AI agents on Telegram, WhatsApp, Slack, and Discord

To connect an AI agent to Telegram, WhatsApp, Slack, or Discord, you link a messaging interface to a service that receives requests, checks permissions, calls the model, and controls its tools. The technical approach varies by channel, but security depends mainly on who is authorized, which data they can access, and which actions are allowed. Start in a private space with read-only capabilities, then expand access gradually as you verify the controls.

Understand what the connection allows

A messaging platform provides an entry point; it does not define the agent’s authority. Receiving a request for a summary, looking up a customer record, and sending a response to someone else are separate operations. Each needs its own authorization.

The architecture follows a sequence: incoming message, identity check, context selection, model call, any tool calls, output check, and response. A task queue lets processing continue without keeping the incoming request open. Access rules must take effect before the message reaches the model.

Also distinguish between two uses. An agent controlled through a messaging platform receives your instructions in a conversation. An agent with access to a messaging platform can search conversations or send messages through tools; it does not necessarily listen for new messages.

A webhook forwards an event to your service. An MCP server exposes functions to an agent. These mechanisms can work together, but installing a messaging MCP server does not automatically create a conversational bot.

AI agent or chatbot: what’s the difference? explains the distinction: generating a text response and taking action in software require different controls. The AI agent directory can then help you compare software, without assuming that every product supports every channel.

Choose the channel based on users and permissions

The appropriate channel is usually where your users already work, provided its rules fit the service you intend to offer. Before development begins, establish who will administer the application, how its access can be removed, and where the data it uses is stored.

Criterion	Telegram	WhatsApp	Slack	Discord
Interface to review	Bot API	Business Platform or a separate gateway	Application and Events API	Application, interactions, and Gateway
Ways to receive events	Polling or webhook	Business integration and events	HTTP or Socket Mode	HTTP interactions or Gateway
Cautious starting point	Authorized private conversation	Clearly defined business workflow	Restricted pilot channel	Command in a dedicated channel
Main control	Authorized user and conversation identities	Service terms and recipients	Permissions and event subscriptions	Permissions, channels, and content access
Risk to address	Command from an unknown person	Confusion between the business API and a personal account	Excessive access to internal conversations	Public exposure and repeated triggers

This table compares the documented interfaces reviewed on October 24, 2026; it does not guarantee that your application is eligible to use them. Administrator approval or contractual restrictions may prevent a setup that is technically possible.

For a personal assistant, favor a closed channel with an allowlist of users. For a team, choose an administered workspace with a clearly identified person responsible for it. For customer service, also plan for human handoff, messages outside the service’s scope, and outbound messaging rules.

A prototype should not start in a public group. You need to observe errors without exposing data or publishing responses to people who have not agreed to use the service in this way.

Telegram: separate message receipt from authorization

Telegram’s Bot API supports polling through getUpdates or webhooks through setWebhook. These modes are mutually exclusive. For a webhook, the API lets you set a secret delivered in a header, while the update identifier helps detect repeated events. These mechanisms are covered in the official Telegram documentation, reviewed on October 24, 2026.

Polling can suit a service that establishes outbound connections. A webhook requires a reachable HTTPS address. In either case, the bot token remains a secret: it must not appear in conversations, screenshots, or routine logs.

Receiving a message does not authorize its sender. Check both the user ID and the conversation ID against an allowlist. A display name, a text signature, or a message saying “I’m an administrator” is not proof of identity or authority.

In a group, define exactly what triggers the agent: an explicit command, a reply to the bot, or another specified event. Check the visibility settings and permissions actually granted before drawing conclusions about what the bot can read.

Finally, tie the response to its original conversation. A long-running task must not adopt a destination suggested in a document’s text. The return destination belongs in service-controlled data, rather than being left to the model to choose.

Slack and Discord: favor explicit requests

On Slack, the Events API delivers events over HTTP or Socket Mode. Available events depend on the permissions granted during installation and the subscriptions configured. Socket Mode uses a WebSocket connection instead of a public HTTP endpoint, as described in the Events API documentation, reviewed on October 24, 2026.

For HTTP delivery, apply the verification described in Slack’s request-signing documentation. This establishes where the request came from; it does not determine whether its author is allowed to view an invoice or change a record.

