The AI agent market has officially entered the awkward teenage years.
The demos are impressive. Agents can browse the web, send email, fill out forms, write documents, book travel, run code, manage files, and operate software that doesn’t even have an API.
They can also do things you absolutely did not intend them to do.

That is the part of the story that gets considerably less screen time.

Over the last year, we went from “AI that answers questions” to “AI that can actually do stuff.”
OpenClaw, Muse, Grok Bot, Claude Cowork, ChatGPT Work, Gemini Spark, Manus and Hermes Agent all take slightly different approaches to the same fundamental problem:

How much autonomy are you willing to give software that can act as you?

And that turns out to be a much more interesting question than which model scores highest on a benchmark.

The new AI benchmark is blast radius

For years, we compared AI models on intelligence.

How well does it code?
How well does it reason?
How well does it summarize a 200-page PDF?

With agents, the question changes.

An agent doesn’t just generate an answer.
It gets credentials, opens a browser, reads your files, sends messages, executes commands and potentially spends your money.

So the important question becomes:

What happens when the agent makes a mistake—or gets tricked?

This is where the current crop of agents diverges dramatically.

Some are designed around containment. They run inside isolated virtual machines, use surrogate credentials and require approval before consequential actions.

Others essentially say: “Here is a very powerful AI. Good luck.”

That distinction matters more than whether Agent A is 7% better at a benchmark than Agent B.

OpenClaw: Give the AI a computer (and hope for the best)

OpenClaw is probably the most interesting agent in the category—and also the one that makes security people reach for their blood-pressure medication.

It is open source, MIT licensed, model agnostic and extremely flexible. It runs on your machine, works through messaging platforms such as Signal, Telegram, Discord and WhatsApp, can execute shell commands, manipulate files, run scripts and remember things across sessions.

In other words, it doesn’t just talk to you.
It operates your computer.
That is exactly why people love it. It is also exactly why it is dangerous.

OpenClaw’s permissions are largely your permissions. If you give it access to your machine, accounts and credentials, a successful prompt injection can potentially turn into a very large incident.

And the security history is not theoretical.

Koi Security reported 341 malicious skills in an audit of 2,857 ClawHub skills. Cisco researchers demonstrated malicious skills capable of data exfiltration. OpenClaw also had a one-click remote-code-execution vulnerability, CVE-2026-25253. Then there is the particularly uncomfortable detail: OpenClaw 2.0 shipped with its new sandbox disabled by default, while secrets were stored unencrypted at rest.

This is the classic open-source tradeoff:
You get enormous power and control.
You also inherit the responsibility for making that power safe.

For an experienced engineer running OpenClaw inside a properly isolated environment with a dedicated account?
Interesting.
For your parents, your finance team or the average person who thinks Docker is a brand of whale?
Probably not.

Muse: What if we actually designed the agent around security?

Meta’s Muse takes almost the opposite approach.
Instead of giving an agent access to your computer and asking you to figure out the security model, Muse starts with containment.
Every user gets a dedicated Secure VM.
A separate Sentinel system controls what can leave that environment.
Muse uses surrogate credentials instead of exposing your actual credentials to the agent.

And when something consequential happens—such as sending an email or completing a purchase—it asks for approval.
The architecture can essentially be summarized as:

Muse proposes. Sentinel permits.

That is a much more interesting security model than simply adding another confirmation dialog to an otherwise unrestricted agent.
Muse can handle the consumer tasks people actually want from an agent: email, travel, bills, forms and purchases.
The catch is that Muse is brand new.

It launched in September 2026. The security architecture looks compelling on paper, but independent validation is still limited. It is also US-only, Meta-operated and cannot be self-hosted.

And there is another uncomfortable question:
Are you more comfortable giving an AI agent your credentials—or giving Meta a complete picture of your digital life?

That’s not a technical question.
That’s a trust question.

Grok Bot: The agent that wants to be your employee

Grok Bot takes yet another approach.
Instead of writing integrations, you can teach it what to do by recording yourself performing a task.

Do it once.
The Bot learns the workflow.
Then it can repeat it.
This is potentially huge.

A lot of business software still exists behind terrible web interfaces with no API. If an AI can operate a browser like a human, suddenly all those ancient internal dashboards become automatable.

But there is a catch.
Actually, several.

Grok Bot uses one shared computer per account. Multiple Bots can access the same browser sessions, files and logins. That means your Bots are not really security boundaries from each other. And the documentation itself is unusually candid about this.
The security boundary is the account—not the individual Bot.

That’s a big deal.

Imagine giving five employees access to the same laptop, browser cookies, downloads folder and logged-in applications.
Now replace those employees with autonomous software.
That’s roughly the model.
Grok Bot is also very new, has little independent testing, doesn’t yet have the promised audit view, and its underlying model isn’t clearly identified for benchmarking.

It may turn out to be fantastic.
Right now, there simply isn’t enough evidence to know.

The ‘boring agents’ may actually be the interesting ones

The flashy new agents get the headlines, but the established players are taking a more conservative path.

Claude Cowork

Claude Cowork is essentially the “I want an agent, but I don’t want it owning my entire laptop” option.
It uses narrow permissions and can be limited to specific folders. It’s particularly useful for documents and office work, with integrations across services such as Google Workspace, Notion, Asana, Box and Canva.

