WhatsApp is how I talk to my AI

Most of my conversations with my AI now happen in WhatsApp. I open a group called Claude MetaNova, type or send a voice note, and a reply comes back a few seconds later from the same system that runs my legal work, my consultancy and the Mindstone Bristol community. I don't open a laptop for most of it.

It's been running since 20 March. In that time it has become the way I actually use my second brain, and it has also gone wrong in ways I didn't see coming. This is how it's set up, what broke, and what I'd tell anyone who wants to do the same.

Why WhatsApp at all

I'd been using AI through a terminal (the text window developers use) and a chat app on my laptop. Both are fine when you're sitting down to work. Neither is where I am for most of the day. I'm away from the desk far more than I'm at it, and the app I always have open is WhatsApp.

The other reason is that a phone is where things actually come up. A thought about a client, a reminder for Thursday, a photo of a letter. If capturing it means opening something unfamiliar, I don't do it. If it means sending a message to a group, I do.

The first time I connected my messages to Claude at all was 14 January. That was through Beeper, an app that brings WhatsApp, iMessage and others into one inbox on the Mac, and lets other software read and draft through it. In February I tried running it from a rented server and it was, honestly, clumsy. It worked some of the time and I couldn't tell when it wouldn't.

The setup since March

On 20 March I built a small plugin for Claude Code Channels, which was then a research preview from Anthropic that lets messages arrive into a running Claude session. Mine is about 200 lines. Here's what happens when I send a message:

1. I post in one of my AI groups on WhatsApp.
2. Beeper Desktop on my Mac receives it like any other message.
3. The plugin checks my AI groups every five seconds and passes anything new into a long-running Claude session on the Mac.
4. It replies "Received, processing" straight away, so I know it's been picked up.
5. Claude does the work (reads files, checks my calendar, drafts something, logs a note) and posts the answer back into the same group.

Each group has one purpose. There's one for my ventures and operations, which is Claude MetaNova. There's one for family logistics that my wife and I share. My wife has her own group too, where the assistant acts as a coach and can only see family things, not my work. There's a separate group that only ever carries security alerts. The group a message comes from decides what the AI is allowed to see and do.

That last point turned out to matter more than anything else.

What it's good for

The everyday uses are unglamorous, which is the point.

• Voice notes on the move. I talk for a minute, it's transcribed, and the AI files it in the right place or acts on it.
• Quick lookups. "What did I agree with this person last month?" It searches my records and tells me, with where it found it.
• Drafting. "Reply to that email saying Thursday works." It drafts the reply and tells me where it is.
• Photos and documents. A letter, a receipt, a screenshot. It reads it and logs what matters.

On 22 April I gave a talk at Mindstone in Bristol called "Your Brain in Your Pocket", showing this live. For the talk I'd set up a separate channel with very tight permissions, so it couldn't see anything private on stage. In testing the day before it passed only 6 of 32 checks. I used that in the talk rather than hiding it: strict permissions mean limited capability, and you have to decide where you want to sit. On the night, someone asked for a voice-note reply and it couldn't send audio, only text, so it sent a text summary instead. That was a fair demonstration of the real thing.

May, when it broke

Most of what I know about running this came from one month.

Too many hellos

On 6 May I forwarded an album of nine messages and got six or more "Received, processing" replies, one per message. The next day I found three copies of the session running at once, each sending its own reply. It's funny until it's your phone buzzing at dinner.

The fix was to group messages that arrive in a burst and acknowledge them once, with a short cooldown, and to add a lock so only one copy can reply. Simple, once you know.

The wrong group

On 10 May a coaching reply meant for the family side went into a different group. I'd asked the question in one place and the answer, which was private family content, landed in another. I caught it straight away and nothing left my own groups, but it was the moment I took this seriously.

The real risk wasn't that particular slip. One of my groups involves someone outside my household. The same kind of mistake there would have put private family content in front of a person who should never see it.

