Wiring an open-source agent to WhatsApp is a weekend project. Keeping it running is not. Here is what breaks, in the order it breaks.
The five failure modes
- Session loss. Linked-device credentials rotate; if you do not persist and refresh them, you are re-scanning a QR code every few days.
- Single-process state. One crash mid-task and the work is gone, because progress lived in memory.
- No cost ceiling. An agent in a loop on a busy group can spend a startling amount overnight.
- Spam flags. Bulk sends, mass group-adds, and rapid identical messages get real numbers restricted by Meta. This is not recoverable by apologising.
- Prompt injection. Anyone who can put text in a group you watch can try to instruct your agent. Without a tool allowlist, that is remote code execution with extra steps.
Designing around them
- Persist the auth state outside the process, and treat reconnection as the normal path rather than the error path.
- Checkpoint every step of long work to durable storage, keyed so a restart resumes instead of restarting.
- Put a hard spend and time ceiling on every job, and make hitting it a reported outcome, not a silent stop.
- Cap outbound sends per turn, and make the cap un-circumventable by splitting across turns.
- Tag all inbound content as untrusted, allowlist tools per turn, and never let a tool's output trigger another tool without re-approval.
The honest cost
The agent loop is maybe fifteen per cent of the work. The other eighty-five is reconnection, durability, guardrails and the operational discipline to notice when your number has gone quiet. If that is not the project you wanted, use something that has already paid that cost.