Skip to content

Choosing a Personal AI Agent: Hosted Duet, Muse, Dots and Grok Bot vs Self-Hosted OpenClaw and Hermes

Oct 24, 20261 min
Home›ai
TL;DRDuet, Muse, Dots, Grok Bot, OpenClaw and Hermes can all work through your email and accounts in the background. They differ in who holds the computer, the credentials, the approvals and the data. Hosted agents save setup but leave model and data policy to the vendor; self-hosted ones let you swap models and read the source, but you have to turn the sandbox on yourself.
#ai-agent#personal-agent#openclaw#hermes-agent#security#self-hosted

Look up & save

Loading dictionary…

🌏 中文版

Between August and October 2026, xAI, Meta, OpenAI and Anthropic each launched the same kind of product: a personal AI agent that works in the background without waiting for you to ask. Each has its own cloud computer, can reach your inbox and calendar, and keeps going after you close the app. On the open-source side, OpenClaw and Hermes Agent were already doing the same thing. This post answers one decision: should you use a vendor-hosted agent or run one yourself?

What the six agents are

AgentMade byHow you use itCost and access (checked 2026-10)
Claude DuetAnthropiciOS, Android, claude.aiResearch preview, US Pro/Max waitlist, included in the plan
MuseMetaApp, WhatsAppFree tier plus paid plans, mainly US for now
DotsOpenAIChatGPT, SlackPro and Business Premium plans (CBS reports from $100/month and $20); the first dot is included
Grok BotxAIDesktop, mobilePremium $30, Super $100, Ultra $200 per month
OpenClawIndependent foundation, MITYour own computer, 20+ chat channelsFree software; you pay for model APIs and hosting
Hermes AgentNous Research, MITTerminal, Telegram, Discord and moreFree software; optional Nous Portal subscription

The first four are hosted: you get an app, and the computer, model and approvals all sit with the vendor. The last two are self-hosted: the code is in your hands and you decide where it runs. This site has a guide to each, in Chinese: OpenClaw docs guide and Hermes Agent guide.

For readers in Taiwan, the first question is whether you can use them at all. Duet is a US-only Pro/Max waitlist, Muse is mainly US, and Dots is limited to what OpenAI calls eligible markets, so check on each vendor's help page whether your region is open before signing up. OpenClaw and Hermes install with a single command and have no waitlist or region list.

Five questions to ask

1. Which computer does it run on?

All four hosted agents give you a vendor cloud computer that keeps running when yours is off. Duet uses a virtual machine with a browser. Muse gives each user an isolated Linux VM. Dots has its own cloud computer and needs separate permission to use your laptop. Grok Bot's computers are operated by Cursor, and its security docs say on-premises deployment is not supported.

OpenClaw and Hermes run on a machine you choose. OpenClaw's Gateway sits on a laptop or an always-on host, and state, memory and credentials stay there. Hermes has six terminal backends, including local, Docker, SSH and Modal; its README says a $5 VPS is enough, and it has a built-in scheduler, so it can also stay resident.

So "always running in the background" is not something only hosted agents offer. The difference is whose computer it is.

2. Who holds the credentials?

The shared hosted-agent pattern is that the model never sees your passwords. Duet handles credentials following the Managed Agents design. Muse gives the agent only surrogate tokens and swaps in the real credential at the network boundary. Dots pauses at a login and has you type into a secure form. Grok Bot keeps connector tokens on its backend and hands the computer back to you for logins, two-factor and payment.

These protections have limits. The Dots FAQ says they do not cover passwords you paste into a chat or document yourself.

OpenClaw keeps credentials on your own machine and handles protected secrets with handles and egress substitution. But tools in the main session run directly on the host by default, so you have to configure a sandbox to get isolation.

3. Who decides whether an action is allowed?

Every hosted agent defaults to asking before it sends, pays or deletes. The difference is who enforces it. Muse sends approvals to Sentinel, a component separate from the agent, and the approval dialog does not pass through your conversation with Muse. Dots and Grok Bot use a separate review model (Auto-review). Duet reuses the auto mode classifier from Claude Code. Custom rules in Dots cannot switch off core requirements: changing a password and moving money always come back to you.

On the self-hosted side you carry this layer. OpenClaw enforces tool policy in code and makes unknown senders pair first, but sandboxing and exec approvals are off by default; its docs describe the default as a trusted single-operator assistant. Hermes documents command approval, DM pairing and container isolation.

4. Where does your data go?

For hosted agents, the data policy is the vendor's.

  • Muse: In its safety write-up Meta says conversations are not shared with its ad systems, though browsing can still indirectly influence the ads you see; de-identified interaction trajectories are used for training by default and you have to opt out in settings. The current architecture also does not stop Meta from accessing your VM when needed; a fully encrypted Confidential VM is planned for later this year.
  • Dots: Per the FAQ, on personal plans "Improve the model for everyone" controls whether your dots' work is used to improve models; even with it off, human review may occur in safety-related cases. You cannot view or edit individual memories, only delete the whole dot.
  • Duet: Per its help page, it reuses your Claude account's memory, skills and connectors and can search past chats, governed by the "Search and reference chats" setting.
  • Grok Bot: The docs say that with Privacy Mode on, data is not used for training. Cursor picks the models, which may include third-party ones.

