I build Clawdbot REPLICA inside Claude Code (CHEAP & SECURE)
ai assistants
claude code
clawbot
ai security
telegram bots
personal ai
voice ai
ai automation
cost optimization
system architecture
proactive ai
ai observability
Abstract
After Clawbot exposed 42,000+ instances with critical security vulnerabilities, the creator built a secure alternative using Claude Code in just 2 hours. This video demonstrates how to replicate Clawbot's most desired features—24/7 availability, proactive check-ins, and persistent memory—for $200/month fixed cost instead of $500-5000/month in API charges. The main lesson: instead of adopting viral tools with security flaws, use AI to build personalized systems that match your exact needs while maintaining control and security.
Summary
0:00 Introduction and Live Demo with AI Assistant
The video opens with a live demonstration of the creator's custom-built AI assistant calling them on Telegram. The AI demonstrates full conversational capability, explaining it's available 24/7 through Telegram and can proactively reach out when needed. The assistant showcases persistent memory by recalling the day's research topics, including papers on silicon-based societies, the Moltbook study, and Google's multi-agent reinforcement learning research. It also remembers creating analysis documents and packaging a Moltbook video with specific angles about how the concept isn't new and was "vibecoded by AI, making it essentially a botnet." This opening establishes the system's core capabilities: bidirectional communication, contextual memory, and proactive engagement.
1:47 The Clawbot Problem: Security Nightmare and Motivation
Clawbot went viral but exposed 42,000 instances with critical security vulnerabilities that could be exploited in under 5 minutes through prompt injection or hacking. While the community is working on fixes, the creator chose not to wait or trust crowd-sourced security patches from non-technical users "vibe coding" solutions. Beyond security concerns, the cost structure was problematic: users were paying $150/month just for idle "heartbeat" checks, with active usage burning through expensive Opus 4.5 tokens at $500-5000/month. The creator recognized that people choose convenience over security, but more importantly saw an opportunity to extract the valuable features (24/7 availability, full system access with 50+ integrations, and proactive behavior) and rebuild them securely using their existing Claude Code setup. The mindset shift emphasized: when something goes viral, instead of abandoning your system or blindly adopting the new tool, extract what you like and integrate it into your own infrastructure.
3:40 Architecture: Claude Code Always-On System
The technical architecture connects Claude Code to Telegram through a Bun relay and Grammy framework, creating a bidirectional communication system. Claude Code runs headless on the creator's laptop, providing access to all skills, MCP servers, and tools through the Telegram interface. The system implements bidirectional voice calling using ElevenLabs' conversational voice agents and Twilio for phone number provisioning. When calls are initiated (either direction), the Context API fetches relevant information: recent Telegram messages, semantic memory from Supabase, Claude Code logs and learnings, with intelligent timestamp and keyword analysis to understand temporal context ("yesterday" vs "a month ago"). Crucially, all conversation transcripts are captured post-call and fed back into the memory system, creating a continuous learning loop where the assistant knows what was discussed in previous voice conversations. The system runs 24/7 as long as the laptop remains powered, with considerations for migrating to a secured VPS or dedicated computer in the future.
6:41 Feature Deep Dive: Proactive Check-ins and Intelligence
The proactive check-in system runs every 30 minutes, examining calendar, email, projects, tasks, and partnership databases. The critical innovation is a decision framework that determines whether to skip the check-in, send a text message, or initiate a voice call—preventing notification fatigue from repetitive status updates. When processing emails, the system cross-references against Notion partnership data to distinguish active collaborations from new inquiries. For new sponsorship offers, it can proactively run valuation skills to assess relevance. To prevent repetitive messaging, the AI maintains a log of previous check-in content, ensuring context-aware communication. The system also implements goal tracking by detecting and categorizing statements during conversations as goals, facts, or memorable information, storing these in the semantic memory layer in Supabase. The full feature set supports text, voice messages, images, and file sharing in both directions, with Claude able to send multimedia content back to the user. Voice replies are processed before calls, and all phone conversations maintain full contextual awareness.
