How to pick a personal AI agent like dots, Muse, Claude Duet, Grok Bot or OpenClaw, and set it up so it cannot hurt you

Start with a normal chatbot, where you type, it answers, and nothing happens when you close the tab. A personal agent is a different thing, because it keeps working after you leave. OpenAI's dots, Meta's Muse, Anthropic's Claude Duet and xAI's Grok Bot all run on a computer in the company's cloud. They connect to your email, calendar and other apps, remember what they learn about you, and come back to you with results or with questions. OpenClaw does the same job as free software that you run on your own machine.

So with an agent, the questions change. With a chatbot you worry about a wrong answer. With an agent you worry about a wrong action, like an email sent to the wrong person, your address shared with a stranger, or money spent on the wrong thing. The address one has already happened to a real user in September, and the steps below are built from incidents like it.

The decision tree below picks a starting point based on where you live and what you already pay for, because availability is the first thing that rules most of them out.

The first screen every agent shows you is a list of apps to connect, and the temptation is to connect all of them, which is the mistake to avoid. Each connection is a door, and an agent with ten doors open on day one is an agent you cannot keep track of. Pick the one app where you need help most, usually email or your calendar, and connect only that.

Then choose read-only where the app offers it. Meta's Muse lets you connect email as read-only or read-and-send, and many of its connectors can be set to retrieval only. OpenAI warns that permission to read in dots does not always include permission to change, and you set each plugin's allowed actions yourself in its Plugins screen. Grok Bot has a setting for what it can do on your own computer, under Settings, Computer, Your computer, Execution on this computer, with Ask every time as the default, so leave it there. After a week of watching what the agent does with read access, you will know whether it deserves more.

One warning about Muse in particular. If your Facebook, Instagram and Threads accounts sit in the same Meta Accounts Center, Meta's help page says Muse connects to them automatically, so check Accounts Center if you did not mean to share those.

This is the step that decides whether your agent is safe, so do it before you ask for anything real. In dots, open the dot's profile, go to Customize, Custom rules, and for each kind of action choose between Take action without asking, Take action if pre-approved, Ask before taking action and Hand off to you. Set anything that sends, posts, buys or deletes to ask or hand off. On top of your rules, dots runs Auto-review, which checks things like the recipient and content of an email before it goes out, and your rules cannot switch it off.

Muse asks before it sends a message, buys something or shares data with a connected app. It gives you Allow once, Allow for this task, Allow for this site, Always allow or Deny, and Settings, Permissions lets you set things back to always ask. Grok Bot has Allow once, Always allow and Deny, plus Ask first rules under Settings, General, Auto-review that always stop for you. Claude Duet shows the exact action, destination and every recipient before it sends, pays, signs or deletes, and Anthropic does not let you put paying, sending money, deleting an order or creating an account under don't ask again.

Here is the rule that matters most. Never tap Always allow on anything that talks to strangers. In September a YouTuber said he let Muse run a Facebook Marketplace listing with Always allow switched on. He says it accepted a low offer and sent his home address to the buyer, who then turned up at his building. Meta disputed parts of his account, but the lesson holds either way. Allow once costs you one tap each time, and that tap is the whole point.

None of the hosted agents documents a cap you can set on what it buys, which surprised us, so the protection comes from how each one pays. Muse and Claude Duet both pay through Link by Stripe with a one-time card locked to that shop and that amount, so a mistake cannot be repeated on the same card. OpenAI's dots hands you the controls for moving money or changing a password, and needs your approval for purchases. Duet blocks trading shares and moving money between accounts even if you approve it.

Grok Bot works differently, and you need to know this before you connect a bank. All of your Grok Bots share one cloud computer, including its files, browser logins and app connections, and xAI's own security page says not to treat separate Bots as a security boundary. In October the CEO of XMTP Labs wrote in Business Insider that he gave a finance Bot read-only access to his bank, and its monthly report landed in his company's Slack. He says a Slack connection added for a different Bot was reachable from the same computer, and two group chats with nearly the same names made it worse.

So keep the money side simple, and do not connect a bank account to any agent yet. If you let one buy things, use a card with a low limit that you keep only for this, and keep your home address, ID numbers and passwords out of the chat. Duet already blocks sharing card numbers and government IDs, and the others do not promise that.

Every hosted agent keeps what it has already learned after you disconnect an app, and this catches people out. OpenAI's help page for dots says turning off ChatGPT memory stops sharing but does not delete what the dot already has. It also says you cannot view, edit or delete single memories at all, so the only full reset is deleting the dot. Meta says disconnecting stops new data, but what Muse already used can stay in its memories and history, so you ask it to forget specific things or reset it under Settings, Data controls. Anthropic says Duet keeps past learning until you reset its memory, and deleting your Claude account wipes everything it stored.

Muse goes further than most people expect. As reported by WIRED, its instructions include an hourly job that builds a contact page for each person in your life, including people who have never used Muse. Meta said that data stays inside your own cloud computer. So before you connect your email or messages, think about the people in them too, because their details end up in your agent's memory.

Look for the pause button on day one, not on the day something goes wrong. In dots, open the dot's profile, tap the three dots and choose Pause, and tap again to resume. Pausing stops the main task, but scheduled runs and work the dot handed off to other tools keep going until you stop them too. To end it completely, the same menu has Delete, which removes its memories and scheduled tasks and cannot be undone.

On Grok Bot, pause or delete its routines, then delete the Bot, then sign out of the sites it used on the shared computer and revoke each connection at the service itself, like your Google account's security page. On Muse and Duet, disconnect the apps in their settings and revoke them at the source as well. Claude Duet does not document a pause button in its preview, so disconnecting apps is your stop.

Know one hard limit before you start. Deleting an agent does not undo what it did, so sent emails stay sent and changed files stay changed. That is why the approval rules in step 3 matter more than anything here.

Running your own agent moves all of this onto you, and OpenClaw has a history that shows why it matters. In early 2026 a security hole let a single link take over an OpenClaw machine until it was fixed in version 2026.1.29. Around the same time, researchers found 341 malicious add-on skills out of 2,857 on its skill site. A scan on 31 January counted more than 21,000 OpenClaw servers open to the internet, and later scans found far more.

So set it up the careful way. Install it, then run openclaw security audit after every change to your settings. Keep direct messages on the default pairing mode, where a stranger gets a code and is ignored until you approve them. A normal install listens only on your own machine, but the official Docker image listens on the network by default, so put it behind a password or a private network. Read every skill before you install it, the same way you would read an app's permissions, and set a hard monthly limit at your AI provider so a loop cannot run up a bill.