On Discord, application commands and components generate interactions. These can arrive through the Gateway or over HTTP; a deferred response lets the service handle a request without waiting for the model to finish its work. The official interactions documentation describes these delivery paths.

Broad access to message content is a separate decision. Discord treats content access as a privileged capability with specific requirements, explained in its privileged intents documentation, reviewed on October 24, 2026.

In both environments, an explicit command reduces accidental triggers. It also makes the service easier to understand: users know which text they are submitting. You still need to restrict accessible channels, avoid administrator permissions, and apply authorization checks to every business tool.

WhatsApp: review the terms of use first

On WhatsApp, distinguish between a business integration and a gateway connected to a personal account. They provide different access and operational assurances. A working demonstration does not establish that a service can be offered on an ongoing basis.

The official terms reviewed on October 24, 2026 restrict use by AI providers when the technology is the primary functionality. However, the text provides an exception for users whose phone numbers have a country code from the European Economic Area or Brazil. It also allows an AI provider to act as a service provider under specified conditions: check the WhatsApp Business Solution Terms against your intended setup.

The business policy also distinguishes replies from subsequent outreach. Within the 24-hour customer service window, which resets when the user sends a message, a reply can be sent without an approved message template; outside that window, messages must use approved templates. The policy also requires a clear escalation path for automated responses. These rules come from the WhatsApp Business Messaging Policy, updated on September 23, 2026 and reviewed for this guide.

A personal-account gateway creates other risks. The WhatsApp MCP project says it connects to an account through WhatsApp Web’s multidevice interface, stores messages in a local database, and exposes reading and sending tools. Its official repository also highlights the risk of data exfiltration through injection. This architecture calls for a specific review before connecting an account that contains private conversations.

Choose between a connector, automation, and custom development

Three approaches cover most projects. Their main differences concern maintenance responsibility and the precision of the available controls, rather than model quality.

Approach	Setup	Control	Maintenance	Suitable use
Connector built into an agent	Guided configuration, depending on the software	Depends on the settings exposed	Monitor both connector and agent	Assistant with a limited scope
Visual automation	Sequence of events and actions	Visible rules that need checking in every branch	Credentials, errors, and changes to nodes	Clearly defined business process
Custom service	Direct management of the interfaces	Detailed policies are possible	You handle operations and security	Specific, long-term requirements

A tool such as n8n may be worth considering. Before choosing it, check its documentation for the exact trigger, available operations, and error recovery behavior. A messaging platform’s name in a catalog does not guarantee that every function you need is supported.

In an automation, keep straightforward decisions outside the model: whether a user is allowed, whether a destination is authorized, whether a budget limit has been reached, and whether approval is required. The model can prepare a proposal without receiving the power to change those rules.

For a custom service, separate the connectors from business logic. A messaging platform’s format change should not alter a tool’s permissions. Hosting an AI agent on a VPS covers the operational questions that remain regardless of the interface you choose.

Launch without granting every permission

The prerequisites are a test space, a legitimate administrator account, secret storage, and someone who can suspend the service. Also prepare representative fictional data and a way to hand requests over to a person.

Define a limited task. For example, search for a procedure in an authorized document collection and suggest a response. Also document which requests must be refused or passed to a person.
Create a dedicated application. Grant only the permissions needed for the pilot. Keep its secrets separate from those for the model and business tools so that each form of access can be revoked independently.
Configure the official event delivery method. Choose a documented method for the channel, verify the origin of events, and discard those that do not match the intended trigger.
Add checks before the model. Identify the user, workspace, and destination. Reject unauthorized requests before sending their content to a model provider.
Start without external actions. Produce a draft in the pilot space. If an action becomes necessary, add an approval step tied to its exact content and recipient.
Test incidents before launch. Simulate a repeated event, an interruption, an excluded user, and an unavailable model. Check that recovery does not turn an old request into an unexpected outgoing message.

There is no universal installation command for this process: setup depends on the connector you choose. Keep the documentation relevant to your deployment and a record of the validated settings so you can rebuild the service.

Protect data and actions

A conversation mixes legitimate instructions with untrusted content: forwarded messages, documents, links, screenshots, or tool results. A prompt injection attempts to make that content pass as an authorized instruction. An event signature does not make its attachments trustworthy.