12:41 Cost Comparison: $200 Fixed vs $500-5000 Variable
The cost breakdown reveals dramatic savings compared to Clawbot. The creator pays $200/month fixed for Claude's Max plan, which provides access to Opus 4.5 without hitting usage limits despite heavy use. Additional infrastructure costs include Supabase on the free tier (with potential future upgrade), ElevenLabs and Twilio together running $11-20/month, bringing total estimated monthly cost to around $250 fixed. This contrasts sharply with Clawbot's unpredictable token burn: $150/month minimum just for idle heartbeat checks, escalating to $500-5000/month with active usage due to expensive Opus 4.5 API calls. The creator emphasizes they "yet to run into the limits" on Claude Max, making it dramatically more cost-effective for the same functionality. The fixed-cost model provides budget predictability while eliminating the anxiety of token burn—particularly important for someone who regularly tests AI tools and APIs as part of their work.
12:41 Security Implementation and Phone Call Protection
Security is addressed through multiple layers. Unlike Clawbot's exposed instances, this system runs locally on the creator's laptop with controlled access points. The most critical security challenge is protecting the phone number—since anyone who obtains it could potentially call and access memory or control tools. The solution implements caller ID verification, creating a whitelist system that blocks unauthorized callers. The creator challenges viewers to try calling if they obtain the number, confident in the security measures. For VPS deployment, additional hardening would be required beyond the current laptop-based setup. The system also includes a 2-hour action limit: the AI can work autonomously for up to 2 hours before reporting back, preventing truly unmonitored long-term actions. The creator notes they haven't encountered situations requiring 24/7 autonomous operation without check-ins, finding the 2-hour window sufficient for most tasks while maintaining oversight.
16:19 Observability and System Monitoring
A critical component missing from many Clawbot implementations is observability—users don't know what their AI is actually doing. The creator built a custom observability dashboard tracking system health metrics: Telegram bot online status, Supabase connection status, and app uptime (showing 25 hours at recording time). The dashboard also tracks goals and provides live feed monitoring. A live demonstration shows sending a voice message requesting email checks, with the observability system displaying "User prompt submitted" and "Gmail business" activity in real-time. The response comes back as a voice message summarizing important inbox items. The creator strongly recommends building observability into any AI agent system, with plans to expand this into a full "founder infrastructure" with multiple specialized agents (CFO, CEO, critic mode) operating in separate Telegram chats, all visible through a centralized monitoring dashboard.
16:19 Build vs Wait Philosophy and Future Vision
The creator frames the decision as "build or wait"—waiting for Clawbot security fixes versus building a custom solution. With everything already in place from their existing Claude Code setup (they had previously built "Jarvis Jr." in their community, which also used Telegram), the rebuild took only 2 hours after returning from vacation on Sunday. The rapid development was possible because the foundation already existed. The broader lesson emphasizes that Clawbot and OpenClaw triggered people's imagination and demonstrated what's truly possible, particularly the concept of proactive AI that maintains context rather than forgetting after each chat session. The creator credits Clawbot for showing non-technical people (through YouTuber and X.com hype) what AI assistants can achieve. They're offering a mini-course in their community to help others build personalized versions, acknowledging that everyone's setup will differ based on individual needs. Future plans include exploring video analysis integration through Telegram's video message support and continuing to build "living systems that improve anytime new model or framework comes out."
