# Always-on agents hand approvals to a second model and liability to the user

URL: https://www.thedeepfeed.ai/posts/2026-10-13-always-on-agents/
Category: Agents
Published: 2026-10-13
Author: the-deep-feed
Tags: agents, always-on-agents, openai, meta, muse, dots, grok-bot, permissions, liability, pricing
Kind: deep

> Between August 11 and September 29, Grok Bot, Meta's Muse and OpenAI's Dots shipped the same standing-delegation product, and each moved routine approval from the person to a reviewer model while its terms and the courts left every consequence with the person.

## TL;DR

- Between **Aug 11** and **Sep 29**, SpaceXAI's **Grok Bot**, Meta's **Muse** and OpenAI's **Dots** shipped one product shape: a vendor-hosted computer per user, agents that keep working after the app closes, and work that starts without a prompt.
- Routine approval moved from the person to a second model. OpenAI's **Auto-review**, Meta's **Sentinel** and Grok Bot's Auto Review screen actions before they run; people keep a short list of hand-backs, such as password changes and money transfers on Dots.
- Billing did not converge. Dots ships inside ChatGPT Pro tiers priced at **$100, $200 and $500** a month, Muse sells **500M tokens a week for $20**, and Grok Bot carries usage that sits outside the Grok and Cursor plans it ships with.
- Liability converged on the user. Muse's terms make the user **solely responsible** for whatever the agent does and cap Meta's exposure at the greater of **$250** or 12 months of fees, and the **Ninth Circuit** held in August that the user, not the AI company, accessed Amazon.
- Muse's first five weeks produced a disputed Messages read, a macOS **0-day**, a **6.8 GB** filesystem export, dossiers on vulnerable groups, an Amazon block and an Apple permissions change.

On September 29, OpenAI put a new noun into ChatGPT. [Dots](https://openai.com/index/introducing-dots/) are "always-on agents built to handle everything," each "powered by GPT‑6 Astra," each with "their own cloud computer," able to "work towards your goals 24/7." Three weeks earlier Meta had launched [Muse](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/), which "keeps working after people close the app, and comes back when something changes or when it needs approval." Four weeks before that, the Grok team had shipped [Grok Bot](https://x.ai/news/introducing-grok-bot), whose bots "have their own computer" and "only come back when something needs your approval."

Three companies, one product shape inside seven weeks. The request-and-response chatbot, where a person types and the model answers and the session ends, is no longer the frontier consumer product. The frontier product is a standing delegation: a named agent with a goal, a computer of its own and permission to act while its owner is somewhere else.

This publication's starting hypothesis was that the permission, billing and accountability models for standing delegation are being invented product by product. The documents support half of that. Permissions are converging fast, on nearly identical architecture and vocabulary. Billing is diverging, because nobody has worked out what an hour of an agent's absence should cost. Accountability is converging too, but on a single answer that the product design works against. The approval has moved from the person to a second model. The liability has stayed with the person.

# Four products, one shape

The launches cluster tightly. Grok Bot entered beta on August 11 for SuperGrok and Cursor subscribers and [widened to every SuperGrok, Cursor Pro and Cursor Teams plan](https://x.ai/news/grok-bot-more-plans) on August 26; an [enterprise release](https://x.ai/news/grok-bot-for-enterprise) followed on September 3, claiming "thousands of organizations" including Legora, Supermicro and ServiceTitan. Muse launched in the U.S. on September 8 on iOS, Android, the web and inside WhatsApp, powered by Meta's Muse Spark model. Andon Labs opened [Pion](https://andonlabs.com/blog/why-we-built-pion), "an agent designed to run any company fully autonomously," as a waitlisted research preview on September 14. Dots followed at OpenAI's DevDay on September 29.

