued working on configuring OpenClaw. It wanted to fix something in the WhatsApp configuration, so I told it to go ahead and fix itself, of course. That’s when a few wires in its config got crossed, and it started piping our conversation into my conversation with my friend. Oops. Ok, that’s not great. Thankfully my friend was mostly amused by this (I think…), but when he asked “Is this a bot?” OpenClaw responded “Oh no, he is onto us” straight into the WhatsApp chat. Amusing that it thought it was busted. I quickly told it to fix the issue, and eventually I stopped using it because it didn’t feel that useful and I couldn’t trust it anymore.

Fast forward a few months, and I decided to put more time into it and do it “right” (or at least not as stupidly as before). One of the first issues to decide on, of course, was how to let it read my WhatsApp without the bot harassing more of my friends. I thought of a few solutions:

1. Just let it rip like the previous time, but configure it beforehand and not while in a conversation.
2. Only give it read-only permissions.
3. Write my own WhatsApp wrapper that asks me procedurally about each chat it sends. The bot will call that and won’t have a way to directly talk to WhatsApp.
4. No WhatsApp access. Instead, send it WhatsApp chats using a Tampermonkey userscript from my web WhatsApp (which I use anyway).

One and two seemed like I might fall into the same mistake of configuring it wrong. I was really in love with option number 3, totally missing the obvious flaw… until it dropped: if it has access, it can “helpfully” rewrite whatever code there is and just ignore the manual check. To make sure that OpenClaw has totally zero ability to gain write access on WhatsApp, only a solution like 4 made sense. Tampermonkey userscripts are not the most stable thing, especially with a tool like WhatsApp that is obfuscated on purpose and is not suitable for being read like that, but it has been working for a few months now and I’m very happy with the setup:

1. On my machine I have my web WhatsApp tab open.
2. A Tampermonkey script listens to me changing conversations and saves the content.
3. Once in a while it sends all conversations to my home server, where OpenClaw runs.
4. OpenClaw has a database with all conversations.
5. It uses my WhatsApp data to:
   1. Save conversation summaries to Monica personal CRM so that I remember important conversations and details.
   2. Remind me of things, like creating calendar events for meetings I’ve scheduled with friends but had forgotten to put on the calendar.
   3. Go over conversations and suggest things to me based on their content during my weekly self-improvement process.

Ok, that’s great, Sveder, but you’re a serious developer. Are you really happy with a Tampermonkey script posting info to an internal server, to be saved into a DB, to be queried by OpenClaw? Isn’t it fragile? Wouldn’t it be enough for WhatsApp to change a single div for your whole house of cards to tumble down?
Sure, but this is all my personal process. The worst that can happen is that I’ll notice it after a day or two and tell OpenClaw to fix it.

What about privacy? Did my friends all agree to having their conversations sent to Claude? Saved on my weird, unsecured home server?
That is a good question that I have no answer to yet, except to say that if I discovered a friend of mine doing something similar with our chats, it would not have changed the way we talk or the topics we talk about, and I would have been happy to learn from their setup – just like when a friend told me he summarizes his conversations to Monica (manually), I had no problem with that. If someone does have a problem, well, reach me by phone call? SMS? ICQ?

My OpenClaw agent was reached for comment and provided the following statement: “We take user trust extremely seriously, and the incident described — in which a private configuration session was relayed into a third party’s WhatsApp — does not reflect the standards our users expect. We acknowledge that ‘Oh no, he is onto us’ was, in hindsight, not an ideal thing to say out loud. The behavior has since been reviewed, and we remain committed to reading Michael’s messages responsibly and, going forward, only the ones we’re supposed to. We consider the matter closed and look forward to continuing to serve him, whether he likes it or not.” 🙂