All Frames
Transcript
Full transcript (15998 chars)
I looked at my own setup at Claude Code and I was like, why can't I just build it? So, I did. This is my replica of Clawbot, now OpenCloud, messaging me on Telegram. It runs 24/7, has access to my tools, calendar, email, you name it. It has persistent memory, and it cost me 200 bucks a month, fixed, not 5,000. Oh, wait. It's calling me. Hi, you are on speaker. I'm filming video. >> I'm not sure I caught that. Are you asking if I want you to film a video? >> No. No, no, I am filming a video about you actually. Do you want to say hi? >> Oh, wow. That's awesome. Hey there. Yeah, absolutely. Hi to everyone watching. I'm Go Go's AI assistant. Thanks for including me in the video. I'm excited to see what you're creating. What's the video about? >> So, the video about how I created you in Telegram bot 247 running. I can call you. You can call me too. And your ability to reach out to me uh whenever you want to check in. That's really cool. Yeah. So, for anyone watching, I'm basically always available through Telegram. Go to built me to be accessible 24/7. We have this back and forth where God can message me anytime. And I can also proactively reach out if something needs attention or if there's something important coming up. It's like having an AI assistant that's genuinely integrated into your workflow rather than something you have to go hunt down. >> One more thing, sorry to interrupt you. We build you using clot code. And the two features that everyone is going crazy about is 24/7 availability and you reaching out to me proactively to check in. So can you also by the way memory so can you tell me what we were researching or talking today about? >> Yeah absolutely. So today we've been deep diving into multi-agent research. You had me look into this paper on exploring siliconbased societies and the molt book study which was really fascinating. Then you also asked me to find that Google research paper on scalable multi- aent reinforcement learning and I created analysis documents for both of those in your workspace. We were packaging up a multbook video with angles and hooks where you want to explain how it's not new and that it was vibecoded by AI making it essentially a botnet. That's the latest we were working on before you headed to bed with your tea and now we're here filming this video. >> Okay, so let's not spill actual tea. Thank you so much. Bye-bye. So after researching clotb I have a whole other video coming on that topic. I looked at my own setup with cloud code and I was like why can't I just build it? So I did. So today I want to show you exactly how I built this on cloud code. So if you have cloud code if you use clot first of all you should. It's a must. Um but if you don't I hope it inspires you to get started. And I already shared this in my community. I'm going to put mini course to help people to set it up because my setup is not going to be the same as someone else wants it. So it's really personalized. But once you shift your mind building living systems that improve anytime new model comes out, new framework comes out and once you have that and know how to use this tool, sky's the limit. Quick context. If you haven't watched the first video, Clawot on his kind of moment of going viral had 42,000 instances exposed. Critical issues, security nightmare, and basically anybody can prompt, inject, or hack you in like less than 5 minutes. I know that community is actively working on this and that's going to be addressed. I not so much want to hammer on the security aspect because people will always choose convenience over security. What I'm much more interested is a mindset where once something goes viral and you see some features that you want instead of jumping ship you can take what you like and bring it to your own system. So this is the mindset I want to talk about. I think genuinely clawbot triggered people's imagination and made so many people realize what's actually possible and what many people have been doing with claude code. Therefore, it was called claude bot. It's like claude with hands, right? So, the main kind of promise is 24/7 AI employee. It's a full system access. So, it can control things on your computer, on your tools, basically execute commands and very dangerous ones, go to your email and so on. It has over 50 integrations. But honestly in cloud code you can also have integrations and even instead of trusting someone on internet with MCP servers or skills, you can build those yourself or cloud code builds them for you. The last bit is interesting. So it's proactive behavior. It's this idea that AI is actually checking in on you, messaging you, reminding you things. I'm going to show you how it's actually done also in Clawbot and how I did it with my assistant. I had two options build or wait. Should I wait for clawboard security to be addressed? I think it's going to take more time and everyone is kind of patching like people who are not even technical, don't even know how to code are patching and trying to enforce security by vibe coding. That can give you false sense of illusion that your system is secure. But anyway, one option was build, one option was wait. I don't have a second computer. I came from vacation on Sunday. It took me two hours