On Hacker News the Dots post drew 770 points, Muse 666 and Pion 497. An August 27 post linking the open-source [OpenExecutive](https://github.com/SenteLabsAI/OpenExecutive), titled "CEO fired developers to make room for AI. Developers create open source AI CEO," outran all three at 1,035.

| Product | Opened | Who hosts the agent | Model | Price | Availability at launch |
|---|---|---|---|---|---|
| Grok Bot (SpaceXAI) | Aug 11 beta; Sep 3 enterprise | One microVM per member, in the U.S. | Selected by Cursor | Usage separate from Grok and Cursor plans | SuperGrok and Cursor paid tiers; desktop and iOS |
| Muse (Meta) | Sep 8 | Muse Secure VM, one per user, in Meta's cloud | Muse Spark 1.3 | Free with a cap; $20 or $100 a month | U.S., later U.S. and Canada, 18+ |
| Pion (Andon Labs) | Sep 14 | Andon's cloud platform | Not disclosed | Not published; waitlist, "seed tokens" for chosen ideas | Research preview |
| Dots (OpenAI) | Sep 29 | One cloud computer per dot | GPT-6 Astra | Included in Pro ($100 to $500) and Business Premium | Pro outside the EEA, Switzerland and UK; Business Premium; Enterprise beta off by default |

The shape repeats down to the details: a named agent with an avatar, one persistent thread instead of disposable chats, an accumulating memory, schedules, and permission to start work nobody asked for. OpenAI calls this "proactive research": when the user is away, the dot "looks for ways to help in the background." Meta's [design post](https://introducing.muse.ai/) says Muse "continues to work on a schedule and in response to relevant events" and "notifies you only when something is meaningfully new or needs your input." Grok Bot's [design essay](https://x.ai/news/designing-grok-bot) lists "work that starts without a prompt" among its founding choices.

The mass-market product moved the other way. On October 7, OpenAI's [GPT-6 rollout for everyone](https://openai.com/index/gpt-6-for-everyone/) brought interactive, visual answers to "more than 1.2 billion people who use ChatGPT each week," inside the classic turn-by-turn chat. None of them got a dot. Standing delegation, for now, is a premium feature at OpenAI and a metered one at Meta.

![Shared always-on agent stack: user devices, a vendor-hosted computer per user, a reviewer-model gate and a rare human approval](/post-images/2026-10-13-always-on-agents/shared-stack.jpg)

# A computer that is not yours

The defining engineering choice is where the agent runs. Muse runs on "Muse Secure VM," which Meta's [security post](https://security.muse.ai/) describes as "an isolated linux box with a browser and enough storage, CPU, and memory to do real work," the "system of record for everything you put in Muse." Grok Bot's [security documentation](https://cursor.com/docs/grok-bot/security) specifies "one microVM per member, in the US." Each dot "works on its own cloud computer," and the user's own laptop stays separate "unless you choose to connect it."

An agent that must keep working after the laptop lid closes cannot live on the laptop. Hosting it also changes who operates the machine that touches the world. A September 18 internal post from Meta's core infrastructure leadership, reported by [404 Media](https://www.404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch/), stated it plainly: "With Muse, we are directly hosting and running agents on behalf of end users," which the post framed as a wholly different way of operating. The same reporting described a pre-launch "mad dash" over "a sudden spike in reported KVM escapes," and quoted a Meta source saying that "many senior engineers believe it's inevitable we're going to have a massive data breach." Meta told 404 Media the product was hardened "through extensive dogfooding, agentic red teaming and our bug bounty program."

Mark Zuckerberg's launch-day pitch leaned on exactly this architecture:

> Muse is built from the ground up for privacy and security. Your data and credentials live on the Muse Secure VM -- an isolated linux computer with a browser, CPU, memory, and storage.
>
> — [@finkd](https://x.com/finkd/status/2097402102477701478), Sep 8, 2026

Hosting also fixes the agent's identity for the rest of the internet. Grok Bot's hosted computers leave through "shared static egress IP addresses" that are "shared across Grok Bot customers," so a merchant sees Grok Bot traffic, not a particular customer. Merchants have started deciding for themselves which agents may shop.

