How I use my Claude Max plan to run an autonomous agent
After Anthropic Killed The OpenClaw Trick, I Built My Own Harness
On February 20, 2026, Anthropic updated its consumer terms to prohibit using a Claude subscription’s OAuth token inside third-party tools. On April 4, at noon Pacific, they started enforcing it. That afternoon, anyone running OpenClaw against their Pro or Max plan watched their agents stop working. Boris Cherny, who runs Claude Code, put out a statement pointing at infrastructure strain. The subscriptions were never designed for the usage patterns these third-party harnesses had built on top of them.
On the surface this is B.S. Anthropic already throttles your access when you reach the limits and sometimes whenever they feel like it.
At around the same time as the announcement, I downloaded a malicious skill from the Openclaw Skill ‘marketplace’ and had to shut down and rebuild my setup. The blast radius of this breach on my life was massive because Openclaw stupidly saves secrets in plain text. Luckily I caught the issue before the malicious skill stole anything important, but I had to rotate every key and password I had set up in Openclaw since they were potentially compromised.
Once I rotated everything, I tried Openclaw with the API and was spending almost 30 dollars a day to do everything I ran before using the Anthropic subscription. I switched to QWEN — while definitely cheaper, it was too much of a downgrade to be useful. OpenAI still hasn’t locked down their max plan yet so I tried that, only to want to throw the keyboard across the room. With the exact same prompts, the OpenAI version became super annoying. It got all fucking clever with its responses and constantly responded with these overly-dramatic slop-snark responses with these weird textual pregnant pauses in each answer. It was like talking to some sassy drag-queen twitch streamer that talked in early 2010’s tweets.
So I decomposed Openclaw down into three things.
1. **A dashboard where I can launch tasks and monitor the system.** The dashboard runs on Vercel and is attached to a DB. It has all of the cool stuff like React 19, Tailwind, serverless API routes, and all of the plumbing of a modern frontend.
2. **A task router.** The task router polls the DB and launches the agent to do the thing. Whether it’s a coding assignment, email triage, market research, portfolio updates, running evals, generating images and stubs for blog posts, or keeping an eye on competition — the task router runs constantly, picks up the job, and launches a Claude Code instance with the prompt. I can add recurring tasks or launch them one-off.
3. **An auto-planning and looping system.** Claude Code needs more guidance than “Go build a feature, make no mistakes.” It needs to take what I tell it, break it down into manageable steps, and then iterate until it is finished. Context windows are real constraints, and the compaction feature doesn’t work perfectly yet. I downloaded a repo called Ralph which does two things. First, it takes whatever task you give it and does some thinking and breaks it down into the smallest context-window-able chunks that it can. Then it continues to iterate until all of the context-window-able tasks are done. The system knows when to run this, and it stores the Ralphs of previous tasks so it doesn’t have to re-run the “PRD” step every time. For checking my email, the cache works great. If I ask it to build a new feature, it will go through planning first and then start building.
But most importantly, I added a SECRETS MANAGEMENT SYSTEM. Openclaw traded flexibility and ease of use for security. Full stop. This might have been an acceptable tradeoff if they didn’t simultaneously launch a malicious code-filled shit show of a marketplace at the same time. They’ve since cracked down on some of the offenders in the skill marketplace, but it was the wild west in the beginning. I will never trust them again, because fool me once and all that.
Instead, I used 1Password. It has a CLI and a Service Token system that lets you only load secrets at runtime. So my Interactive Brokers and banking credentials aren’t sitting there trust-us-bro-your-secrets-are-safe.json waiting to be hoovered up and sent home through a prompt injection.
The guts
Take email triage. I sit down in the morning, open the dashboard, click “Triage emails,” and by the time I’ve refilled my coffee the inbox is sorted. Nothing about that sentence is interesting, but everything underneath it is.
Here is what actually happens. The UI posts to `/api/jobs` with a title, a description, and a job type. Email triage is on my trusted list so it auto-runs. Anything that touches production code, or anything new, waits for me to click approve. That’s the whole approval logic.