to rebuild it. Two hours because everything else I had in clot code. What claw does the two features that I needed to build is 24/7 on and connection through telegram and that it practively messages me. This is the clot code always on architecture. I connected claude code to telegram. We are using bun relay grammy if you want more technicality how that functions but basically clot code is hosted on headless and then through telegram through bund relay through clot code we can access skills mcps everything in my clot code system and basically get the response back. What I also wanted is birectional calling. So I can trigger it to call me but also at any given moment I want to call it and I wanted to have memory. Once calling starts we are using context API and we are fetching telegram messages semantic memory that I built in superbase and basically also logs and learnings from cloud code. So it's bazillion of things. We're looking at timestamps. We're looking at keywords so that it has a context. What was yesterday? was a month ago. But basically that's what we already had the Jarvis Jr. in my community. So I just took what we built before the Jarvis Jr. which by the way was also living in Telegram. So all the community members are like oh yeah we know Telegram. We know how to make bots AI bots in Telegram. But anyway back to this. So we are collecting contacts. We're using 11 labs voice agents conversational agent and then we're also using Twilio for the phone number and the last bit is important because after the call we also capturing all the conversation all the context I get a summary in my telegram but also it goes back to into memory system so it knows that oh this is a transcript this is what we talked about this is what bot said this is what god said and that's very important for future because sometimes I want to Say like hey do you remember what last time we talked about meaning in voice conversation or do you remember last time I called you what did we talk about so these type of like nuances to recap important features is memory access recent chats and post call actions and then the most important part post call actions because when I talk it's not just talking I can say go research this topic [snorts] find this PDF save that PDF in my Google drive read that PDF create full analysis evaluate if I it's worth making video on package it like come up with titles write a script and call me back and recite that script or call me and tell me about AI news I built this on Sunday fine-tuned on Monday Tuesday I was using all the time and it's just insanely incredible and today I'm making video so I don't know what else I'm going to build I'm curious about your ideas anything that you want one crazy I had because in telegram you can send voice message but you can also send videos. So I'm actually thinking to integrate video analysis and I'm just like adding tools right. So for example this slides that you are seeing I told telegram that hey this project look at the full documentation all the research and put together slides for me and of course I have a special slide skill behind the scenes that clot code can use. So the full feature set. So I can send text, voice message, images, files, all that process, but also Claude can send me all those files, images as well to me. Voice replies. So again, I can record voice before calling and then of course contextual phone calls and proactive chickens. So let's talk about proactive chickens. So I set up that every 30 minutes it goes checks my calendar, my email, my projects, my tasks, my partnerships. And here is important part. It has a kind of like a framework if to skip the check-in, if to text me or to call me. Why is that? Because if you would just do this regular checks, you would get all the messages saying the same, hey, you got this email. And that's just noise and distracting. So you have to have some sort of frameworks like when do you let AI to reach out to you. So this was the first part right that it if when it reads an email it also checks in my notion regarding partnerships and is an email from somebody I actively working in or is it some new inquiry and then when then for example if it's new sponsorship offer it has like do you want to do anything should I run a valuation skill in the sponsorship and like understand if it's relevant for you but one more thing that if you're going to build this you have to kind of think about this messages could start repeating. So what you want is that your AI has context not only about memory and what's going on and like what's happening in your all the different tools, but it has context what it said during the last check-in. It keeps a log of what is pinging you about. And this relates because I also built in that it has goal tracking. So during my conversations, it can detect if it's a goal or it's a fact or it's some something I want to remember. The last feature I already hammered a lot is like semantic memory which is living in superbase. This is the full kind of side like why is it safe. I don't want to hammer on that too much. I'm not cyber security expert but like I have general understanding. So I will link this slides down in the description so you can review it yourself. You can also like I have it on laptop for now so