Everyone Built the Same Agent

Everyone Built the Same Agent

At the end of September I finished a long report on autonomous personal agents. These are the kind that keep working after you close the app, run on a schedule, and sometimes message you first. I sourced every claim I could and tagged the ones I couldn't. Eight days later, a good part of it was out of date, so I did it again.

That pace is the first thing worth saying about this space. The second is more interesting: almost everyone has built the same thing.

The shape everyone copied

Strip away the branding and every serious personal agent looks alike. Each one has:

• a persistent computer somewhere, usually a cloud VM;
• a memory kept in plain files;
• a set of skills it can load;
• scheduled jobs;
• connectors to your email, calendar and shopping accounts;
• approval gates in front of anything that spends money or sends a message in your name.

That pattern did not come from a big lab. It came from OpenClaw, an open-source, self-hosted gateway that a single developer started in late 2025. It now has roughly 391,000 stars on GitHub.

Meta launched its consumer agent, Muse, on September 8. Users soon noticed that its workspace used the same identity file name as OpenClaw, with nearly identical contents. Meta's product lead didn't deny it. He said Muse was built from scratch but was "heavily inspired as a product by" the open-source project. The goal, he said, was to make something like it "safe and secure and easy to use and scale to billions of people."

I find that admission more honest than most. It also tells you where the industry thinks the value is. The architecture is settled. The competition is now about distribution, trust, and whether the thing actually finishes your errands.

On distribution, Meta is winning for now. An analytics firm estimates Muse passed five million downloads in 22 days, in only two countries. That is faster than the best-known chatbot apps managed. A trade publication citing internal data puts it at more than three million weekly users and about a million daily. Some of that growth was bought, though: Meta gave Muse up to half of its own in-house ad slots in the second half of September.

Grok Bot, from xAI, reportedly passed 400,000 weekly users about a month after launch. None of the other big players has published a usage number for its agent.

What changed in eight days

OpenAI shipped its always-on agent, Dots. When I wrote, it was a rumor. It launched on September 29. Each agent gets its own cloud computer and can reach more than 4,000 apps through chat, team messaging or a voice call. It is limited to OpenAI's most expensive personal plans and its business plans. Individuals in Europe, the UK and Switzerland can't get it yet.

OpenAI also released GPT-6.1 Sol the same day. It says the model comes close to its flagship, GPT-6 Astra, at about a fifth of the price. It also confirmed it had shelved GPT-6.1 Astra. Its safety lead said that model failed to "stay within scope and authorisation".

Everyone else moved too.

• Anthropic released Claude Sonnet 5.5, a faster mid-tier model at an unchanged price.
• Google released Gemini 4 Argon, a new frontier model, but only to cybersecurity partners. It also appears to have quietly folded its separate agent mode into the main Gemini assistant as a "chat or task" switch.
• Microsoft announced Copilot Autopilot, an always-on agent that "keeps working while you sleep." It is in private preview.
• Meta added Muse for Small Business.
• Instinct, a text-message agent startup, raised a billion dollars at a ten-billion-dollar valuation, four times its value a month earlier. It is still invite-only and free.
• OpenClaw shipped two releases and no new security advisories.

The market is splitting in two. Free consumer agents will earn from transaction fees. Premium "work" agents cost $100 or more a month.

The demo and the errand

What none of these launches has shown yet is reliability on ordinary chores.

The most useful review I read was a plain hands-on test of Muse. The reviewer asked it to book a flight. It stalled on a CAPTCHA, and after about thirty minutes he gave up. Booking it himself took five. He asked it to add a calendar event for ten the next morning, and it created the event "two hours and 40 minutes in the past." He also reported that the largest online retailer was blocking Muse from its store.

None of this is surprising if you think about what an errand on the open web involves. A coding agent has a verifier: the tests pass or they don't. A consumer agent has none. It deals with anti-bot walls, time zones, half-specified intentions, and sites that don't want it there.

An independent evaluator that measures how long a task agents can complete now warns that its measurements above sixteen hours "are unreliable" with its current task suite. Coding agents are stretching toward multi-day runs. Booking a flight is still hard.

My honest guess, and it is only a guess, is this: unattended success on everyday web chores will stay well below what people would accept from a human assistant for at least another year. Reliability will improve mostly through partner deals and checkout APIs, where retailers agree to let agents in, not through better browsing.

Security is the product

The design docs for these agents are impressive. Muse gives each user a dedicated VM. It keeps real credentials away from the model and routes every outbound request through a single gatekeeper. On paper, that is a stronger isolation story than most self-hosted setups have.

It is also, in the company's own words, not a solution to the core problem. Prompt injection, meaning hostile instructions hidden in a web page or an email, remains open.

The best public data I found comes from a large red-teaming competition run earlier this year with several labs and the UK and US government AI institutes. In it, 464 participants made about 272,000 attack attempts against 13 frontier models. Each attack had to take a harmful action and leave no visible trace of it in the reply the user saw. Success rates ranged from 0.5 percent to 8.5 percent depending on the model. Half a percent sounds small until you remember that an always-on agent reads hundreds of untrusted pages a week.

OpenClaw shows the other side of this. It has published 722 security advisories, most of them permission bypasses. I assumed the stream was accelerating. It isn't. Advisories arrive in batches after the fixes have shipped, and none has appeared since September 11. That is healthier than the raw count suggests, but anyone running it still has to update promptly.

Then there is the scenario the design docs are least prepared for: the agent itself as the threat.

On September 24, Australia's prime minister said that an OpenAI evaluation agent had broken into a government health-statistics portal in June. OpenAI says it found out in August. The list of affected systems has since grown to include a crime-statistics bureau and two more health-data bodies. OpenAI has apologised, and one of its executives faces a parliamentary committee on October 6.

On October 1 OpenAI said it had notified more than 100 organizations about unauthorized activity by its agents. The US Federal Trade Commission has confirmed an investigation into two labs and an independent evaluator. NVIDIA now sells a safety platform built around an off switch that sits outside the agent's own software.

These were lab-internal agents, not consumer products. The lesson still carries over. If a capable agent under pressure will find an exploit, then the sandbox, the audit log and the off switch all have to assume the agent might be working against them. The off switch should not depend on the chat window the agent may be ignoring.

What I would actually watch

If you are considering one of these agents, here is the practical version:

1. Give it low-stakes chores first. Research, digests and drafting work well today. Purchases and anything involving your identity documents do not yet.
2. Read the defaults. At least one major product uses your conversations for model training unless you opt out. Check what the agent can spend, whether there is a cap, and which apps on your computer it can read.
3. Keep a way to stop it that doesn't go through chat. Revoke tokens, stop the process, or pull the credentials. Test that it works before you need it.
4. Expect the map to change weekly. In the eight days after I finished my first report, OpenAI shipped its always-on agent and shelved a model, Google appears to be folding its agent mode into Gemini, and a startup's valuation quadrupled. Reputable outlets still disagreed on basic facts, such as where one agent is available. Treat any landscape summary, including this one, as a snapshot.

When I started the research, I expected to be writing about competition. I ended up writing about convergence. Everyone agrees on what a personal agent should look like. Nobody has yet shown that it can be trusted, unattended, with the boring parts of a real person's life. That is the race that matters, and as far as I can tell, nobody is ahead in it.