Put sensitive decisions in code or rules that operate independently of the model. The service must control recipients, accessible resources, and available actions. Instructions telling the model to be careful can supplement these barriers, but cannot replace them.

The requester’s identity must also determine document access. If the bot uses a highly privileged service account, it must not return everything that account can read. Filter searches according to the user’s permissions before assembling the context.

Isolate memory by organization, conversation, and, where necessary, user. A private response must not enter the context of a public channel. Summaries and derived indexes require the same care as the original messages.

For a sensitive action, show the operation, its target, and its content. Approval must expire and become invalid if any of those elements change. An isolated “yes” in a group is not an adequate approval mechanism.

The AI agent security guide explores these controls in more detail. The Lab’s security assessment helps identify excessive access before deployment.

Budget for and measure the whole service

Costs extend beyond the model’s response. Include message delivery charges for the channel, any intermediaries, hosting, attachments, transcription, storage, and maintenance time. Check the rates applicable to your contract and destinations before estimating costs for a given volume.

A user message can trigger several model calls and multiple tools. An overly long history increases the context sent to the model; a loop that fails to stop multiplies the work. Set limits per task and per user, together with a global stop mechanism that operates independently of the model.

Measure useful outcomes: requests completed correctly, human handoffs, authorization errors, blocked actions, response times, and the cost of completed tasks. Sending a response does not prove that the user’s need has been met. Keep a representative set of requests to compare performance after changes.

Logs should let you connect an event to its task, tool calls, and response without routinely copying entire conversations. Mask secrets and restrict access to traces. Define retention periods for messages, files, memories, and backups.

Self-hosting the connector does not, by itself, keep data on your infrastructure: a remote model or external tool may receive it. Map the actual path content takes and have the obligations that apply to your organization reviewed before introducing sensitive data.

Common problems and final checks

The bot does not respond. First check event delivery, permissions, the trigger, and the authorized identity. On Telegram, look specifically for a conflict between polling and webhooks. On other channels, check the configured subscriptions or interactions before changing the model’s instructions.

A response is sent more than once. Make processing idempotent: an event already recognized must not cause another action. Also distinguish user messages from messages generated by the service to prevent loops.

An action may have succeeded despite an error. A timeout does not mean that sending failed. Check the recorded state or the result on the service side before trying again; otherwise, a simple retry may create a duplicate.

Context comes from another conversation. Suspend the pilot and inspect session keys, routing, and document filters. Changing the instruction text is not enough to fix memory being mixed across conversations.

Before launch, complete this checklist:

Authorized accounts, conversations, and recipients are defined.
Event origins are verified using the channel’s required method.
Repeated events do not trigger additional actions.
Searches respect the requester’s permissions.
Memories and files are isolated at the appropriate scope.
Sensitive actions require specific approval.
Access to secrets, logs, and backups is restricted.
Limits and the stop switch have been tested.
A person can take over blocked requests.

A connection is ready when these mechanisms have been verified under both normal conditions and failure scenarios. Exchanging an initial message confirms only that message delivery works.

Frequently asked questions

Can I use my personal account to control an AI agent?

Some gateways make this technically possible, but they expose a personal session and sometimes an extensive message history. A dedicated account or application makes it easier to revoke access, separate conversations, and manage permissions.

Can an agent respond across several messaging platforms?

Yes, the same underlying logic can receive events from multiple connectors. Each connector must retain its own access rules, and user identities must not be merged solely because they share a display name.

Do I need a server that is accessible from the internet?

That depends on how messages are received. Some interfaces use an outbound connection or periodic polling, while an HTTP webhook requires a reachable, protected endpoint.

Can I offer a general-purpose assistant on WhatsApp?

Check the terms that apply to the service and the territories involved. The official terms reviewed for this guide distinguish AI providers whose assistant is the main feature from ancillary uses, with territorial exceptions.

How do I stop an agent that is sending unwanted messages?

Provide a switch that blocks outgoing messages independently of the model and suspends pending tasks. Then revoke any compromised access and review the logs before restarting the service.

Connect an AI agent to Telegram, WhatsApp, Slack, or Discord: methods and risks