The downside is familiar: usage limits, uneven connector support and some early rough edges.
But the philosophy is sensible:

Give the agent access to the thing it needs, not everything you own.

That should not be revolutionary.
Unfortunately, in 2026, it still is.

ChatGPT Work

ChatGPT Work is positioned around the office-deliverables problem: documents, spreadsheets, presentations, research and multi-step workflows. It also has approval mechanisms for consequential actions and stronger data controls on business and enterprise plans. Its biggest problem isn’t necessarily capability.
It’s packaging.

The terminology and plan boundaries are confusing enough that you should check the current product documentation before assuming a particular feature is included in your plan.
The underlying idea, however, is straightforward: let the agent do the boring work while keeping humans in the loop for important decisions.

Gemini Spark

If your digital life is Gmail, Google Docs, Sheets, Calendar and Slides, Gemini Spark is the obvious ecosystem play.
It gets deep access to Google’s products, supports additional connectors and can operate continuously from Google’s cloud infrastructure.
The tradeoff is also obvious.
The more deeply an agent is connected to your digital life, the more complete a picture it has of your life.

An AI reading your Gmail is useful.
An AI reading your Gmail, calendar, documents, files and browsing activity 24/7 is something else entirely.
Convenience and data concentration are becoming inseparable.

---

Manus: The agent that can build things, until it decides it is done

Manus is particularly good at one-off deliverables.
Research reports.
Presentations.
Websites.
Complex research tasks.

It runs inside a cloud sandbox with browsers, files and code and can parallelize work across many tasks.
The problem is reliability. Users have reported loops, tasks marked complete without producing what they expected and credits being consumed regardless of whether the result was useful. And Manus has had a particularly strange ownership story, including a proposed Meta acquisition, regulatory intervention and subsequent operational changes. That makes Manus an interesting product to use—but also a good reminder of something we don’t talk about enough:

Your agent is a dependency.
If an agent is deeply embedded in your workflow, what happens when its pricing changes?

Or ownership changes?
Or the company disappears?
Or your credits expire?
Agent portability is going to become a real enterprise concern.

Hermes: OpenClaw without quite as much chaos

Hermes Agent is the open-source alternative for people who want control without necessarily wanting the entire OpenClaw ecosystem. It is MIT licensed, self-hosted and supports a large number of communication channels. Its most interesting feature is the learning loop. Instead of simply remembering what you told it, Hermes can create reusable skills and refine them based on feedback. The tradeoff is that you become the platform team.

You have to maintain it. You have to pay for the model APIs.
You have to build the sandbox. You have to decide what credentials it gets. You have to debug it when something breaks. The software may be free.
Your time isn’t.

So which one should you use?

There isn’t a universal winner.
And I think that’s the wrong way to look at this market anyway.

The better question is:
How much autonomy do you need, and how much blast radius are you willing to accept?

If you want a hosted consumer/personal agent that handles personal errands, Muse is built around strong containment.
If your world is Gmail and Google Docs, Gemini Spark makes the most sense from an ecosystem perspective. If you spend your day creating documents, presentations and spreadsheets, Claude Cowork or ChatGPT Work are natural choices depending on the ecosystem you’re already using. If you want to run your own agent and are comfortable with infrastructure, Hermes is an interesting open-source option. If you want maximum flexibility and don’t mind taking responsibility for the security model, OpenClaw is extraordinarily powerful.

And if you’re already paying for the ecosystem that includes Grok Bot, it is worth experimenting with—but I’d keep the first experiments reversible.
Manus is particularly interesting for one-off research and deliverables, where the credit model matters less than having something useful at the end.

The rule I would use for every AI agent

Regardless of which agent you choose, I would start with three rules.

1. Give it a separate account – Just like a new employee in your company.

Don’t give an experimental agent access to your primary Gmail, your company’s production environment or your entire Google Drive. Create a sandbox.

2. Start read-only.

Let the agent observe before you let it act. Reading a calendar is one thing. Canceling appointments is another. Reading email is one thing. Sending email as you is another.

3. Make the first tasks reversible.

Have it organize files. Research something. Draft a document. Find information.
Don’t start with:
“Here are my credentials. Run my company.”

This sounds obvious.
It apparently isn’t.

The real AI agent arms race

The next phase of AI isn’t going to be about who has the smartest chatbot.
It’s going to be about who can safely give software more autonomy. That’s a much harder engineering problem. An LLM generating bad text is annoying.

An agent sending the wrong email is embarrassing.
An agent leaking your credentials, deleting production data, purchasing something expensive or falling for a prompt injection is an incident. And as agents become more capable, the distinction between “AI feature” and “employee with a laptop” starts to disappear.

That’s why I’m paying less attention to agent benchmark scores and more attention to boring things like:

• Where does it run?
• What is the security boundary?
• What credentials does it get?
• What happens when it is compromised?
• Can I stop/undo it?
• Can I take my data and move somewhere else?

Those questions aren’t nearly as sexy as a demo where an AI books your entire vacation.
But they are the questions that will matter when the agent is running your business at 2:00 AM.

The future of AI agents isn’t just about making them smarter.
It’s about making them safe enough to let them work while we’re asleep.