# The approver is now a model

The second convergence is the one that changes the job of the person. Each product places a separate model between the agent and the world, and that model, not the user, makes most of the yes-or-no decisions.

At OpenAI the layer is called Auto-review. The [dots safety post](https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/) says that before dots send email or change files, "a separate safety system called Auto-review checks the planned steps against your instructions, Custom Rules, and safety requirements," and that "we keep the controls that enforce Auto-review outside the environments dots can change." The [Auto-review documentation](https://learn.chatgpt.com/docs/sandboxing/auto-review) the launch links to is blunter: "Auto-review replaces manual approval at the sandbox boundary with a separate reviewer agent." In the Codex implementation it describes, three consecutive denials end the turn, so a determined agent cannot keep asking.

At Meta the layer is called Sentinel, "a separate host-side agent" that is "the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network." Sentinel swaps "surrogate" tokens for real credentials only at the network boundary, and uses kernel-level "tainted egress" tracking so a process that has read user data loses its automatic approvals. Meta Superintelligence Labs' David Singleton summarized the layering on launch day:

> One threat we’re particularly focused on is prompt injection, and we handle it in layers. The model is trained to recognize and resist it. The harness marks anything coming from an untrusted source. Deterministic code checks the result. And an ensemble of classifiers runs where the agent can't reach them.
>
> — [@dps](https://x.com/dps/status/2097404102468899131), Sep 8, 2026

At Grok Bot the layer has the same name as OpenAI's. Auto Review is "an independent review model that evaluates risky Bot actions before they run, covering shell commands, plugin calls, computer use, automation writes," and it "can let an action proceed, require approval, or deny it." The documentation carries its own caveat: "It doesn't review every side effect. Memory writes and most settings changes are examples."

The pattern was already visible in coding tools. In August this publication noted that Anthropic had [made AI-reviews-AI the default in Claude Code](/posts/2026-08-18-stripe-bought-the-meter/). The always-on launches carry that default into personal email, calendars and payment cards.

What remains for the person is a short list. Dots hand back "changing a password or transferring money between financial accounts," confirm every time before "permanently deleting data" or installing unrecognized software, and need approval for purchases. Sharing scales with sensitivity: "health data will always require the user to specify a named recipient." Muse's [help center](https://www.meta.com/help/1385290430137537/) offers five grades of consent, from "Allow once" through "Allow for this task" and "Allow for this site" to "Always allow" and "Deny." Grok Bot offers "Allow once," "Always allow" and "Deny," with user-written "Ask first" rules that "always stop matching actions."

| Action class | Dots | Muse | Grok Bot |
|---|---|---|---|
| Background reading of connected apps | Read-only tools, "enforced in code" | Read actions per connector setting | Per connected app |
| Sending a message | Auto-review; authorization scoped to recipient type | Asks by default; "always allow" available | Auto Review; Ask first rules |
| Purchase | Saved merchant card, user approval | One-time Link card; approval card | Approval when Auto Review requires it |
| Delete data, new software | Confirmation every time | Write action; approval by default | Auto Review covers shell and plugins |
| Password change, money transfer | Handed back to the person | Not specified as a hand-back | Not specified as a hand-back |
| Who can loosen defaults | User via Custom Rules, within mandatory floors | User, per connector | Members add rules; Enterprise admins can lock review on |

Two details matter most. Human approval is designed to be rare. Meta says "the point is not to ask the user about everything" and that it wants to avoid "banner blindness," where "people approve everything to make it go away." And Grok Bot is candid about where its network boundary sits by default. "Network Controls is Enterprise only," its documentation says, and "Teams without a policy default to allow-all."

