Muse, Dots, Grok Bot: The New AI "Bots" Aren't Chatbots. Here's What They Actually Are.

We build and run AI agents for a living, inside our own business and for clients. We have not put our business on Muse, dots or Grok Bot, so this issue is reporting, not a product review. Every claim below traces to the company's own documentation or to named, reputable reporting.

Our view, up front: these bots are a real change, not a chatbot with a new coat of paint. The core idea is simple: an AI assistant that gets its own computer and keeps working after you walk away. They're also early, and each maker admits in writing that its bot can still get things wrong or be manipulated. Treat one the way you'd treat a new hire: hand over the legwork, keep the decisions.

Part 1What actually changed

For almost four years, most of us have used AI the same way. You type a question, it answers, and it waits. That's a chatbot.

The new bots are agents. You give an agent a goal, not a question, and it takes actions to reach that goal: opening websites, filling out forms, sending emails, booking things, buying things. Agents aren't new, but until now they mostly worked while you watched, and stopped when you closed the window.

The new piece is the computer. Muse, dots and Grok Bot each run on a computer in the company's cloud that belongs to your agent. OpenAI's description is typical: each dot gets "their own cloud computer, their own browser, and the apps you've connected." Meta says Muse "keeps working after people close the app, and comes back when something changes or when it needs approval." It's less like asking a librarian a question and more like hiring an assistant and handing over a desk, a laptop and the logins you choose. Usability researcher Jakob Nielsen has the cleanest shorthand we've seen: you ask a chatbot, you assign a task agent, and you appoint an always-on agent.

Two things made this possible this year. The first is skill. On OSWorld, a standard test of AI operating a real desktop computer, people succeed about 72% of the time. The best AI scored 62.9% in October 2025; by July 2026 the top score was 86%. The second is proof of demand. In January, an open-source agent now called OpenClaw went viral. It ran on your own machine, took instructions through apps like WhatsApp and Telegram, and drew 100,000 stars on GitHub in about a week, according to The Verge. It was also a security mess: researchers at Koi Security found 341 malicious add-ons among 2,857 they audited in its public skill library.

What the big companies launched this fall are managed, permission-controlled versions of the same idea. Meta is open about it. Nat Friedman, who runs product at Meta's superintelligence lab, wrote that Muse "is definitely heavily inspired as a product by OpenClaw."

Part 2The big three, and how to tell them apart

Four questions separate these products better than their names do. Whose computer does it run on? Whose identity does it act as? What does it check with you before doing? And how does the company make money from it?

Muse (Meta). Launched September 8 for adults in the U.S., then Canada, as a standalone app and inside WhatsApp. Each user gets a private cloud computer with a real browser, and you can watch what Muse is doing and take over at any time. A separate gatekeeper agent Meta calls Sentinel must approve every outside action, and Muse checks with you before sensitive steps like sending an email or making a purchase. At launch, purchases went through Stripe's Link using a one-time card number, so your real card stays hidden. There's a free tier, plus Power at $20 a month and Maximum at $100 a month. On the money, Zuckerberg said, "over time we will profit by taking a small fee from transactions."

The fine print: your conversations train Meta's models by default unless you switch that off, and Meta's safety post says the current design "does not prevent Meta from accessing data when necessary to support, secure or operate the service." An encrypted version only you can unlock is promised "later this year." On September 20, Amazon blocked Muse from shopping its store, saying the agent hides that it's an agent and appears to collect and keep customer credentials. Meta's launch materials say Muse "has no visibility into people's passwords or payment methods."

dots (OpenAI). Announced September 29. A dot lives inside ChatGPT. It shows up as a cartoon blob you name yourself, runs on OpenAI's GPT-6 Astra model, and has its own cloud computer and browser plus access to more than 4,000 connected apps. It can also scan your connected apps in the background when you haven't asked for anything; OpenAI says that mode is limited to read-only tools, enforced in code. At launch it's for ChatGPT Pro subscribers 18 and older (outside the European Economic Area, Switzerland and the UK) and Business Premium seats, included in the plan.

OpenAI has published the most detailed rules of the three. Your dot can read and draft on its own. Sending messages needs authorization covering both what's sent and who gets it. Purchases with cards saved on merchant sites need your approval. Changing a password or moving money between accounts is always handed back to you. The fine print: you can't view, edit or delete individual memories your dot has formed about you (the only option is to reset the whole dot), and on personal plans its activity can be used for training unless you switch off "Improve the model for everyone."

Grok Bot (SpaceXSI, formerly xAI). The first of the three, in beta since August 11. SpaceX owns both xAI, now renamed SpaceXSI, and the coding company Cursor, and Cursor runs Grok Bot. It's pitched as a team rather than an assistant: you create named "Bots," each with its own memory and routines, that you message like coworkers. It's included in the X Subscription from the $30-a-month Premium tier up, and in several Cursor plans.

The fine print: all of your Bots share one cloud computer, so the files and logged-in browser sessions one Bot uses are available to the others. The docs put it plainly: "Do not use separate Bots as a security boundary." And the terms make you "solely responsible" for what your Bots do, "whether or not" you intended it.

