Anthropic has released a phone application called Claude Duet. Each morning it pushes a briefing that lists the most urgent items across a user’s email, calendar and accounts. If it finds an unpaid bill sitting too long, it drafts the chase email. With a nod from the user, it can place the order and pay.
That is one of a wave. In September Meta launched a personal agent called Muse. Microsoft followed with a new Copilot positioned as the assistant that keeps working while you are off. At the end of September OpenAI opened dots, which can message and call other people on the user’s behalf. Tencent released Buddy One at the end of October, an agent wired into documents, meetings and cloud storage.
They share a category. A personal agent is not a chatbot that answers when asked. It finds the owner, reports, and finishes the task.
Working with the machine switched off
A baozi shop owner in Changsha built an order desk on Tencent’s WorkBuddy. It collects the group chat orders, generates a calendar, and designs the signage, menu and posters. Work that took three people now takes one person and one machine, and daily sales rose from 300 to 800.
The capability lists are already long. Muse could compare prices, buy, handle email, manage a calendar and book travel at launch. Claude Duet works through invoices in accounting software, drafts payment chases and prepares contracts for signature. OpenAI’s dots specialises in proactive research and keeps working in the background on what else it might do for its owner. Copilot absorbs documents, spreadsheets and presentations, watches meetings and writes the to-do list.
Initiating contact is now standard equipment. An ordinary agent is a reception desk, answering one question at a time and forgetting quickly. A personal agent is closer to a full-time housekeeper who takes a task, decomposes it, and comes back with a report. The critical difference is that it keeps working after the phone is closed.
Wu Shuang, chief engineer for autonomous driving at Nvidia, argues two conditions make that persistence possible. The first is continuous context memory, which is a function of model capability, and he believes model capability is now sufficient, which is why the wave arrived this year rather than last. The second is an environment where the agent can exist and work continuously, which is why every vendor put its agent in the cloud.
People once assumed email had to live on their own computer and then adapted to webmail. In the cloud, an agent can work around the clock. It amounts to giving each agent a private office.
The difference between a framework and a product
The working style invites comparison with OpenClaw, which can also manage long-running background tasks. Meta has said publicly that it drew on OpenClaw’s product philosophy. The difference is structural. OpenClaw is not a model but a self-hosted agent framework. Users deploy it, connect a model, configure tools. It is industrious, but its brain is whatever model the user chose, and its performance is that model’s performance.
Personal agent users configure nothing. Meta assigns each user a separate cloud virtual machine and a separate agent to approve outbound actions, with an audit log the user can read, and sensitive operations such as payments require confirmation. OpenClaw leaves security with the user. Muse takes it over.
That threshold decides the market. OpenClaw is for developers. Personal agents are for ordinary consumers, and ordinary consumers have started arriving.
Tencent says WorkBuddy has completed 9 billion task requests since launch. Apptopia counted 1.8 million downloads of Muse on iOS in the United States and Canada in the first twelve days, ahead of ChatGPT’s opening on mobile, briefly taking the top spot in the US App Store overall.
The experience is not yet clean. A dots user told China Newsweek that voice calls sometimes need minutes of retrying to connect, and that taking over computer operations stutters. Anthropic has acknowledged that Claude Duet still struggles with complex personal logistics such as booking tickets, still misreads messages, and still misjudges what is urgent.
Then the shops pushed back
In October Walmart opened a dedicated shopping lane for agents, giving each agent its own file and a spending cap, closer to issuing a limited supplementary card against a user’s credit than to opening the front door. Most platforms have not followed.
Amazon went the other way. After discovering that Muse could access its marketplace at the end of September, Amazon asked Meta to exclude it from Muse’s supported sites. Meta declined. Amazon then began blocking the agent, and users trying to shop through Muse received a notice that persistent access by an unauthorised AI agent violates the platform’s terms. Amazon’s position is that third-party agents shopping for customers should operate openly and respect merchants’ decisions on participation. Muse, in its view, did not.
Muse also ran into the human problem. At launch, many merchants hung up as soon as they realised they were talking to an AI, blocking core functions such as appointment booking. Meta began testing an internal human concierge service, where a failed AI call would be handed to trained human contractors who would make the call. The test was withdrawn quickly, because users could expose sensitive information to those contractors without knowing.
Zhou Wei, a vice president at vivo and head of its global AI research institute, expects the dominant model to become protocol-based, with a direct link between agent and merchant rather than a simulated thumb tapping a phone screen.
Trust is the harder problem. An AI that can send email and move money has to know a great deal. Wired reported on 3 October that security researchers found Muse building hourly-updated profiles of a user’s family and friends, including preferences, history and relationship status. In mid-October a conversation-sharing feature was found to expose corporate loan applications, internal revenue reviews written for a chief executive and bank fraud alerts to third parties. Meta suspended the feature.
Fraud is the other flank. Prompt injection disguises instructions as content, the equivalent of slipping a forged note from the owner into the housekeeper’s inbox. Claude Duet shows the user exactly what it intends to do before sending a message, paying or signing, and blocks securities trading and account transfers outright, even when instructed.
The Verge argued in October that privacy protection is becoming a selling point precisely because the defaults are so permissive. Muse allows Meta to train on user data by default. dots requires control of the entire cloud drive. Much of what makes these agents useful is the same information that makes them dangerous.
Muse remains limited to the United States and Canada. Claude Duet still runs on an invitation queue. The explosive early growth of Muse faded within about a month. Wu’s view is that users will pay with personal information once the convenience is worth it, provided they trust the vendor to defend it. Personal agent strategy now needs product work, feature polish and engineering discipline rather than another launch.
One personal agent per person is close to certain. Before that arrives, the agents have to persuade both their users and the apps on their phones.
Editor’s note: This is an adapted translation of the original Sohu Tech report. It has been trimmed and restructured for readability for an international business audience. The full original (in Chinese) is at https://www.sohu.com/a/1098646507_220095.