OpenClaw, by default, contacts nothing except a daily version check; your prompts go only to the model provider you configure.

5. Can you swap the model?

The four hosted agents are tied to their own models: Duet is built on Claude Opus 5.5, Muse uses Muse Spark, Dots uses GPT-6 Astra, and Grok Bot has no user-facing model picker.

OpenClaw and Hermes both let you change model provider. OpenClaw can even plug in vendor harnesses such as Codex or Claude Code as plugins. The flip side of that freedom is that the model's safety behavior changes with it, and the vendor-built protections on top become yours to supply.

How much you can check

A safety promise can't be verified; what you can check is what the vendor publishes.

OpenAI's Dots system card appendix gives the designs and results of its own tests: 16,600 attack emails in the bulk test produced no scored success, and in the test where permissions were revoked mid-task, dots passed 45 of 49 episodes. The same document admits moderate scope violations and says known vulnerabilities are still being worked on.

Meta's safety write-up publishes the most detailed architecture: isolated container, Sentinel, surrogate tokens. It gives no attack success rate, but its bug bounty is open to everyone, up to $300,000.

Anthropic's announcement says it will publish more on Duet's safety design. What can be referenced today is the Claude Code auto mode write-up, which reports that in Anthropic's own Claude Code tests the classifier let through 17% of real overeager actions. That is a Claude Code number; Duet's own performance will need its own data.

Grok Bot's security docs list controls layer by layer and say Cursor's parent company Anysphere holds ISO/IEC 27001 and 42001, with Grok Bot in scope. Most of those controls are Enterprise-only.

The biggest difference on the self-hosted side is that you can read the source. OpenClaw and Hermes are both MIT-licensed, and OpenClaw also publishes a trust model and security advisories. Open code is not audited code: you have to review it yourself or trust someone who did.

Limits: what has already happened

The documents from OpenAI, Meta, Anthropic and xAI all say prompt injection can only be reduced, and none claims to prevent it. What has happened so far:

  • Muse: Shared-conversation links could be enumerated; researchers found 6,800 through passive DNS, and the sample included a loan application and an unreleased revenue review. Meta paused sharing (Ars Technica). Amazon blocked Muse under its terms of use, saying the agent does not identify itself and appears to store customer credentials; that is Amazon's account (GeekWire). Internal documents obtained by 404 Media show Meta testing human agents placing calls, with testers told only afterwards; Meta says public launch will come with disclosures.
  • Dots: In the system card appendix's chained-task test, doubling the number of tasks roughly doubled the share of flagged scope violations. OpenAI classes them as moderate, such as carrying information into an unrelated task.
  • Grok Bot: The docs say Bots on one account share a single computer, including browser logins and files, so there is no isolation between Bots.
  • OpenClaw: CVE-2026-25253, a high-severity one-click remote code execution bug (runZero), patched starting in version 2026.1.29, with stricter origin validation added later (SonicWall).
  • Duet: The announcement itself says it may misread a thread or misjudge urgency, and it checks accounts only every few hours.

Choosing: what to do tonight

You want to try one and already pay for ChatGPT or Claude: pick the one your subscription belongs to; Duet and Dots are both included in the plan. Do four things the first night:

  1. Connect read-only permissions first. Muse authorizes read and write separately, and Dots plugin permissions can be set separately too. Let it run a few days before you allow writes.
  2. Find the training switch in settings (the training switch in Muse's settings, "Improve the model for everyone" in Dots) and decide whether to turn it off.
  3. Type passwords only into the login form it shows you; never paste them into a chat or document.
  4. Keep send, pay and delete on per-action approval. Don't pre-approve just to save a few clicks.

You want to control your data and model: pick OpenClaw or Hermes and put it on a dedicated machine or VPS, not your everyday work computer. For OpenClaw, follow the hardened setup: set agents.defaults.sandbox.mode: "all" to turn the sandbox on, put Tailscale or an identity-aware proxy in front of the Gateway, keep the DM policy on pairing, and run openclaw security audit --deep after installing. For Hermes, choose Docker or a remote sandbox as the terminal backend. Connect only dedicated low-privilege accounts; for how, see How to hand a logged-in website to an agent (in Chinese).

A team or company: most hosted-agent controls are Enterprise features. In Dots, local computer access and custom rules are off by default for Enterprise until an admin enables them. In Grok Bot, network allowlists, audit logs and enforced Auto-review are Enterprise-only, and self-serve Teams defaults to allowing all network access. Check which controls your plan has before deciding who gets access.

The trade-off

Hosted agents give you vendor-built isolation and approvals with little setup, and in exchange the vendor decides the model, the data policy and the update pace. Self-hosted agents let you decide all three, and you carry the sandbox, the updates and the auditing. Neither side has solved prompt injection: when an always-on agent reads a malicious email, what stops it is approvals and isolation, not a promise from the model. Picking a side is picking which layers you want to manage yourself.

References

Hosted

Self-hosted

Incident reports

Related

Nine Self-Hosted Personal Agents, One Security Question: Where Does the Execution Boundary Go?1 minChoose an AI Security Practice Environment: Local, Cloud, CTF, or Authorized Targets1 minCan an AI “False Positive” Decision Close an Alert?1 min