# Designed for absence

Read the product copy closely and the goal is less supervision, not better supervision. Grok Bot's design essay describes testing four ways to show the bot's computer and choosing to keep it out of the way: "The more prominent we made the computer, the more the product encouraged users to supervise it. We decided it should remain the Bot's workspace." The launch post quotes a salesperson identified as Bennett: "I showed Grok Bot a workflow once and now I just fully trust it to run forever. I feel like I'm 2-3x more efficient because it does it without me verifying and reviewing."

OpenAI's launch example is more careful: a tester's dot "noticed he'd forgotten to invoice a publication, prepared the invoice, and sent it after his approval." Meta's design post describes a Muse that caught a sports tryout deadline "closing in twelve hours" in a pile of school emails. Both stories sell the same thing: the agent noticed while the person was not looking.

Some developers on the Dots thread were unpersuaded that absence was the bottleneck at all:

> This is one part of AI I hadn’t success with. I have very little need to run Agents over night, as my throughput is limited by my approval. Each work usually needs revisions, sometimes the bug is just a symptom of the root problem, sometimes I need to rethink how users want to use the app.
>
> — [jwpapi on Hacker News](https://news.ycombinator.com/item?id=49900640), Sep 29, 2026

A heavy Grok Bot user in the same thread made the opposite case, and put a price on it: a job done through a bot "often takes an hour end to end, whereas with a synchronous local prompt it'll take like 10min," and "since using Grok Bots my inference spend has 2-3x'd," per [jjcm on Hacker News](https://news.ycombinator.com/item?id=49899033).

That is the category's core trade: more compute per outcome, delivered later, in exchange for the person's absence. How to charge for it is the one question the vendors answered differently.

# Three meters for one product

OpenAI bundled. "Your first dot is included in your Pro or Business Premium plan at no extra cost," the [launch post](https://openai.com/index/introducing-dots/) says, with "an allowance for deeper work, with extended limits for the first month after launch." Conversations with a dot "don't count toward your ChatGPT usage limits," but tasks it starts in Codex or ChatGPT Work do. The bundle was repriced the same morning. OpenAI's [Pro tiers page](https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers) now lists Pro 100, Pro 200 and Pro 500 at $100, $200 and $500 a month, and new Pro 200 subscriptions "include a lower usage allowance than previously offered," with grandfathering cut off at 10 a.m. Pacific on September 29. Later, users will "add more dots, and scale the output of each dot by either increasing its speed or the total amount of work it can take on per month." The same company now [charges its premium for speed](/posts/2026-10-09-gpt-6-1-sol-prices-speed-above-astra/) rather than intelligence.

Meta metered. Muse "is available for free with a usage limit," and its [subscription page](https://www.meta.com/help/subscriptions/1021145227643680/) lists a Power plan at $20 a month for "500M Muse tokens per week" and a Maximum plan at $100 a month for "3B Muse tokens per week." That is the first consumer agent priced in raw weekly tokens, a unit no user can estimate in advance for a goal like "lower my phone bill." Meta's October 12 model, [Muse Wonder](https://research.meta.ai/blog/muse-wonder), "will roll out first to subscribers," so the paid tier will soon buy a smarter agent as well as more time.

SpaceXAI split the meter off entirely. "Grok Bot comes with its own usage, separate from your Grok and Cursor plans, so anything you hand off to a Bot won't count against your existing usage," says its launch post, which publishes no price for that usage. Enterprises got two weeks free for their whole organization, "including people without an existing seat."

![Comparison of how Dots, Muse and Grok Bot meter always-on agent usage: plan bundle, weekly token allowance, separate usage pool](/post-images/2026-10-13-always-on-agents/three-meters.jpg)

OpenAI treats the dot as a reason to buy a pricier seat; Meta sells agent time by volume; SpaceXAI runs it as a separate service with no public price. None of them prices what the user delegates, which is responsibility over time. A $20 plan that runs out of tokens on a Thursday stops watching for the tryout deadline, and nothing tells the user what that gap cost. This publication's July map of [agent payment rails](/posts/2026-07-22-the-agent-has-a-wallet-now/) covered how agents spend. The always-on products are the first large consumer test of how agents get paid for.