The task router lives on a Mac mini that sits three feet from me. It polls the DB every 60 seconds, claims a job (atomic `approved` → `running` flip, so two workers could never grab the same row if I ever ran two), and then it asks Ralph the important question: do we have a cached plan for this one?
For email triage, we do. The first time I ran it, Ralph burned a few minutes of Opus chewing on “what does ‘triage’ mean for Henry’s inbox” and produced a plan — sort, label, surface the three things that actually need me, archive the rest. That plan got cached against the job type. Every morning since, the worker loads the cached plan, skips straight to execution, and spawns Claude Code:
```bash
claude -p --model sonnet --max-turns 20 \
--output-format json \
--dangerously-skip-permissions \
--append-system-prompt <skill-content> \
“<the prompt>”
```
`-p` puts Claude Code in print mode — no TUI. I scrub the `CLAUDECODE` env var before spawning so it doesn’t think it’s nested inside another Claude Code session. Skills get fetched from my public GitHub repo at runtime, never vendored. Edit a skill on my laptop, push, and the next job runs against the new version.
For a new feature, there’s no cache. Ralph plans first: breaks the task into the smallest context-window-able chunks it can, writes those out as a sequence, caches the sequence, and then starts working through it. If it runs out of context in the middle of one chunk, that’s fine — the chunks are small enough that it won’t. If Claude Code gets confused or quits early, Ralph re-queues the chunk with the failed output appended as context and tries again. This is the original vibe coding ‘keep pasting the error into the chat’ approach but much much smarter.
That second part — feed the failed output back in and run it again — is the whole Ralph loop, and it’s embarrassingly simple.
Three detection layers. Process-level: if `claude` exits non-zero, retry. Semantic: scan the output for “please clarify,” “I am not sure what you mean,” “could you provide more context.” Any of those, it’s a fail regardless of exit code. And on top: a Haiku evaluator. When Claude Code exits cleanly, the worker sends the job title, description, and output to Haiku and asks whether the objective was actually met. Haiku returns `{succeeded, summary, reason}`. Costs about a tenth of a cent per job. Best guardrail I’ve ever added to an agent system, because LLMs fail by producing confident wrong text, not by crashing
Planning is its own flavor of the same thing. For high-stakes jobs — architectural decisions, research that feeds a pitch, anything that touches a customer — I set the model to `opusplan`. That runs Opus with plan mode on, forces a structured plan before any execution, and dumps the plan in the output for me to approve or reject. Approve → same job kicks off execution against the plan. Reject → the plan is the final artifact. Planning uses the same queue as everything else. “Think harder about this” is a dropdown on the job form.
1Password is the spine
I said SECRETS MANAGEMENT SYSTEM in all caps and I meant it. Every secret lives in 1Password, in a vault called `Claudia-Bot` that only this agent can read. Nothing sits in a `.env` file on disk, and nothing sits in a Vercel env var I pasted from a terminal three months ago and forgot about — which I realized I had been doing today when I had to rotate keys after the recent Vercel breach.
The mechanism is secret references. Instead of storing `ANTHROPIC_API_KEY=sk-ant-abc123`, the repo has an `agent/op.env` that looks like this:
```
ANTHROPIC_API_KEY=op://Claudia-Bot/API Credentials/Anthropic API Key/password
VOYAGE_API_KEY=op://Claudia-Bot/API Credentials/VOYAGE_API_KEY/password
CONTROL_PLANE_TOKEN=op://Claudia-Bot/API Credentials/CONTROL_PLANE_TOKEN/password
DATABASE_URL=op://Claudia-Bot/API Credentials/DATABASE_URL/password
```
Every value is a pointer. To run the worker, I pipe it through `op run`, which resolves every pointer against 1Password and injects the real values into the child process’s environment:
```bash
op run --env-file=agent/op.env -- tsx agent/task-router.ts --loop
```
The secrets are never written to disk. They live in memory, in the scope of the process 1Password spawned, and go away when the process dies. The launchd plist that keeps the worker running as a background service does the same thing — wraps `op run` around the script, pulls the service account token from the macOS Keychain first and a `chmod 600` file only as a last resort. The service account token is the one bootstrap secret. It’s locked to this machine, scoped to one vault, and revocable in ten seconds from the 1Password web UI.
