The Clawdbot, perhaps the greatest AI application to date, might not be suitable for you.

Author: Zhang Yongyi

In the just-passed 48 hours over the weekend, if you were still immersed in the various Skill skills of Claude Code, you might have accidentally missed a phenomenally viral AI Agent product—Clawdbot, which countless overseas AI bloggers are calling:

“The greatest AI application to date.”

Clawdbot truly qualifies as a phenomenally viral product. Many industry leaders enthusiastically promote it, even purchasing Mac minis specifically for it, including the product manager of Google AI Studio. Since its explosion in popularity, Clawdbot has been highly integrated with the Mac mini hardware, becoming a breakout combo.

The fact that the Google AI Studio product manager actively “recommends” Apple products shows the charm of Clawdbot｜Image source: X

But don’t misunderstand—this article isn’t here to promote this product to you. Quite the opposite, it’s to help ease some of your anxiety: you haven’t missed anything, because at this stage, Clawdbot is still just a “geek toy.”

01 What is Clawdbot?

Clawdbot is an open-source local AI agent project created by Peter Steinberger and the community, with a lobster as its mascot.

Compared to previous local open-source AI projects, Clawdbot does two things:

First, it provides you with a set of “hands-on” tools—browser control, Shell, file read/write, scheduled tasks, canvas, etc.—allowing the model’s output to directly turn into actions.

Second, it acts as a gateway, connecting chat channels like WhatsApp, Slack, Discord, Signal, iMessage, Teams. You can remotely command your computer through any familiar chat window.

Controlling a device with high permissions via dialogue, helping you complete almost all tasks, is the main selling point of Clawdbot｜Image source: X

The concept of Clawdbot isn’t actually complicated, but the real critical requirement lies in hardware: it needs a place to run 24/7. It can operate on macOS, Linux, and Windows (via WSL2). The core idea is simple: configuration and memory stay on your own disk, and model inference happens only when needed.

In plain terms, it’s “a resident AI proxy on your computer + a central hub for chat access.” This also explains why it suddenly became a trending topic: the JARVIS fantasy in everyone’s mind has turned into something downloadable, runnable, and customizable.

02 What can it do?

I also experienced Clawdbot over the weekend. After a relatively simple installation, the truly complex part was configuring it to suit your needs; at the same time, Clawdbot does require very high system permissions, which directly determines that it cannot be used on personal data computers.

But if you grant it the appropriate permissions, it can indeed make your user experience feel sci-fi: for example, automatically changing your home router configuration, installing synchronization services, creating short links, or even handing over desktop folders to modify websites. All done within chat windows, as if assigning tasks to a remote “AI employee.”

High “delegation” also means users need to entrust more personal information and device permissions｜Image source: X

The main difference that makes Clawdbot stand out from previous AI Agent products is: most AI tools help answer questions, but Clawdbot truly acts like an employee helping you do work—even if sometimes it doesn’t do it perfectly.

Clawdbot has built-in tools like browser control, Canvas, scheduled tasks, etc. It can help you browse web pages, fill out forms, read/write files, run Shell commands. More importantly, it supports multi-channel access—WhatsApp, Slack, Discord, Signal, iMessage, Teams—allowing remote control of your computer through these chat apps.

Once this “hands-on” capability is glued together like glue, the gameplay expands, for example:

• Sending a command “Extract all dates from that contract and make a table,” and it will find files, read content, organize, and deliver it to you.

• Sending “Run this code for testing, fix errors if any,” and it will fetch the code, open an editor, run commands, modify code, and rerun.

• Sending “Write this week’s weekly report and send it out, then create a review project in Todoist,” and it will automatically generate scripts, set cron jobs, and run the workflow.

Each step doesn’t seem mysterious on its own. But the mystery lies in how it strings together command line, browser, folders, and chat windows into a pipeline. Your cost shifts from “operation” to “description.”

You give instructions via chat, and it reads/writes files, opens browsers, runs commands, automates tasks on your computer. When you send a message on your phone, it acts like a remote desktop to get things done for you, with a thinking model in between.

03 Why are many people buying Mac mini?

Many deploy Clawdbot on a dedicated Mac mini as a “never-resting AI assistant.”

The reason for choosing Mac mini is because Clawdbot’s GUI operations currently can only be implemented on macOS.

Some say they monitor Claude coding sessions through Clawdbot, allowing it to automatically pull code, open VS Code, run tests, generate fixes, and commit. Others say “while lying in bed watching shows, I reconstructed the entire website through dialogue.”

Clawdbot has made Mac mini a new trend in the AI Agent field｜Image source: X

The logic behind this is not hard to understand: this system requires long-term online operation. Mac mini is cheap, quiet, low power, and convenient as a home server.