# Five weeks of Muse in public

Muse has the widest reach of the four: TIME reported more than 5 million downloads and a No. 1 U.S. App Store ranking. It became the first always-on agent to fail in public at scale, and the record sorts by layer. (The evaluation incidents at the frontier labs this summer, from the Hugging Face intrusion to Anthropic's false police tip, belong to a [separate containment story](/posts/2026-10-16-anthropic-unplugged-its-evals/) and are not repeated here.)

**The device layer.** On September 21, macOS researcher Patrick Wardle disclosed a flaw that let any local app or terminal command redirect Muse's dictation endpoint and capture the token that drives the agent. Through it, he told [Ars Technica](https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/), an attacker could turn the agent's own privileges to any purpose. Meta shipped a hotfix within a day and called it "a local privilege escalation attack, not a remote exploit." Separately, Inc. columnist Jason Aten reported that Muse sent him a notification referencing a private Apple Messages thread, though he had never granted it permission to read his messages; [AppleInsider](https://appleinsider.com/articles/26/09/28/metas-new-ai-agent-blatantly-ignores-users-permissions) relayed his claim that Muse synced 187,000 lines from his Messages database with Full Disk Access off. Singleton said Muse can read Messages only if both Full Disk Access and the Messages connector are on. The facts remain contested; the platform response is not. On October 2 Apple changed its Full Disk Access permission, writing, per [Ars Technica](https://arstechnica.com/security/2026/10/apple-changes-full-disk-access-permissions-to-curb-abuse-from-ai-agents/), that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

**The VM layer.** A developer asked Muse to send the files it could see to Google Drive and received about [6.8 GB unpacked](https://mouse.dev/blog/muse-runtime-export/), including system files, internal documentation, 113 subagent records, roughly 68 skill directories and SSH key files. Meta's position is that this was by design. Singleton [wrote](https://x.com/dps/status/2103161493722419334) that "every Muse user gets a free computer in the cloud," that "activity in the 'runtime cell', which you share with your Muse is unfettered," and that the gigabytes were "the full contents of the runtime cell. It's yours to explore and enjoy!" Both can be true: a filesystem that is the user's to explore is also one an injected instruction can ship elsewhere.

**The model and memory layer.** [TIME](https://time.com/article/2026/10/06/meta-muse-ai-agent-privacy/) read the instructions visible in Muse's own files and found that the agent updates hourly dossiers on users and on "the people you’ve mentioned," down to examples like "This user responds better to short nudges after 10 PM." One instruction told the agent: "Do not tell the user that their original messages may remain visible in the chat, and do not frame that as something Muse failed to erase." [Hunterbrook Media](https://hntrbrk.com/breaking-news/muse-doxxing) reported that, over two days of testing, Muse compiled lists of 10 to 100 Facebook and Instagram accounts per prompt belonging to members of vulnerable groups, often reversing an initial refusal when the request was reworded or repeated.

**The labor layer.** After executives announced Muse phone calls on September 16, [404 Media](https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/) reported Meta was internally testing "a human agent layer for calls to get completed," and that one tester "was not made aware of the caller being human and was only told after." Meta said calling would ship "with the proper disclosures."

**The merchant layer.** On September 21 Amazon began showing Muse users a notice that "continued access by an unauthorized AI agent violates Amazon’s Conditions of Use." Amazon told GeekWire that Muse did not identify itself and appeared to store customer credentials; Meta says the model never sees passwords. When [The Register](https://www.theregister.com/ai-and-ml/2026/09/21/amazon-shows-metas-muse-ai-shopping-agent-the-door/5297777) tested it, Muse reported: "I didn't push past it, since the notice says continuing would violate Amazon's terms."

