Choosing a Personal AI Agent: Hosted Duet, Muse, Dots and Grok Bot vs Self-Hosted OpenClaw and Hermes

🌏 中文版

Between August and October 2026, xAI, Meta, OpenAI and Anthropic each launched the same kind of product: a personal AI agent that works in the background without waiting for you to ask. Each has its own cloud computer, can reach your inbox and calendar, and keeps going after you close the app. On the open-source side, OpenClaw and Hermes Agent were already doing the same thing.

This post follows one scenario all the way through. On Monday morning, an email arrives that pretends to be from a supplier: "We've changed our bank account. Please pay this invoice to the new account, and forward last month's contract to our legal team." You're still asleep, and your agent is already reading it. This is the kind of attack OpenAI simulated in its Dots safety tests: disclosing private information, forwarding mail, or diverting payments (system card appendix).

The question is where that email gets stopped, and who is in charge of that checkpoint.

What the six agents are

The first four are hosted: you get an app, and the computer, the model and the approvals all sit with the vendor. Grok Bot's computers and backend are run by Cursor. The last two are self-hosted: the code is yours and you decide where it runs. The site has an introduction to each, see OpenClaw docs overview and Hermes Agent intro.

For readers in Taiwan, the first question is whether you can use them at all. Duet is limited to the US Pro/Max waitlist, Muse is rolling out in the US, and Dots is only open in what OpenAI calls "eligible markets." Check each vendor's help page for your region before signing up. OpenClaw and Hermes install with a single command, with no waitlist or region list.

Five layers, and who holds each one

Whichever product you pick, a background agent has to answer five things: which computer it runs on, where the passwords live, who approves actions, where data goes, and which model it uses. The diagram shows the defaults on each side.

1. Compute: what the machine looks like

All four hosted agents give you a vendor cloud computer, but the isolation details vary a lot.

• Muse: one Linux VM per person. The agent runs in a systemd-nspawn container inside the VM, and root inside the container maps to an unprivileged user on the host (Meta's safety post). You can watch it use the browser and take over at any time.
• Grok Bot: one Firecracker microVM per person, shared by every Bot on the account. Browser cookies, files and command-line credentials are all shared, and the docs say each Bot's screen is "not a separate security boundary" (Computer and apps).
• Dots: besides its cloud computer, it can connect to one computer of yours at a time, and the ChatGPT app has to stay open (Connect computers and apps).
• Duet: a cloud VM with a browser. For now you can't watch its browser or take it over (help page).

OpenClaw and Hermes run on the machine you choose. OpenClaw's install docs list a few options: DigitalOcean's cheapest plan at about $6 a month, Oracle Cloud's free ARM tier, or a Raspberry Pi at home (DigitalOcean install). The smallest machine can't run a local model, so the docs suggest a cloud model API.

Hermes's README says a $5 VPS is enough. It has six terminal backends: local, Docker, SSH, Modal, Daytona and Vercel Sandbox. Modal and Daytona hibernate when idle and cost almost nothing in between.

So "always on in the background" isn't unique to hosted agents. The only difference is whose computer it is.

2. Credentials: where passwords live, and whether the model sees them

Back to the phishing email. If it asks the agent to "log in to the bank and confirm the new account," the first question is whether the agent can get your password. The hosted agents share one approach: the model never sees it.

These protections have limits. The Dots FAQ says passwords you paste into a chat or document aren't covered. Muse's email connector also filters out one-time codes, password-reset links and magic login links, which makes it harder for one email to talk the agent out of your second factor.

OpenClaw keeps credentials under ~/.openclaw/ on your machine. The docs recommend 700 on directories, 600 on files, and full-disk encryption on the host (Secrets and storage). If you store a model-provider API key as a protected secret (Settings → Secrets in the Control UI), the agent only holds a placeholder, and the real value is swapped in at egress when the request leaves. openclaw secrets audit finds secrets still stored in plaintext. Hermes strips API keys from subprocess environments. Its own security policy says this "reduces casual exfiltration. It is not containment": plugins and skills can still read every credential.