The fix went in that morning, in three layers:

1. A check before sending. Before any reply goes out, a separate check confirms the destination is a chat that just sent me a message I haven't answered.
2. A block inside the server. Even if the AI gets it wrong, the plugin itself refuses to post to a chat that doesn't have an unanswered message waiting. There's an override for deliberate messages, and every use of it is logged.
3. Separation. The group with an outside person moved onto a completely separate server, so the family side and that group can't reach each other at all.

While I was in there the plugin shrank from 484 lines to 399, and gained 11 tests. Fewer lines, more checks.

The fix that caused a new problem

On 23 May the first layer bit me. The server only remembered the single most recent chat that had messaged in. My wife sent something to her group, that became the "latest" chat, and a perfectly correct reply to me in Claude MetaNova was blocked. From my side it just looked like the AI was refusing to answer. It felt stuck.

The fix was to track each chat separately, so every group has its own "waiting for a reply" flag. Obvious in hindsight. I hadn't thought about two people messaging at once, because when I built it there was only me.

38 hours of silence

The worst failure didn't make a sound. Beeper needs a login key to keep reading messages. I'd added a job on 14 April that refreshed it every night. Between 8 and 15 May that job failed eight nights in a row, and it didn't tell anyone. When the key finally ran out, my wife's group went quiet for 38 hours. Messages went in and nothing came out.

The same week I found more than seven leftover copies of the server running in the background, and a bug where Beeper wrapped my AI's own replies in a bit of formatting, so they came back in looking like new messages from me. The AI was, briefly, replying to itself.

On 28 May I switched Beeper to a key that doesn't expire and deleted the refresh job altogether. A job that can fail silently is worse than no job, because it gives you a reason to stop looking.

And on 1 June I found the mirror image of the ack storm: "Received, processing" went out with no session behind it listening. The acknowledgement told me something was happening when nothing was. I've made it a principle since that a status message has to be true. If the AI isn't there, the system should say so, not reassure me.

The rules I run it by now

These came out of May. None of them are clever.

• One group per purpose. The group decides what the AI can see. Work, family and alerts never share a chat.
• Reply where the message came from. The reply address comes from the message being answered, every time. Overrides are rare, deliberate and logged.
• Drafts, not sends, for everyone else. Inside my own AI groups it replies freely. For anyone outside them it writes a draft and I press send. Anything it drafts to an outside contact opens by saying it's from my AI.
• No tables or heavy formatting. WhatsApp doesn't show them, so the replies are plain text, short, with the point first.
• One listener, and a loud alarm when it's down. Exactly one copy of the server should run. If it isn't running, I want to know from something that doesn't depend on the thing that's broken.

If you're doing this yourself

You don't need my setup to get most of the value. Here's the order I'd do it in.

1. Start with one group, just you. Make a WhatsApp group with yourself in it, name it so it's obviously the AI's, and use it for a week before adding anyone.
2. Decide what each group can see before you create it. Write it down in one line. "This group can see my calendar and my work notes, nothing else."
3. Make the AI reply only where the message came from. If your tool allows any other path, put a check in front of it.
4. Keep sending to other people manual. Let it draft. You send. This one rule removes most of the risk.
5. Watch for silence, not just errors. The failures that hurt me were quiet ones. Something should tell you when no reply has gone out for a while.
6. Test with two people at once before you rely on it. Most of my May problems only appeared when more than one chat was active.

What I'd still change

The weak spot is that all of this runs on my Mac. If the lid is closed, it stops. For now that's acceptable, and it's the next thing I want to fix properly, so that the groups keep working when the laptop is off. I'd also like a better answer on voice replies, which it still can't send.

What's surprised me is how quickly it stopped feeling like a tool. I don't think of it as "using the AI". I think of it as messaging the group, the same way I'd message a colleague. That's exactly why the guardrails matter: once something feels that normal, you stop checking it.

The earlier versions of the system behind all this are in Deleting my second brain twice in one morning and MetaNova V3: run the skills, don't read them.

If you'd like your own AI reachable from your phone, with the guardrails in from the start, let's have a chat.