The pattern is also self-documenting. `op.env` is the complete secret inventory of the system. Taking away Gmail access is deleting one pointer. Rotating the Anthropic key is a field update — no redeploy, next job picks it up. If Claude Code ever gets prompt-injected into exfiltrating env vars, the worst it can steal is a list of `op://` pointers and a scoped service token. That is the exact opposite of trust-us-bro-your-secrets-are-safe.json. I am not a security expert though, so please tell me if this is adequate. I guarantee it’s better than vanilla Openclaw.
The boring parts
Here are four decisions I made on purpose, and they’re the reason this thing runs unattended for weeks at a time.
Launchd not Cron + KeepAlive=true, RunAtLaod=true and it runs relentlessly like it’s chasing Sarah Connor.
Fail Loud - In claude.md I have an explicit rule against fallback code. So missing environment variables or encryption keys won’t allow the system to start. This is from a hard lesson where some claude generated fallback code would have made customer data unrecoverable. But more importantly if I break something it breaks everything instead of running and failing silently while I think everything is fine.
3rd party skills get reviewed before they go anywhere near my setup - I have a separate process which reviews 3rd party skills for anything that looks suspicious and gives them a score based on whether it does what it says it should do, there are no prompt-injection patterns, it doesn’t try to tell the agent to download anything or call home etc.
What’s next and what’s missing
I plan to add a ‘fix’ button on each failed job, which will kick off another Ralph planning / iterate cycle to figure out why any job fails and triage the solution.
I also want the system to tell me what I should work on. I have a “Dreamer “script runs nightly, reviews the last 24 hours of jobs, and writes suggestions to a proposals table. But that table is a place I have to go visit. What I actually want is a morning briefing waiting on the dashboard when I open it — three ranked priorities with a one-line reason for each. The machinery is all there. I just need to make it.
And I want someone else to be able to run this. I’m not trying to turn it into a SaaS (though I’d take orders if anyone really wanted it), more like a public fork another solo founder could clone and deploy over a weekend. The current repo has my investment portfolio in it and jobs that are specific to my company like my evals, so none of that belongs in a version a stranger could pick up. Stripping that into a private overlay and publishing a clean base is a two-day job I haven’t found two clean days for yet.
The point
Openclaw was the wrapper around Claude, and the OAuth trick is what made it cheap enough to justify running. Then Anthropic killed the trick. I almost got my banking creds stolen because Openclaw stores secrets in plaintext. Every replacement I tried was either expensive or insufferable. Running the same stuff on the Anthropic API was thirty bucks a day. QWEN was cheap but too much of a downgrade. OpenAI’s max plan was the drag-queen twitch streamer I already complained about.
So I stopped looking for a better wrapper and I wrote one. A dashboard, a task router, Ralph for the planning and retry logic, and 1Password for the secrets. A few hundred lines of code, most of it the UI. The expensive parts all happen inside Claude Code, which I was already paying for every month anyway.
If you’re a solo founder and you’ve been shopping for an agent framework, just use Claude Code instead, and add a job queue, something like Ralph to plan and retry, and a secrets vault that isn’t a JSON file trust-us-bro’d into your repo.
Sources
- [Anthropic cuts off Claude subscriptions from OpenClaw — VentureBeat](https://venturebeat.com/technology/anthropic-cuts-off-the-ability-to-use-claude-subscriptions-with-openclaw-and)
- [Anthropic clarifies ban on third-party tool access — The Register, Feb 20, 2026](https://www.theregister.com/2026/02/20/anthropic_clarifies_ban_third_party_claude_access/)
- [Anthropic says Claude Code subscribers will pay extra for OpenClaw — TechCrunch, April 4, 2026](https://techcrunch.com/2026/04/04/anthropic-says-claude-code-subscribers-will-need-to-pay-extra-for-openclaw-support/)
- [Ralph: the dumbest agent loop that works — Geoffrey Huntley](https://ghuntley.com/ralph/)