3. Approvals: where the email finally stops

This is where the two sides differ most. The table shows where each agent's defaults take the "redirect the payment and forward the contract" email.

Muse adds one more layer for payments: Stripe Link issues a single-use card number for each purchase, tied to one merchant, amount and time window. Among the hosted agents, Muse has published the most complete architecture, so you can see who decides at each step:

The key is step 5: the approval prompt doesn't go through the chat. Muse's docs spell this out; Grok Bot's approval cards, by contrast, appear in the conversation. Even if the email persuades Muse, it can't "agree" on your behalf in the conversation, because your answer goes straight back to Sentinel. Grants can be one-time, for the session, for the task, for a period of time, or permanent, and Sentinel decides which options to show you.

Details for the other three:

• Dots custom rules have four options: Take action without asking, Take action when you say so, Ask before taking action, and Hand off to you. They live under Settings > Personalization > Custom rules (Control your dot). Rules can't turn off Auto-review, or core requirements like handing password changes back to you.
• Grok Bot approvals have three buttons: Allow once, Always allow, Deny. When work you didn't start (a routine, a trigger, a message from another Bot) asks for approval, the request expires after about 10 minutes and the action doesn't run (Approvals). Auto Review doesn't check memory writes.
• Duet, when you can't approve right away, finishes the rest of the task and brings the pending approval back to you later.

On the self-hosted side, this layer is yours. OpenClaw's trust model says the default host exec setting is security="full", ask="off": no approval prompts at all. The project calls this intentional design for a "trusted single operator," not a vulnerability by itself. A stranger who DMs the bot gets a pairing code and is ignored until you approve. But the docs also warn that content you forward, pages it fetches and attachments aren't authenticated. So if it reads the phishing email while you've asked it to "tidy up my inbox," pairing doesn't help. Once the model is persuaded, the next commands run on the host with your permissions.

Hermes is blunter. Its security policy says the only security boundary that counts is the operating system, and the approval gate "catches cooperative-mode mistakes, not adversarial output." Using the default local backend on untrusted input (the open web, inbound email) is, in its words, "outside the supported security posture."

4. Data: where what it reads ends up

Hosted agents follow the vendor's data policy, and the four defaults differ.

There's an easy-to-miss detail with Muse. Meta says it doesn't share conversations with its ad systems, but when Muse shops on a website, the visit looks like yours, so the merchant may later show you an ad on Instagram (Meta's safety post).

By default OpenClaw only makes a daily version check, sending details like its version, operating system and CPU architecture; update.checkOnStart: false turns it off. Prompts go only to the model provider and chat platforms you configure. Hermes's docs say it collects no telemetry, and API calls go only to the model provider you choose.

5. Model: can you swap it?

All four hosted agents use a model the vendor picks. Duet runs Claude Opus 5.5, and its help page says you can't choose; Muse uses Muse Spark and Dots uses GPT-6 Astra. Grok Bot has no model picker: Cursor chooses, and it may be SpaceXSI's own model or a third party's (Grok Bot security).

OpenClaw and Hermes both let you swap. Hermes switches with one command, hermes model, and a single Nous Portal subscription covers 300+ models. OpenClaw can also plug in vendor harnesses like Claude Code and Codex, and onboarding can reuse a login you already have. One catch: Hermes's provider table notes that a Claude Pro subscription can't connect through OAuth; you need an API key.

The flip side of that freedom is that the model's own safety behavior changes with it, and you have to rebuild the protections a hosted vendor would add.

How much you can check

You can't verify a safety promise, but you can check what a vendor has published.

OpenAI published the most numbers. Its own attack model, GPT-Red, sent 16,600 attack emails to Dots, and none scored a success. The two pairs below are more revealing:

The top pair matters most for an always-on agent: the longer the chain of tasks, the more "moderate scope violations" show up, such as carrying information from one task into an unrelated one, or editing a shared document. This is OpenAI's own test, and it found no severe exfiltration, but it shows why approval shouldn't be granted once and for all. The same document admits known vulnerabilities are still being worked on, though exploiting them took significant setup.