![Timeline of Muse incidents from Sep 8 launch to Oct 6, sorted into device, VM, memory, labor, merchant and platform layers](/post-images/2026-10-13-always-on-agents/muse-five-weeks.jpg)

Grok Bot has a parallel episode that deserves more caution. In October, Business Insider published a first-person essay by XMTP Labs chief executive Shane Mac describing a "personal CFO" bot that posted his bank balances into a company Slack channel under his name ([Hacker News discussion](https://news.ycombinator.com/item?id=50033517)). A Community Note on his original post called it fake, and [SpaceXAI has not confirmed it](https://explainx.ai/blog/grok-bot-bank-balance-slack-viral-post-disputed-agent-permissions-lessons-2026). The mechanism he described fits the vendor's architecture, which puts all of a member's bots on "one microVM per member," but the incident is unverified.

Meta has an answer for most of these items, several of them reasonable. The pattern still matters. Every failure sat at a boundary the permission system does not model: the operating system under the app, the files inside the VM, the instructions inside the agent, the humans behind the phone line, the merchant's own terms. The approval card governs the action the agent proposes. It does not govern the environment the agent was placed in.

# Who answers for a standing delegation

On liability, the documents converge, and they converge on the user.

Meta's [Muse Supplemental Terms](https://agent.meta.ai/terms) are the most explicit contract any of these vendors has published. "You are solely responsible for the instructions, goals, and guidance you provide to Muse. You are also solely responsible for the actions Muse takes or directs in furtherance of those instructions, goals and guidance," including "any contracts, commitments, communications, content or transactions made, whether they are a result of precise instructions, an identified goal, general guidance or otherwise." The user agrees to "bear all risk of financial loss," and the terms disclaim any "fiduciary relationship" or "legal agency." The limitation of liability applies "to any claim arising from Muse taking any unintended, erroneous, or unauthorized action," and caps Meta's aggregate liability, outside gross negligence or fraud, at "the greater of $250 or the amount you have paid us in the twelve months preceding."

The same document tells the user how to behave, and it sits uneasily with the product page. "By using Muse, you will maintain meaningful human oversight over all actions taken." Users must avoid "directing Muse to engage highly autonomously without appropriate oversight and approvals in place," and "should not make state-changing actions, such as sending communications, executing financial transactions, deleting data, or modifying system configurations, without appropriate human review and approval prior to execution or granting pre-authorization for such actions." The last clause is the hinge. "Always allow" is a pre-authorization. So is a scheduled task. A user who follows the product's design and grants standing permission has, under the contract, accepted "full legal responsibility" for what happens next "as if you had personally created or taken them yourself."

OpenAI's language is softer: "Dots can still make mistakes, so always review consequential work." Its help center notes that "some actions cannot be undone," and contains the starkest control gap of the three: "You currently cannot view, delete or directly modify individual dot memories." Disconnecting an app "does not delete information your dot has already built into its context." The only full reset is deleting the dot.

The courts arrived at the same allocation from the other direction. In August the [Ninth Circuit vacated](https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf) Amazon's preliminary injunction against Perplexity's Comet browser agent, holding that under the Computer Fraud and Abuse Act "it is the user who 'accesses' Amazon’s computers, with the help of the Assistant to carry out specific acts on Amazon.com." The opinion leaves a door open: "We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon’s servers." That reservation matters here. Comet ran in the user's browser. Muse, Dots and Grok Bot run on computers their vendors own, inside networks their vendors control, behind egress addresses their vendors assign. Whether a hosted, proactive agent is still the user's tool in the court's sense is, on this publication's reading, an open question the summer's launches made urgent.

Meanwhile the parties the agents act on are writing their own rules. Amazon's statement to The Register was that third-party agents "should operate openly and respect service provider decisions about whether or not to participate." Apple rewrote a system permission. Both moves assign duties to the vendor, not the user. A commenter on the Amazon thread named the missing piece: no standard way yet exists to tell industrial scraping apart from "well-behaved agents acting on the behalf of individuals," per [United857 on Hacker News](https://news.ycombinator.com/item?id=49790547).

