Getting an Openclaw agent running on its own machine

I finally hopped on the bandwagon and set up an OpenClaw agent, mostly because of DHH.

He recently ran an experiment where he isolates an OpenClaw agent in a VM to limit the blast radius if anything goes wrong. That idea really clicked for me: If you’re going to give an agent a browser and the ability to click around, you probably don’t want it to live inside your everyday machine.

Here’s his post about it if you’re interested

My Setup (and why it wasn’t as smooth)

My setup differs from DHH’s: I hosted the agent on a DigitalOcean droplet instead of a local VM. I started with the smallest droplet (1GB RAM, 25GB disk), and it mostly worked…. until I tried to use the browser tool.
Eventually, I had to resize it to 2GB RAM because the browser automation workload needed more memory to stay stable.

The first real snag: Browser Tool

The droplet didn’t have a browser ready for automation, so I had to get one installed. Turned out there’s a difference between Snap-packaged Chromium and Google Chrome. And Snap-packaged Chromium doesn’t work well with automation, so I had to install Google Chrome Stable instead. With that, the agent finally has a browser to use.

The agent’s first task

Like DHH described, the agent quickly needed her own email account. I had her sign up for a Hey email account to replicate DHH’s experiment as much as possible.

She didn’t do it in one swoop though:

She first asked for backup email, so I gave my email to her as backup.
Came back saying she couldn’t toggle the checkbox for terms and services. I had to nudge her with a simple “Think harder to resolve this please” and she managed to finish the sign up and move on.

After that, signing up for Fizzy was surprisingly smooth. She created a board and cards like a real assistant would.

Collaborating in Slack

At first, I was controlling everything by SSH’ing into the droplet and chat through the TUI. That works, but that’s not how I want to collaborate day-to-day, So I moved the conversation to Slack.

The first issue she ran into when signing up for Slack was passing the reCAPTCHA test, I eventually had to finished the sign up for her to move on.

The second issue was a big misunderstanding. I originally assumed: “If my agent has her own Slack account, she can read my messages and respond.” But that’s not how it works.

Even if the agent has a Slack account in the workspace, it doesn’t automatically “hear” (receive) messages in the channels the way human does. To reliably receive messages from Slack, we need to use Slack’s Events API (Slack sends events to us).

Slack gives us two ways to receive messages:

Public HTTP Endpoints: Slack sends events to your server URL.
Socket Mode: Slack opens up a WebSocket connection between Slack’s API and the agent.

I chose the Socket Mode path which requires generating a bot token + app token. The app token allows the agent to open that WebSocket connection to receive messages. The bot token allows the agent to post/respond in the channel.

I got lazy to read the docs, so I asked the agent to generate those tokens and configure everything accordingly. Impressively, she set everything up without an issue.

The final step is to go to the Slack channels that I want my agent to receive and respond in and invite the OpenClaw bot to the channel by typing in the Slack chat prompt /invite @OpenClaw. Once the bot is invited, my agent could read and respond to messages accordingly.

I did a final end-to-end test to assure everything works by asking my agent(from Slack) to create a test board with sample cards on Fizzy. And she did it flawlessly!

Permissions are a double-edged sword

Through out this experiment, I had to approve many actions along the way before she went off and execute because I wanted to minimize the risk.
If she had full permissions, I’m sure she can perform better and more smoothly. But, that’s obviously a security trade-off. The whole point of this style of setup is to limit the blast radius small enough that I’m comfortable letting the agent act.

Takeaway: The future is here, but it still has paper cuts

The world is changing fast.
Yes, there were hiccups. But once the pieces were in place(ie. stable hosting, browser automation, communication platform), it genuinely felt like a new category of tool. It’s no longer the AI that explains, but the AI that goes and does. Soon, I can imagine a world in the near future where everyone has their own personal AI butler. I believe the next big question is:
“How do we isolate it and control the blast radius when things go wrong?”
If people can start using agents freely without worrying about the risks, AI agents will become more disruptively powerful.