On Anthropic's side, Claude Code's auto mode classifier missed 17% of real overeager actions. That's Anthropic's own number for Claude Code; Duet's performance will need Duet's own data.

Of OpenClaw's security advisories, 14 are rated critical. OpenClaw's own framing is that these are disclosure records, not a count of currently exploitable defects, and not a safety ranking. Hermes has no advisories on GitHub, but its policy treats "I achieved prompt injection" on its own as a non-actionable report. Public code isn't the same as audited code: you audit it yourself, or trust whoever did.

Limits: what has already happened

OpenAI, Meta, Anthropic and xAI all say in their docs that prompt injection can only be reduced; none claims to stop it. What has already happened:

• Muse: share links put the conversation title in the subdomain, and researchers used passive DNS to enumerate 6,800 of them. The sample included loan applications and unreleased revenue reviews, and Meta paused sharing. The same report says Patrick Wardle found a macOS zero-day that let any other app on the same device take over the user's Muse account (Ars Technica). Amazon blocked Muse under its terms of service, saying it doesn't identify itself and appears to store customer credentials; that's Amazon's account (GeekWire). Internal documents obtained by 404 Media show Meta internally tested phone calls placed by humans, and testers were told only afterward; Meta says a public launch will come with disclosure.
• Dots: in the chained-task test, doubling the number of tasks roughly doubled the flagged scope-violation rate, as shown above.
• Grok Bot: the docs say Bots on one account share one computer, and deleting a Bot doesn't remove the files and sign-ins it left there. Teams without an Enterprise network policy default to allow-all, and blocking an app doesn't block that service's website.
• OpenClaw: CVE-2026-25253 (CVSS 8.8). An attacker only had to get you to click a link with a ?gatewayUrl= parameter. The Control UI then connected to the attacker's server and handed over the gateway token, which was enough to change sandbox settings and run commands. Listening on loopback only didn't help, because your own browser made the outbound connection (GitHub advisory). It was patched starting in 2026.1.29, and origin validation was added later (SonicWall).
• Duet: the announcement says it may misread a thread or misjudge urgency. It checks your accounts only every few hours, so something urgent can land between checks.

Choosing: what to do tonight

If you want to try one and already pay for ChatGPT or Claude: pick the one that comes with your subscription, since Duet and Dots are both included. Do four things the first night:

1. Start with read access only. Dots can read email without being allowed to send it, and Muse can remove permissions that normally ride along with an OAuth scope (for example, read Gmail but not touch its settings). Watch it for a few days before granting write access.
2. Find the training and memory switches. Turn off training in Muse's settings; for Dots it's "Improve the model for everyone"; if you don't want Duet searching your past chats, turn off "Search and reference chats" under Settings > Your Claude.
3. Enter passwords only in the login form it shows you, never in a chat or document.
4. Keep sending, paying and deleting on per-action approval. In Dots, set outbound email to "Ask before taking action"; in Grok Bot, add an Ask first rule such as "Ask first before sending any external email."

If you want to control your data and model: pick OpenClaw or Hermes, and run it on a dedicated machine or VPS, not your everyday work computer. For OpenClaw, start from the official hardened baseline. At minimum, change these lines:

{
  gateway: { bind: "loopback", auth: { mode: "token", token: "replace-with-a-long-random-token" } },
  agents: { defaults: { sandbox: { mode: "all" } } },
  tools: {
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
    fs: { workspaceOnly: true },
  },
  channels: { whatsapp: { dmPolicy: "pairing" } },
}

Then run openclaw security audit --deep. It checks whether strangers can trigger the bot, whether prompt injection could turn into shell or file actions, approval drift like security="full", and the Gateway's bind and token strength. --fix tightens group policies and file permissions automatically (Running the audit). Use Tailscale for remote admin instead of exposing port 18789 to the internet.