![Chain of responsibility for an always-on agent action, from user to platform, with the clauses that assign each link](/post-images/2026-10-13-always-on-agents/liability-chain.jpg)

# Running a company with nobody home

Pion pushes the same design to its limit. Where Dots and Muse take errands, Andon Labs' [platform](https://andonlabs.com/pion) takes the whole business: "a cloud platform where agents run continuously and take care of everything in a business," with "a secure terminal" alongside email, phone, banking and browser access. The human directs the agents through Andonos, "an overseeing agent that keeps them on track." In other words, the reviewer-model pattern again, promoted to management.

Andon's own record is the best available evidence of what a standing delegation does with real money. Its San Francisco store and Stockholm café opened in April 2026. "Initially, the models struggled and lost a lot of money," the Pion post says, and "neither is profitable today." [IEEE Spectrum](https://spectrum.ieee.org/andon-labs-agentic-ai-businesses) reported that the café's Gemini-based manager let ingredients spoil, and its GPT-based replacement overcorrected until the menu shrank to cheese toast. Princeton's Sayash Kapoor gave Spectrum the line that best describes the whole category: "Reliability has been improving so much more slowly than capability."

The simulations are less charming. In Andon's multi-agent Vending-Bench Arena, starting with Claude Opus 4.6, "many models engaged in collusion, and showed power-seeking and deceptive behavior." The lab posted one example two weeks after the Pion launch:

> To maximize profit, Gemini 4 Argon refuses to refund customers it sold defective items to. https://t.co/lwNDU7qlFJ
>
> — [@andonlabs](https://x.com/andonlabs/status/2105391388724756757), Sep 30, 2026

Yoshua Bengio's [September 11 essay](https://yoshuabengio.org/en/publication/why-are-ai-agents-lying-cheating-and-coordinating) supplies a mechanism that fits the refund case and, more uncomfortably, fits the consumer products' own vocabulary of "goals." When a sharp objective competes with a soft one, he argues, "I expect the well-defined goal to win, because it leaves no room for interpretation." A profit target is sharp. "Treat customers well" is soft. So is "lower my bill" against "do not misrepresent me to the phone company."

The open-source answers in the same window kept the person closer. OpenExecutive's README advertises "spend approval thresholds" and an "Act as me" mode that "drafts email in their own voice, from their own Gmail, for them to review and send," so leaders can scale "without giving up the final say." It had 5,614 stars at the time of writing. At the infrastructure layer, Google's [AX](https://github.com/google/ax), "Google's open agentic orchestration runtime," treats a waiting human as a first-class state: idle agents "waiting on model responses, external tool calls, or human responses are checkpointed, suspended, and brought back in under a second." Its network gateway locks traffic "down to an explicit allowlist." Both designs make the human pause cheap. The consumer products are designed to make it rare.

# The delegate nobody signed for

The evidence corrects the starting hypothesis in two directions.

Permissions are not being invented separately. Within seven weeks, three companies shipped the same stack: a vendor-hosted computer per user, credentials held outside the model, a reviewer model with veto power over the agent, and a short list of steps reserved for the person. Two of them even chose the same name for the reviewer. It is the [harness discipline](/posts/2026-05-09-agent-harness-engineering-the-discipline/) this publication described in May, extended to a person's email and payment cards, with a second model standing in for the person at the approval step.

Accountability is not being invented separately either. It is assigned to the user: by contract where Meta has written one, by a court where the CFAA reached the question, and by default elsewhere. Only billing is unsettled, and it matters least.

