I Call My Coding Agents From the Car. The Model Is the Part I Refused to Lock In.

On a normal phone call from my car, I asked my PC how much RAM it was using and whether anything needed cleaning up. I told it to start an agent for the cleanup and to check with me before the agent acted. In the same call I asked it a football question. Before I hung up, it told me some of my Claude sessions were finished and asked if I wanted it to close them out.

The "check with me first" part is what the first version got wrong. It had a field called collin_confirmed. The voice model set it to true when it believed I had said yes, and the server sent my message to a coding agent. The review of that first build caught the hole: the model reads agent output aloud to me, so a sentence sitting inside that output could talk it into setting the flag, and a message would go out that I never approved.

That flag is gone, and the fix is the most important part of what I built. First, though, here is why I wanted a phone line to my agents at all.

I wanted my own sessions in the car, not another assistant

I drive a 2025 Model 3, the refreshed one, with Full Self-Driving. With the car doing most of the driving, the time behind the wheel turned into time I could spend checking on work, as long as I did not have to look at a screen.

I run several Claude Code and Codex sessions at once through Paseo, a local app that manages coding agents on my PC. Most of my day is waiting for one of them to finish, ask permission, or hit an error. The built-in assistants in my car and my phone are good at their own jobs, but none of them could tell me what my sessions were doing or pass them an answer. I wanted to call my PC, hear which session needs me, and reply without looking at a screen.

The second requirement was the one that shaped everything: the agents had to keep running on the tools and subscriptions I already pay for. My coding agents run on my existing Claude and ChatGPT plans. If voice access meant moving that work onto one vendor's agent, I would be trading flexibility for convenience.

The call is ordinary; the tools on my PC are what matter

The car does nothing special. It places a normal phone call over Bluetooth to a number saved in my contacts as "Grokinator". That number sits on a Twilio Elastic SIP trunk with encrypted transport, which hands the call to OpenAI's GPT-Live voice model. OpenAI sends a signed webhook to the only public path on my machine, and a small Node server checks the signature and my caller number before it accepts the call. A spoken PIN unlocks the tools, and nothing said before the PIN is accepted is logged or saved.

From there, the voice model delegates to a backend model that calls tools running on my PC. I can ask "what's going on?" and get a rundown with whatever needs me first. I can ask for a summary of one session's last request and reply. I can start a new Claude Code or Codex session in a project, with a model and thinking level, on its own branch, or move a running session to a different model or thinking level. When a session finishes, errors, or asks for permission, the assistant tells me without being asked.

The projects, models, and thinking levels are not free text. The server reads them from Paseo every 10 minutes and turns them into fixed choices in the tool definitions, so the voice model cannot invent a model that does not exist on my machine.

A read-back is not a confirmation unless I actually spoke

Back to the flag. The stake is simple: an assistant that reads agent output to you is also reading text that someone else may have written, whether that is a web page an agent visited or a file it opened. If the same model can both read that text and approve actions, the text can approve actions.

The replacement is two steps and a gate the model does not control. A request like "tell it to open the PR" only holds the message and returns a read-back. Nothing is sent until a separate confirm step runs, and the gate refuses that confirm unless my voice was heard after the assistant last read agent content. It proves I spoke, not what I said, so the spoken read-back is still my check on the content. A retried confirm cannot send twice, which also fixed a bug where a tool timeout followed by a retry could deliver the same message two times.

The phone added its own failure. Phone speech recognition once heard me say "accept" as "stop". I now say "approve", which survives a narrow-band phone line better.

Where the built-in options win

OpenAI's dots, announced on September 29, 2026, are a stronger product than mine in several ways. According to OpenAI's announcement, each dot is an always-on agent running on GPT-6 Astra with its own cloud computer. You can message or call it in ChatGPT on desktop, web, and mobile, and message it in Slack or Teams (texting is still to come). The first one is included in the Pro and Business Premium plans in eligible markets. It keeps working when my PC is off. Mine does not.

Grok in a Tesla wins on setup: it is already in the car, it controls the car, and I did not have to build anything. I have the basic Grok in the car, and I can use the Grok bots without the top plan. I use them for simple things and my own system for work.

Both lost for this one job for the same reason. The work I wanted to reach already lives in sessions on my PC, on models I choose per task. A dot does its work on OpenAI's computer and model. Grok in the car is xAI's assistant. Neither was built to sit on top of the Claude Code and Codex sessions I already run. Mine brings my own subscriptions and works on the desktop I set up for my agent work.

The voice layer is still one vendor, and it can break

Here is the limitation I would rather name before a reader does. The agent layer is model-flexible; the voice layer is not. Every call runs on OpenAI's GPT-Live today, and if OpenAI changed its pricing or terms I would have to rebuild that layer. I accepted that because the voice model is the replaceable part: it only talks and delegates, while the sessions, branches, and history stay on my machine.

The setup taught me a lesson about overbuilding too. The night after the first version worked, I had a team of agents build an improvement system around it: a test lab with 24 scenarios, an AI reviewer, and an overnight loop to keep only fixes that did not regress. I parked it the next day because the testing was taking more time than the assistant was saving. And because the server runs on my PC, it can go down with it. On October 5 the process that keeps the server alive was killed, and the phone line stayed dead until a manual restart at 9:50 PM. A scheduled check now starts it again within five minutes.

Decide which layer you are willing to rent

If you want voice access to your agents, decide first which layer has to stay yours. For me it was the agents and their sessions; the voice model is rented and swappable. If your work already lives inside one vendor's agent, their built-in voice will be simpler and better than anything you build. If it lives on your machine across several models, put the confirmation gate outside the model before you put a phone number in front of it.