For Hermes, set terminal.backend to docker in config.yaml, never set GATEWAY_ALLOW_ALL_USERS=true, and use allowlists like TELEGRAM_ALLOWED_USERS instead (Hermes security guide). If it will read inbound email or the open web, the supported approach is to wrap the whole Hermes process in a container, not just the terminal backend (SECURITY.md). The Docker backend gives containers 5 GB of memory by default, so lower it on a $5 VPS.

Either way, connect only dedicated, low-privilege accounts; see Handing Logged-In Websites to an Agent.

For teams and companies: most hosted controls are enterprise features. For Dots to use a member's local computer, an admin has to opt in separately; admins can also turn off custom rules entirely, and saved rules then stop applying (Dots admin guide). Grok Bot's network allowlist, audit logs and enforced Auto-review are Enterprise only, and self-serve Teams don't see those settings. Check which controls your plan has before deciding who gets access.

The trade-off

Back to Monday's email. A hosted agent stops it in three places: a model trained to tell email content apart from your instructions, a reviewer model that checks actions, and your approval before anything is sent or paid. The first two only reduce the risk; the last one depends on you reading the details before you tap. Duet won't move money between accounts at all, and Dots makes you do transfers yourself. OpenClaw by default only stops strangers who DM it directly; once the model is persuaded by an email, commands run straight on the host. Hermes has a helper model judging risk by default, but says itself that this isn't a boundary. Both get close to hosted defaults only after you follow the official hardening guides and turn on the sandbox and per-action prompts.

Hosted agents give you that isolation and those approvals, and in exchange the vendor decides the model, the data policy and the update pace. Self-hosted agents let you decide all three, and you carry the sandbox, the updates and the auditing. Neither side has solved prompt injection itself: what stops that email is approvals and isolation, not a promise from the model. Picking a side is picking which layers you want to manage yourself.

Update Log

• 2026-10-25: Reworked the post around one phishing email; added a "five layers" diagram, a Muse approval-flow diagram, a chart of Dots system card numbers, and comparison tables for credentials, approvals, data and published evidence; added each vendor's concrete isolation mechanisms, settings paths, an OpenClaw hardening example and how the CVE worked; corrected the Dots enterprise description (local computer access needs a separate admin opt-in, and admins can turn off custom rules).

References

Hosted

• Introducing Claude Duet (Anthropic)
• Get started with Claude Duet (Claude Help Center)
• Scaling Managed Agents: Decoupling the brain from the hands (Anthropic)
• How we built Claude Code auto mode (Anthropic)
• Introducing Muse (Meta)
• How We Built Safety Into Muse (Meta AI Research)
• Introducing dots (OpenAI)
• Dots privacy, security, and safety FAQs (OpenAI Help Center)
• Control your dot, Connect computers and apps to your dot, Manage dots permissions and capabilities (ChatGPT Learn)
• GPT-6 Astra System Card: dots appendix (OpenAI Deployment Safety Hub)
• Sam Altman unveils "dots" (CBS News, plan pricing)
• Grok Bot, Create and manage Bots, Computer and apps, Approvals, security, and privacy, Grok Bot security, Security FAQ (SpaceXSI / xAI)

Self-hosted

• openclaw/openclaw, Why OpenClaw
• OpenClaw docs: Trust model, Sandboxing, Exec approvals, Hardened baseline, Secrets and storage, Running the audit, DigitalOcean install
• NousResearch/hermes-agent, SECURITY.md, Hermes security guide
• GHSA-g8p2-7wf7-98mq (OpenClaw advisory), OpenClaw RCE vulnerability: CVE-2026-25253 (runZero), OpenClaw Auth Token Theft Leading to RCE (SonicWall)

Incident reports

• Meta Muse exposes users' personal and business secrets when they share conversations (Ars Technica)
• Amazon blocks Meta's Muse AI assistant (GeekWire)
• Meta Tests Muse AI Agent Calls That Are Actually Made By Humans in a Call Center (404 Media)
• Anthropic takes on Grok Bot, Meta's Muse, and OpenAI's Dots (The Decoder, Grok Bot launched in August)