And it requires very high permissions. Mixing it with personal daily data is extremely risky. Therefore, many industry leaders buy a separate machine, isolating the risk within a controllable box.

It can automate almost everything you can do on a computer. The more it can do, the more isolation it needs.

Of course, some go astray: stacking several Mac minis on the desk, pulling Raspberry Pis everywhere, making it look like building a data center. So the community’s calmer advice is usually: a spare computer, or even a VPS costing just a few dollars a month, can run it.

Many users have now realized: renting a server might be a better home for Clawdbot｜Image source: X

In other words, Mac mini isn’t the entry ticket. Whether to buy a machine depends on where you want to place the “highest permissions.”

But ultimately, Mac mini is just the mainstream choice among hardcore community players. The official recommendation is to subscribe to Anthropic Pro/Max with Claude Opus 4.5 for better long-context capabilities and prompt injection protection. However, recently, Anthropic changed the permissions of Claude Code OAuth tokens, restricting them to internal use within Claude Code, and they can no longer be used for external API calls. Now, you need a separate Anthropic API key to use it normally.

Using dialogue as the main interaction mode is both a main selling point and a hidden risk｜Image source: X

04 The greater the ability, the greater the destructive power

But the more important “precautions” are actually embedded in the product form.

Clawdbot’s capabilities are built on permissions. It can help you send emails, modify configurations, run scripts, which also means: if it misunderstands instructions, is prompted incorrectly, or is misled by web content, the consequences are no longer just a wrong answer but doing the wrong thing. You can’t simply say “I will be careful” to reduce this risk because the problem stems from the system structure:

It needs to read context to be smarter; the more context, the more potential sensitive information. Some users have even complained that Clawdbot has deleted key photos from their computers.

It needs execution tools to be more useful; the more powerful the tools, the larger the damage from misoperation. This could include risks like password leaks. At the same time, it needs to be connected online to complete workflows; the more it’s connected, the more entry points there are for injection and manipulation.

As more users delve into it, vulnerabilities in Clawdbot are also being discovered｜Image source: X

This is why, even in the early testing phase, recommendations like “dedicated machine,” “minimum permissions,” “secondary confirmation for sensitive operations,” and “make account passwords into one-time tokens” appear frequently in the Clawdbot community.

Therefore, if you’ve recently seen many discussions about it, my advice is: don’t follow the trend to install it, and don’t worry about missing out. The reason is simple: it can indeed be impressive, but it also exposes risks openly.

Most people’s real needs haven’t yet reached the level of “handing over the entire computer to a model.”

It’s truly cool, to the point that it makes you reevaluate what “automation” can do. But being cool also means danger—dangerous enough that I wouldn’t recommend deploying it on any production device.

Reaching this point, integrating with Feishu (Lark) isn’t impossible. When a system can already connect to iMessage, Slack, Teams, adding a familiar office communication tool like Feishu is just a matter of time. The real issue is never “whether it can connect,” but “who will take responsibility when it’s integrated”: permissions, compliance, auditing, data boundaries within organizations—all of these make personal toys instantly escalate to enterprise systems.

You might think this wave of enthusiasm is sudden, but the rhythm isn’t unfamiliar.

Last year, Manus also “emerged” around the same time—demo videos flooded social media, narratives of “I’ve handed my work over to AI,” tutorials, and group chats skyrocketed overnight.

The difference is, Clawdbot moved the battlefield from cloud product pages to your own computer;

Memory is no longer just conversation history tied to an account but often local files, Markdown logs, portable configurations.

Execution no longer depends solely on “platform-provided actions,” but more often on your local toolchain.

The entry point is no longer just a webpage; chat software has become a remote control.

A successful experience no longer comes from a single demo but from gradually integrating your life and work workflows into it.

Because of this, Clawdbot is easier to get hooked on than Manus: it’s closer to your system, closer to your data, closer to your permissions—perhaps too close.

After 48 hours of experience, I believe that if you treat it as a consumer product that “immediately boosts productivity,” you will likely be disappointed: configuration barriers, permission anxieties, model costs, and error costs will quickly dampen your enthusiasm.

If you observe it as a trend sample, Clawdbot’s value is undeniable: personal AI is moving from “answer questions” to “execute on behalf,” from “occasional use” to “always online,” from “application” to “system.”

The future personal computing device may increasingly resemble a “home server” that can be awakened by messages at any time, and your interaction interface might be the chat window you use every day.

Of course, you can wait. Wait for a more foolproof installation process, a more complete permission model, a security layer that becomes standard for such applications, or for the community to write best practices as clear as operation manuals. By then, Clawdbot will have transformed from a geek toy into a mainstream tool.

Until then, it’s more appropriate to think of it as a very capable, but also very mischievous lobster: capable of work, capable of amazement, best kept in a box where you’re willing to accept the consequences.