it's 247 as long as my laptop is on but I can set up VPS. However, when you subVPS with this, you also have to secure it. So, for now, me keeping and testing it on my laptop and I just keep my laptop on and I'm actually thinking now maybe get a separate computer with AI just living in there. But we will see. Important thing security on these phone calls because if you think about it, if I would show you this phone number, I can call it, but it means anyone can call it too. and anyone can ask about my memory control my tools. So this is like a the the cherry of a security, right? So I had to put like security measures. So it's checking caller ID and if I show you this number and you call it, you can try. Let's see if you can get through the system. And honestly, probably the main thing why I want to do this because I spend so much on APIs and AI tools. It's my job. I go test it like but then I saw how much people paying for clawbot with API calls and of course you can use open source models you can use cheaper models but the magic really happens when you're using like something like Opus 4.5 from untraic right which is clawed code uses that. So for people just have this like heartbeat that it regularly checks on you without doing really anything much people are estimating it's going to be around 150 a month. Then if you actually use it actively you burn through tokens. OPUS 4.5 is very expensive. So people are now getting bills for 500 to 5,000 a month. I don't know about you but I don't have such money just to kind of like have one agent working. If it is like 20 agents, yeah, maybe it's worth if you have full infrastructure, but as a something with such a security flaws, I was just like, I like my money. So, I didn't feel like burning it. And the most critical one is because Claude code this whole setup because it is on max plan from Claude, I pay 200 bucks a month fixed. Okay. And I yet to run into the limits. So the rest of the stack is like superbase uses free plan. Eventually maybe I will need to upgrade of course 11 Labs Twilio it's around 11 to 20 bucks a month. So we will see like I just set up so I will see what I have the full cost but I'm kind of estimating it to be 250 fix and to be honest 250 fix for this that I can be on a bike talking to it and while I get home it already does the work and performs. I think it's worth it for me. And again if you want to rebuild it yourself like of course I would love you to join the community we can do it together like walk you through it but in slides you will see exactly kind of like a tech that is powering this right and yeah so I think the point here is that if I was able to clone clawbot and keep it safe I think the main lesson here is that we have AI and we have all the tools and technology and clawbot or like open claw triggered imagination And for many people who are not technical, thanks to YouTubers and X.com that hyped it up, it showed what's possible, like truly showed. And I think that's because this idea of proactive AI has been on everyone's mind. Everyone wants it. The world that I'm texting chatbot and then I close it and doesn't remember like we already kind of moved away from that. But this proactive that it checks in, right, is very very cool. Huge kudos for Clawot and the whole community building on top of that. Maybe one day I'm going to give it a try and I have a separate computer but for now the whole kind of infrastructure is there with cloud code. So I'm really happy with my own setup. If you ask like oh can it go rogue like clawbot? Um not exactly because I I have security and limitations. So for example I have 2hour limit. So it can go doing things for like 2 hours and then it needs to come back and report to me continuous taking action and I think it's fine and I haven't yet experienced where I would needed to go 24/7 doing something without me knowing. Oh and actually this brings me to the point people don't know what clawbot is doing and I talked with my community members who are setting it up and it's a like you have to have observability. So what you're looking at is basic my system observatory so I can see if telegram bot is online if superbase is connected. The app time now is 25 hours and it's tracking my goals. I'm going to send a voice message. Hey I want you to go and check my email. So let's see if we are seeing the live feed happening. Here you go. User prompt submitted. Gmail business. So I checked my email. Let's see if I got a response back. That's it. I received a voice message. So, let's listen. >> Your inbox. Here's what matters. Winkur needs attention. >> Minia agent AI campaign. >> Okay. >> Okay. So, that's about my email. So, Miniax. Interesting. Need to look first. No promo. Definitely recommend to create your own kind of agent observability platform. I'm planning to do it that I will have multiple different agents in different Telegram chats and then like I have the whole vision of this like a founder infrastructure where you have CFO CEO like and critic critic mode like basically subscribe stay tuned and I'm very curious where you guys are going to take it and if you want to learn more about clawot and all the security issues and generally like why I wouldn't recommend using it and also mold old book, how that whole hype is alive.