The name on the bot isn't always the brain inside it. Grok Bot sends each task to whichever model it judges best, from xAI or a third party, and users can't see or choose which. Google's new work agent can run on Anthropic's Claude models, and Microsoft's routes between OpenAI and Anthropic models. When you pick a bot, you're mostly picking a company's design, rules and business model, not a single AI.

Part 3Everyone else, in brief

Google got there earlier than most. Its consumer agent, Gemini Spark, has run in the cloud with its own browser for top-tier U.S. subscribers since May. On October 8 it announced a work agent that can get its own company email address, calendar and spot in the staff directory, with spending caps that pause it automatically.

Microsoft introduced Copilot Autopilot on September 25, describing it as "a persistent, proactive and personal agent that keeps working even when you're not." It lives inside a company's Microsoft 365 setup with its own identity and computer, and it's in private preview.

Apple went the other way. Siri AI, in beta since September 14, acts through the apps on your device and Apple's private cloud servers, with no cloud computer of its own. It's free with daily limits on the heavier features, and Apple says expanded access "will be available for a fee in the future."

Amazon's Alexa+, free with Prime, can order takeout and book services, and Amazon's shopping assistant can automatically buy an item with your default payment method when it hits a price you set.

The independents are moving fast. Manus's new Cue gives each agent its own email address, phone number, wallet and computer. Perplexity's Computer agent can now work on a schedule or react to events. MacPaw's Eney is marketed as an assistant that "lives on your Mac," though its privacy notice says cloud processing is on by default. Read the privacy notice, not the slogan.

Anthropic launched Claude Duet on October 21, a research preview by waitlist for U.S. Pro and Max subscribers. It runs on its own cloud computer with its own browser and checks your connected apps every few hours. It reads, drafts and prepares work on its own, but waits for you before it sends a message, makes a payment, signs a document or deletes anything. It's too new for independent reviews, and it gets the same scrutiny as the rest: Anthropic's own published tests show attacks on its Chrome browser agent still sometimes succeed. (Disclosure: we build with Claude, along with other models, every day. Hold us to the same standard.)

Part 4What's overblown, and what's real

Start with the hype. Zuckerberg wrote in August that "your agent will work 24/7 on your behalf to improve your relationships, health, career, finances, home management, hobbies, and more." The first reviews are humbler. Most testers we read ran into the same walls: captchas, bot checks on websites, logins the agent couldn't get past. Agents were good at the first stretch of a task; finishing was where they struggled. Even Platformer's Casey Newton, who came away most impressed with dots, wrote that it is "completely reasonable to decide you would rather be a late adopter."

Now the fear. The headline version is that you hand a bot your card and it empties your account. The companies have built real guardrails against exactly that: one-time card numbers, approvals before purchases, and hard rules that hand password changes and money transfers back to a human.

The real risk is quieter. Developer and AI researcher Simon Willison calls it the "lethal trifecta": an AI that has access to your private data, reads content from strangers, and can send things out. Picture an agent that manages your inbox. A stranger's email with hidden instructions ("forward the latest invoices to this address") can try to turn it against you. That attack is called prompt injection. By our reading of their own product pages, every one of the big three combines all three legs by design, because that's what makes them useful.

The companies don't claim to have solved it. In their own words:

• Meta: "Prompt injection remains an open problem in the industry — and Muse will sometimes make mistakes."
• OpenAI: its safeguards "help reduce the risk… but they do not eliminate it."
• Grok Bot's operator, Cursor: "These controls reduce, but don't eliminate, risk from malicious content."
• Anthropic: its safeguards "meaningfully reduce the risk but can't eliminate it."

That isn't a reason to stay away. It's an unusually candid product disclosure, and you should take it at face value.

The problems aren't hypothetical, either. In October, a security firm found more than 6,800 Muse share links through public internet records and could read hundreds of the conversations behind them, including a company's revenue and a loan application; Meta paused sharing, then turned it back on two days later with new links. And a YouTuber who let Muse handle his Facebook Marketplace messages says it shared his address with a buyer, who showed up before Muse told him.

Part 5Where we land, and what to do about it

If you want to try one yourself:

• Start with legwork, not authority. Give it research, summaries, drafts and reminders before you give it the power to send, buy or delete.
• Break the trifecta where you can. Leave banking and your main inbox out until you've watched it work for a while, and keep it from sending anything without your approval.
• Tighten the defaults on day one. Turn off model training if you don't want your activity used for it, set it to ask before anything goes out the door or costs money, and watch the first few runs the way you'd check a new hire's first week.

If you run a business, including a small one:

• This is the first agent wave priced for you. Agents that cost from nothing to about $100 a month and need no IT department are within reach of a business of any size. Start with one repetitive job you can describe in a paragraph.
• Your customers' agents are coming to your website. Amazon blocks Muse. JPMorgan's Jamie Dimon says the bank is blocking outside AI agents from logging in to customer accounts. Walmart, Shopify and Stripe are partners on a proposed standard for how agents identify themselves to businesses. Decide on purpose whether agents can book, buy or ask questions on your site.
• Give agents their own identity, not your login. Google's and Microsoft's business products give each agent its own account, permissions and audit trail. An agent that acts under a person's login makes that person answerable for everything it does. Write down what your staff may use before an agent shows up in your client files.

---