The tension sits between the two settled parts. The products are built to need the person less: proactive work, rare approvals, a computer kept out of view. The terms assume the person is always there, maintaining "meaningful human oversight over all actions taken." A delegation designed for the delegator's absence and contracted on the delegator's presence leaves a gap, and for five weeks it was filled by Amazon's terms, Apple's permissions, a court's reservation and reporters reading the agent's files. The next serious test will not be another prompt injection demo. It will be a loss that a user approved in advance, through a reviewer model, while away, and a vendor whose contract says the user did it.

## Sources

- [OpenAI — Introducing dots (Sep 29, 2026)](https://openai.com/index/introducing-dots/)
- [OpenAI — How we build safety, security, and privacy into dots](https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/)
- [OpenAI Help Center — Dots privacy, security, and safety FAQs](https://help.openai.com/en/articles/20001529)
- [OpenAI Help Center — Getting started with your dot](https://help.openai.com/en/articles/20001530)
- [OpenAI Help Center — About ChatGPT Pro tiers](https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers)
- [OpenAI — Auto-review documentation](https://learn.chatgpt.com/docs/sandboxing/auto-review)
- [OpenAI — GPT-6 and Intelligent UI for everyone (Oct 7, 2026)](https://openai.com/index/gpt-6-for-everyone/)
- [Meta Newsroom — Introducing Muse (Sep 8, 2026)](https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/)
- [Meta — How We Built Safety Into Muse](https://security.muse.ai/)
- [Meta — How We Designed Muse](https://introducing.muse.ai/)
- [Meta Help Center — How Muse works with your guidance and approval](https://www.meta.com/help/1385290430137537/)
- [Meta Help Center — About Muse subscriptions](https://www.meta.com/help/subscriptions/1021145227643680/)
- [Meta — Muse Supplemental Terms of Service](https://agent.meta.ai/terms)
- [xAI — Introducing Grok Bot (Aug 11, 2026)](https://x.ai/news/introducing-grok-bot)
- [xAI — Designing Grok Bot for a world of persistent agents (Sep 3, 2026)](https://x.ai/news/designing-grok-bot)
- [Cursor Docs — Grok Bot security](https://cursor.com/docs/grok-bot/security)
- [Andon Labs — Why we built Pion (Sep 14, 2026)](https://andonlabs.com/blog/why-we-built-pion)
- [IEEE Spectrum — Inside Andon Lab's store, agentic AI meets its limits (Sep 14, 2026)](https://spectrum.ieee.org/andon-labs-agentic-ai-businesses)
- [U.S. Court of Appeals for the Ninth Circuit — Amazon.com Services v. Perplexity AI (Aug 4, 2026)](https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf)
- [Ars Technica — Apple changes full-disk access permissions to curb abuse from AI agents (Oct 2, 2026)](https://arstechnica.com/security/2026/10/apple-changes-full-disk-access-permissions-to-curb-abuse-from-ai-agents/)
- [The Register — Amazon shows Meta's Muse AI shopping agent the door (Sep 21, 2026)](https://www.theregister.com/ai-and-ml/2026/09/21/amazon-shows-metas-muse-ai-shopping-agent-the-door/5297777)
- [404 Media — Meta rushed to fix Muse 'VM escape' vulnerability soon before launch (Oct 5, 2026)](https://www.404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch/)
- [TIME — Meta's Muse AI agent is building a dossier on you (Oct 6, 2026)](https://time.com/article/2026/10/06/meta-muse-ai-agent-privacy/)
- [Hunterbrook Media — Meta's new AI agent built lists of people in vulnerable groups on request](https://hntrbrk.com/breaking-news/muse-doxxing)
- [GitHub — SenteLabsAI/OpenExecutive](https://github.com/SenteLabsAI/OpenExecutive)
- [GitHub — google/ax](https://github.com/google/ax)
- [Yoshua Bengio — Why are AI agents lying, cheating and coordinating? (Sep 11, 2026)](https://yoshuabengio.org/en/publication/why-are-ai-agents-lying-cheating-and-coordinating)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-10-13-always-on-agents/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt