Agent Zero · main guide

Step 3: A morning digest and your phone

You can already make a file, compare two products, and save a preference, so this step adds a job that repeats on its own. It also covers the rules you need before you reach the agent from your phone.

You are still on the same web page, and the clicks are the same on Windows and on a Mac. Host access stays off, and the container is still the workspace.

These steps were checked on 14 November 2026. If the agent asks to turn on Host access, click Stop.

A digest every morning

Repeating jobs live in the Tasks area of this web page, where a task can run on a schedule, at a planned time, or whenever you ask. A morning report is one example.

Tasks come from the scheduler plugin, an add-on that can create, list, run, update, or delete a task.

Because Agent Zero runs on your Windows or Mac machine, the computer has to stay on for the digest to run. If the computer is off at that time, that morning's run does not happen.

Ask for a digest that only writes a file:

Every morning at 7:30, while this computer is on, write a short digest in the workspace. Name the file morning-digest.txt. Include the weather for my city and one line from usb-compare.txt if that file is still in the workspace. Do not email anyone. Do not send a text. Do not spend money.

Change the time and the city to yours before you send it.

What you should see the morning digest is listed under Tasks in this web page, set to repeat. Nothing is emailed. With the computer off at 7:30, that run does not happen.

Phone add-ons stay off until only you are allowed

Telegram, WhatsApp, and email are plugins that show up as optional cards after the model is set up. You skipped those cards in Step 1, so they are still off.

Do not use a public bot, because a public bot is a remote control that any stranger can message.

The WhatsApp plugin starts off (enabled is set to false) and uses self-chat mode, which means a chat with your own number.

Its allow list is called allowed_numbers, and an empty list means everyone can message the agent once you turn the plugin on. Put only your own number in that list before you turn it on.

To pair, you scan a square code: on your phone, open the WhatsApp app and go to Linked devices.

The WhatsApp connection needs Node.js, version 18 or newer, but any missing pieces can install themselves the first time it starts.

What you should see WhatsApp stays off until allowed_numbers has only your number and you turn it on. After you scan the code from Linked devices, a message you send to yourself can reach the agent.

Telegram and email

The Telegram plugin stays off until you set it up. An empty Telegram allow list means the bot is open to everyone, so allow only yourself. This guide does not walk through creating a Telegram bot, because it could not confirm those steps.

The email plugin can read mail and send replies, so leave it off through this step.

What you should see Telegram and email still off. If you turn Telegram on later, the allow list has only you.

A web page can hide instructions

Any page the agent reads while it compares products or checks the weather can carry a prompt injection in text you never notice, and the agent may treat those hidden lines as a request from you. That is why you should keep the morning digest as a file in the workspace. Do not let it send messages yet, and do not let it spend money yet.

Trade-offs: safety versus capability

Agent Zero's main wall is its container, so most of the choices below come down to how far past that wall you let it reach. Agent Zero does not stop to ask before each command, so the container does the job that approvals do on other agents. Each choice makes the agent more useful, and each one gives a mistake more room.

Host access. This Launcher setting lets Agent Zero use files, terminal commands, a supported browser, or Computer Use on your real computer. It starts off, and the folder you pick only sets where file work and commands start, so it does not keep them inside that folder.

You gain: the agent can work on your real documents instead of copies you move into the workspace.
You risk: changes and deletions land on your originals, and a command can reach well beyond the folder you picked.
Makes sense when: you are watching the whole run and the files are backed up, such as a copied folder of photos to rename. It does not make sense while you are still learning the agent, or for any scheduled task.

The Telegram, WhatsApp, and email plugins. These optional cards let you send the agent jobs from your phone, or let it read your mail and send replies. WhatsApp starts off, but an empty allowed_numbers list, like an empty Telegram allow list, lets anyone message the agent once the plugin is on.

You gain: you can hand the agent a job while you are away from the computer.
You risk: anyone who reaches the bot can give orders, and on a personal WhatsApp number the agent can handle messages other people send to you. Email brings prompt injection straight to the agent, and the plugin's own notes say that whether a sender is genuine depends on your mail provider.
Makes sense when: the allow list holds only your own number or account, and you already know how the agent behaves from the web page. Email has no allow list you can rely on, because a sender's address can be faked, so connecting your main email does not make sense for a beginner.

The Flare tunnel. Found under Settings → External Services → Flare Tunnel, it opens the Agent Zero web page to another device, such as your phone, once you have set a login and password for that page.

You gain: the full web page, not just a chat, from wherever you are.
You risk: Agent Zero's own guide says anyone with the tunnel address can try to open your Agent Zero page, and its docs say never to put it on the internet without a login and password turned on.
Makes sense when: the login is on with a strong password you chose yourself (not the installer's default), and you keep the address private. Most beginners do not need it, because a phone plugin limited to your own account already lets you send a job.

Scheduled Tasks. A task in the Tasks area runs at its set time whether or not you are at the computer, as long as the computer is on.

You gain: work such as the morning digest is waiting for you without a word from you.
You risk: nobody is watching when it runs, so a hidden instruction on a page it reads, or a plain mistake, repeats every day until you notice.
Makes sense when: the task only reads public pages and writes a file in the workspace, like the digest in this step. A task that sends email, posts, or spends money does not make sense for a beginner.

A cloud model or a local model. During setup you choose a cloud model, through an API key or account sign-in, or a local model, through Ollama or LM Studio.

You gain: the best cloud models are stronger than any local one, while a local model keeps your prompts on your computer and costs nothing per use.
You risk: with a cloud model, your prompts and any files the agent sends along leave your computer. A small local model may describe what it would do instead of doing it. Also, for Agent Zero to use a local model, Ollama or LM Studio has to accept connections from other devices, so allow only devices you trust.
Makes sense when: a local model fits private material on a computer with plenty of RAM, and a cloud model with a spend limit fits the everyday jobs in this guide.

For the three questions behind this advice, and a ladder for loosening settings one rung at a time, see Safety versus capability.

When the digest is listed under Tasks, Host access is still off, and any phone plugin allows only you, go on to the longer jobs in guide/05: 05-feel-the-agi-playbook.md.