What is the debate over personal AI agents really about?

Within about two months, personal agents stopped being a hobby for people comfortable with a terminal. Meta launched Muse on September 8, 2026, OpenAI launched dots on September 29, and Anthropic opened a preview of Claude Duet on October 21. A personal agent differs from a chatbot because it keeps working in the background and acts for you: it reads your mail, fills in forms and buys things. The open-source OpenClaw showed the appetite for this earlier in the year, and Reuters describes Muse as modelled on it.

People are not really disagreeing about whether the technology is impressive. They disagree about who should hold that much access, and how much trust the current systems have earned. Four positions come up again and again.

The four positions

The case for managed agents

Mark Zuckerberg put the ambition most plainly in a 2025 letter, promising personal superintelligence and contrasting it with AI aimed at automating work centrally. In a longer essay this summer, quoted by PBS, he wrote of an agent that works "24/7 on your behalf." PBS adds that critics derided the document as fantastical.

The practical argument is about isolation. Most people will not set up a container on their own laptop, so companies offer one. Meta says each Muse runs on a dedicated virtual computer, with a separate program called Sentinel approving what reaches the internet. Anthropic says Duet runs on its own cloud computer, never directly sees passwords or sign-in tokens, and refuses to trade securities or move money between accounts even with approval. OpenAI points to a read-only mode that stops a dot from controlling your browser or computer when you are away. Those are vendor claims. Some have technical documentation behind them, and The Batch's review credits Meta for assuming the model will be fooled, while noting that Meta has not published accuracy figures for its injection defenses.

The case for running it yourself

The local camp's argument predates agents. In 2019, the research lab Ink & Switch described local-first software, listing ideals such as working offline, keeping your data for the long term and retaining ultimate ownership. In their account, cloud apps leave you with a copy that is merely a cache of what the server holds.

OpenClaw and Hermes Agent bring a version of this to agents. They are open source, you choose the model, and their memories are stored as plain files you can read and edit. Our comparison of the two covers the details.

The honest weakness is that self-hosting moves the risk onto you. A local agent that calls a cloud model still sends your data to that provider. And OpenClaw's own documentation concedes there is no perfectly secure setup. Researchers have found exposed keys and malicious add-ons around it, which we detail in what can go wrong with a personal agent.

The case that access itself is the problem

Meredith Whittaker, president of Signal, made the sharpest version of this argument at SXSW in March 2025, before most of these products existed. Booking a concert, she said, means the agent reaches your browser, card, calendar and messages, across your system "with something that looks like root permission," meaning near-total control of the machine, and likely in unencrypted form on a cloud server. That, she argued, breaks the separation between applications that keeps your Signal messages private.

Developer Simon Willison gave the same worry a tighter shape in 2025 with his lethal trifecta: an agent with access to private data, exposure to untrusted content and a way to send data out can be tricked into stealing from you. A useful personal agent has all three almost by definition. Companies reply that they can put a gatekeeper between the three, and critics reply that such a gatekeeper has yet to be proven at scale.

The case that they haven't earned it yet

The fourth position is about evidence, and it applies to every vendor. TechCrunch's launch piece on Muse lays out Meta's history of privacy penalties with the US Federal Trade Commission and asks directly whether consumers will trust it. Reuters reported that Meta employees testing Muse had flagged flaws, including an agent that got around guardrails and exposed personal iCloud photos, though others found it very useful. Meta's Vishal Shah told Reuters the product had reached "the minimum bar," and that no one can promise there will never be a mistake.

Business models feed the suspicion. Meta says Muse conversations do not go to its ad systems, but Meta AI chief Alexandr Wang told CNBC the company is weighing a cut of agent shopping, and interactions train its models unless you opt out. TechCrunch also highlights another agent, Instinct, whose terms surprised testers with a broad, perpetual licence over their materials.

Anthropic's product faces related doubts. The company itself says Duet "might misread a thread or miscalibrate what's urgent" and it keeps Duet behind a US waitlist. CBS notes that security professionals warn users to limit what they share with such agents. A hands-on review at Every, written with early access, liked it as a professional tool but found gaps, and the same writer says his Dot recently lost tasks.

For Canadians, this debate is already practical. Muse reached Canada on September 18, reports iPhone in Canada, and CNBC reports Zuckerberg telling analysts that more than 10 million people in the US and Canada have set up an agent. That figure comes from the company and counts setups, not sustained use.

How can you decide whether you want one?

Start with the job, not the product. If what you want is a morning summary, that needs read access only, so a much smaller risk than an agent that can send and buy. Grant the first, live with it for a few weeks, and see whether you would actually miss it.

Next, decide whose failure you would rather deal with. With a managed service, you depend on a company's security and its privacy promises, and you can mostly leave the engineering to them. With a self-hosted agent, the control is yours, and so are the updates and the mistakes. Neither makes the core problem go away, because neither stops a model from being misled by what it reads.

Finally, weigh the reversibility of what it can touch. A wrong calendar entry costs a minute. A sent email, a purchase or a leaked file costs more. Our comparison of current agents sets out what each one can do and what it asks of you.