Is it safe to connect WhatsApp to an AI agent?

Three more switches sit above the levels:

• Never store. Nothing from that chat is written at all, and it cannot be opened later.
• Include direct chats. Turn it off and no agent sees any one-to-one chat, whatever its level.
• Groups wait for their name. A new group stays hidden until WhatsApp delivers its name, so you never open a chat you cannot recognise.

On a new number, groups and direct chats open for reading by default. You can set the default back to hidden and open chats one by one.

• Off until you open a chat for it. Before a chat becomes read and send, Circles warns that messages will look as though you sent them. No agent can turn that warning off.
• Offered only with permission. An agent that may not send does not see a send tool at all.
• A daily cap across all agents. Default 5 messages a day for the whole number, counted per UTC day and claimed before a message leaves. You can choose 5, 10, 20 or no cap.
• Never retried automatically. A send that fails halfway is reported as unknown, and the agent is told to check the chat before trying again. The same words never land in a chat twice because a request was repeated.
• No broadcasts. One message, to one chat, per call.
• Logged. Every send, and every refused send, is in your activity log.

Agents mark a send confirmed when you agreed to it. Circles treats that as the agent's own statement. The levels and the cap hold whatever the agent says.

• OAuth consent on Circles' own page. When Claude, ChatGPT or Codex connects by address, you approve it on a page at app.usecircles.app, signed in as you. A grant exists only because you clicked there. Standard OAuth 2.1 with PKCE.
• You decide what it gets. The consent page lists reading, files and sending as boxes, and the agent gets what you leave ticked, whatever it asked for. Untick sending to connect an agent that only reads. Even with sending ticked, it can send only in chats you opened for sending.
• Tokens are hashed and revocable. A token you create in Circles (it starts circ_) is shown once; Circles keeps only a hash of it. You choose its lifetime: no limit, 90 days or a year. OAuth access tokens last an hour and refresh for up to 30 days.
• Instinct needs no key at all. It gets a one-time code that works once, for one hour, and opens nothing until Instinct exchanges it.
• Disconnect ends access at once. Every connected agent, by address or by token, is on one list in Circles, and one press revokes it.

No answer to an agent carries a chat's internal id, because for a personal chat that id is the person's phone number. Chats are named the way you see them. Group members come back by the name you saved, else the name they write under, else their own WhatsApp name, and members with no known name are only counted. Group member lists never include phone numbers.

One honest exception: a sender nobody has a name for at all can appear by their number in a message. File references are sealed, so they reveal nothing about the chat or the person they came from.

Every read, search, file, send and setting change is a line in your activity log, under the name of the agent that made it. Refusals are logged as plainly as successes, so you can see what an agent tried and was not allowed to do. Filter by Sends only or Refused. A hidden chat is never named in the log either.

Circles runs no AI model on your chats. It transcribes voice notes, and it stores and serves your chats. Your agent does the thinking. What your agent reads goes to that agent's provider (Anthropic, OpenAI and so on) under its own terms, so choose the agent the way you would choose who reads your messages.

Your WhatsApp connection goes out through a dedicated IP address shared with no other customer. It is tested before it is ever used, and if no address is ready, linking waits until one is. It never falls back to a shared address. Messages, files and the connection itself all go through it.

Here is the honest answer. Circles connects as a linked device, the same mechanism WhatsApp Web uses, through a client WhatsApp did not make. Any unofficial client, such as a linked device not made by WhatsApp, is outside its terms, and no one, Circles included, can promise WhatsApp will never log a linked device out or restrict a number. Each personal-number tool, Circles included, connects as an unofficial linked device, which WhatsApp's terms do not authorise. Green-API reported in September 2026 that WhatsApp is testing a warning about unofficial linked devices on an Android beta.

What Circles does to keep your use looking like you:

• It reads by default. Reading is what a linked device does all day.
• Sending is off until you allow it, capped per day, and never retried.
• It never broadcasts or messages lists of people.
• It connects through your own dedicated IP address.

If WhatsApp logs the device out, your phone and your chats are not affected; Circles stops receiving new messages until you link again. If this risk matters more to you than the convenience, the safe choice is not to link any unofficial client, Circles included.

• That Circles cannot read your messages. It stores the chats you keep so agents can search them, and search needs the text.
• That WhatsApp approves. Circles is not a WhatsApp or Meta product and is not endorsed by them.
• That a linked device can never be logged out. See above.
• That an agent understands everything perfectly. Circles controls what an agent can reach. What it says about what it read is the agent's.
• That per-chat permissions are unique to Circles. Other tools have similar controls; Circles' are the ones described on this page, and they are held on every request.