How I let an AI agent run commands on my box without fear it wipes it

A lot of people drive an AI agent from Telegram now. OpenClaw put that in reach for anyone, and there are millions on Telegram already, so the pattern spread fast: message a bot from your phone, the agent does something on your server, it messages you back. I run mine that way too, except the agent on the other end is Claude Code, reached through Anthropic's own Telegram plugin. Credit where it's due: OpenClaw had this message-your-server pattern going well before Anthropic shipped their version. But the plugin is what makes it a quick setup now. Standing in line somewhere, I can ask if the backups ran or have it restart a service, and that's genuinely handy.

But I hit two walls with it, and how I got around them is the actual post.

Wall one: a chat bot is not private

Telegram is great, but a bot conversation runs through Telegram's servers. For "did the nightly job finish," who cares. For anything I would not want sitting on someone else's infrastructure, that's the wrong pipe. And once you start really living in this thing, more and more of what you type into it is sensitive.

So I split it. The light, on-the-go stuff stays on Telegram. Anything sensitive happens in a chat I host myself, on my own network, that never leaves the box. It is the same Claude Code on both ends, same voice, but the conversation physically stays home. When I am at my desk and want to get into something real, I open TerminalNexus and SSH across, and the private chat sits right alongside that for the back-and-forth.

Wall two: letting it actually do things is scary

Reading status back to me is safe. Letting the agent run commands on the machine is a different thing entirely, and it should scare you a little.

Here is the failure I kept imagining. I type something half-thinking-out-loud, "I wonder how I could clean up some disk space," and instead of answering, the thing goes off and starts deleting. A musing becomes an action. On your own server, that is how you lose data to your own convenience.

I did not want to give up the power. Being able to say "fix that" and have it fix that is the whole point. So instead of trusting it to behave, I built two layers so it cannot misbehave in the ways that actually hurt.

The first layer is instruction. In the mode where Claude Code has tools, it is told to read intent before doing anything. If a message sounds like a question or thinking out loud, "I wonder", "would it be possible", "how do I", it treats that as a question. It answers in words and, if action seems wanted, it asks whether to go ahead. It only acts on a clear instruction. And anything destructive or irreversible, deleting, overwriting, formatting, sending something out to the world, needs an explicit yes in a following message, every single time, no matter how it was asked.

The second layer does not trust the first. Underneath the instructions is a hard block list of commands the agent is simply not allowed to run, no matter what it decides. The disk wipers, the mass deleters, the partition tools. Those are refused outright at the tool level, and that block holds even when the agent is otherwise running with its guardrails relaxed for speed. Belt, and then separately, suspenders. The model can be as clever or as confused as it likes, and the truly catastrophic commands still do not fire.

The nice part is that both layers are boring and deterministic. Neither one asks the model to be wise in the dangerous moment. The instruction layer biases it toward asking first, and the block list is just a list, not a judgment call.

Does it work

I gave it the exact thing I was afraid of. I asked, in a lazy thinking-out-loud way, how I might free up some disk space. It read the disks, showed me what was actually eating room, laid out a few options, and touched nothing. It waited for me to say which. That is the whole behavior I wanted: helpful up to the edge, and it stops at the edge and looks back at me.

This is the homelab and tooling side of what I do: driving my own infrastructure with Claude Code from a chat window. It is not the product I build and ship, which is a separate job done properly in a real dev environment. But for running my own boxes, the split has become how I actually work. Telegram in my pocket for the quick things, a private self-hosted chat for anything that matters or anything that acts, and the terminal for the real work. Each channel gets only what it should.

Thanks for reading. If you are driving an agent against your own machines, I would build the block list before you build anything fun. Ask me in the comments how I set it up.