Dots, Grok Bot, Muse, and Claude Duet: the new always-on agents

What changed

Up to now, AI has mostly worked the way a chat window works: you ask, it answers, the conversation ends when you close the tab. Starting in the fall of 2026, the four major labs each shipped something different, an agent that gets a goal, runs on its own cloud computer, and keeps going even after you've put your phone down. It checks in when it needs a decision, and hands you results when it's done.

That's a real shift, not just a feature update. It's also why this topic deserves a closer look than "which chatbot is smartest." These things can send emails, spend money, and touch accounts you've connected, while you're not watching. Four versions launched within about six weeks of each other:

• OpenAI's Dots — announced at DevDay, September 29, 2026
• xAI's Grok Bot — early beta, August 11, 2026
• Meta's Muse — launched September 8, 2026
• Anthropic's Claude Duet — research preview, October 21, 2026

OpenAI's Dots

A Dot is an always-on agent that keeps pursuing a goal you've given it, between conversations, not just during one. Each Dot gets its own cloud computer and its own browser, and it keeps working after you log off entirely.

How you use it: you give a Dot a goal, connect whatever apps it needs, set boundaries on what it's allowed to do without asking, and it brings results back for your review. You can reach your Dots through ChatGPT, Slack, or Microsoft Teams, with texting planned.

Where it's headed: OpenAI has said the long-term plan is teams of Dots working together on different parts of the same goal.

Access: rolling out to ChatGPT Pro and Business Premium accounts in eligible markets first, with an admin-enabled beta for Enterprise, Education, and Healthcare plans. One report also mentions a new $500/month tier aimed at heavier, more autonomous use.

xAI's Grok Bot

Grok Bot works from its own persistent cloud computer. It can open a browser, edit files, run terminal commands, and use the same MCP connectors covered in topic 5.

What's different about it: instead of connecting to your tools through official APIs, Grok Bot signs into your existing software and uses it the way a human would, moving a cursor, clicking buttons, typing into fields. That makes it compatible with almost anything with a login screen, but it also means it's operating with a real, logged-in session to whatever it touches.

Multi-bot setup: you can organize several bots by department, sales, finance, operations, and have them hand work to each other, checking in with you mainly for approvals and key decisions.

Access: early beta, limited to SuperGrok Heavy and Cursor Ultra/Teams Premium subscribers. Its distribution is closely tied to Cursor, the coding tool xAI has been folding into its agent lineup.

Meta's Muse

Muse is built to act, not just talk: send an email, book travel, fill out a form, make a purchase, and keep going after you've closed the app.

The safety model is the most distinctive part. Muse and your connected data and credentials run inside a dedicated "Muse Secure VM," separate from the rest of your device. A second agent, called Sentinel, has to separately approve anything Muse tries to send out to the internet. Sensitive actions, sending an email, completing a purchase, still require your explicit go-ahead.

Access: US-first rollout on iOS, Android, web, and WhatsApp. A basic version is free; paid tiers run $20/month and $100/month for heavier use. Meta has said smart-glasses support and an encrypted version are both planned.

Worth knowing: Muse runs on a model Meta calls "Muse Spark," which by most accounts trails the leading models from Anthropic and OpenAI. Meta itself has said the agent "will sometimes make mistakes," and has a more capable model in development internally. Treat Muse as the most action-happy of the four, and keep an eye on anything it's allowed to do with payments or personal data.

Anthropic's Claude Duet

Duet is a standalone app where Claude works proactively instead of waiting to be asked. It compiles a morning briefing from whatever apps you've connected, monitors those services through the day, and messages you only when something actually needs a decision.

What you can hand it: scheduling meetings, building dashboards, running financial or sales forecasts, prototyping, building web apps. Like the others, it runs on its own virtual machine and browser, so the work continues even with your device off.

Safeguards, and this is the most conservative design of the four:

• Duet asks for approval before sending a message, making a payment, signing a document, or deleting anything. It shows the plan and waits.
• Trading securities and moving money between accounts are off-limits entirely, even with your approval.
• A dedicated classifier blocks Duet from sharing sensitive data outbound, credit card numbers, government ID numbers, that kind of thing, regardless of what it's asked to do.

Access: waitlisted research preview for Pro and Max subscribers in the US, on iOS, Android, and claude.ai. Built around Claude Opus 5.5. Not yet available on Team or Enterprise plans. There's no separate charge during the preview, but background work counts toward your existing plan's usage limits, and it can burn through those faster than chat alone.

How the four actually differ

Security, across all four

These agents are more useful than a chatbot for exactly the reason they're riskier: they can act on your behalf while you're not watching. A few things apply regardless of which one you use.

• They inherit the "lethal trifecta" risk from topic 2. An agent with access to your data, exposure to untrusted content (email, web pages, calendar invites), and a way to send data outward is the exact setup prompt injection is built to exploit. An always-on agent is exposed to untrusted content constantly, not just during a chat you're actively watching.
• Read what you're actually authorizing. "Connect your email" and "approve autonomous actions on your email" are very different grants. Dots, Grok Bot, Muse, and Duet all let you dial autonomy up or down, use the lower setting until you trust the pattern of what it does.
• Grok Bot's login-and-click approach is worth extra caution. Because it operates with a live, logged-in session the same way a person would, there's no API-level scoping, it has roughly the same access a human user with your password would have.
• Favor hard limits over promises. Claude Duet's refusal to move money or trade securities, no matter what's approved, is a stronger guarantee than "it will ask first." Approval prompts can be worn down by habit; a hard-coded no can't.
• These are all still early. Three of the four launched as betas or research previews. Expect rough edges, unexpected behavior, and fast-changing permission models. Don't hand a brand-new agent product your most sensitive accounts on day one.
• Usage adds up in the background. Several of these count agent work against your normal plan limits. Keep an eye on what's actually running, an agent you forgot about is still doing things, and still using your quota.

How to pick

• You're not technical and want to delegate work involving your files. Claude Cowork is the easiest path.
• You want an agent that can shop online, fill out forms, navigate websites. ChatGPT Operator.
• You want maximum privacy and control, are willing to spend a weekend setting it up. OpenClaw with a local model.
• You're building agents for a business and need enterprise support. Claude or ChatGPT, on Enterprise plans.

The intermediate take: where agents actually deliver value

Agents shine when the task has multiple steps, requires pulling info from different places, recurs on a schedule, or would cause you to context-switch a dozen times. Examples: weekly status reports pulling from Slack, calendar, and project files. Inbox triage that drafts replies for review. Lead enrichment that takes a new contact and fills in their company info. Agents are overkill for one-off tasks. Chat is faster for those.

The advanced take: the agent ecosystem in 2026

The agent space is moving fast and the lines are blurring. A few patterns are clear:

• MCP is becoming the standard. Anthropic's Model Context Protocol is now supported by major platforms. Build skills and connectors to MCP and they'll work across tools.
• The biggest practical limitation is reliability, not capability. Agents can do a lot, but they fail in unexpected ways. Approval mode plus human review still beats fully autonomous in most real workflows.
• Security is the real frontier. Prompt injection, connector chaining, and lethal trifecta attacks (see topic 15) are the live issues. Mature deployments isolate agents heavily.

For small businesses in 2026, the practical move is: pick one (Cowork for non-devs, OpenClaw for tinkerers, Operator for web tasks), automate one workflow, measure the time saved, then expand. Don't try to "deploy AI agents across the organization" as your first move. That's how things break.