Eight personal AI agents compared (updated monthly)

A short version of the table. Prices, availability, payments and passwords are in the full personal AI agents comparison (last verified 2026-10-25). In “Best for”, entries marked “my judgment” are my opinion; the rest follow the vendor.

Articles by question

Choosing one

• Which personal AI agent should I use? One table comparing access, price, availability, payments and passwords for eight agents. → Personal AI agents compared
• Is a personal agent selling productivity or time? They are two businesses: one priced against your hourly value and sold on proven ROI, the other against the value of your free time. → Personal agents split into two markets
• What should a personal agent’s entry point and interaction look like? The entry point buys the habit; the interaction buys the trust. → Personal agents: the entry point buys the habit, the interaction buys the trust

Risks

• Is there anything risky in the Skills I have installed? I built skill-risk-checkup, an open-source Skill that runs a read-only risk check on installed agent Skills (my X post, in Chinese). → GitHub: LiamZJU/skill-risk-checkup

Product judgment

• How do you accept an agent the way you accept a driver-assistance feature? Write the grading contract before the prompt and judge the system’s end state. → Eval as spec
• What review should a new agent capability pass? Agent capability is capped by how much the receiving organisation can verify. → An agent’s shippable capability is set at the review gate

Digital agents and Physical AI: the same delivery problem

Physical AI and digital agents look like two worlds, but shipping either as a product runs into the same problem: model capability sets the ceiling, and the unglamorous work decides whether it ships. In autonomous driving that work is corner cases and the data loop; for agents it is authentication, fault tolerance, state management and unreliable third-party APIs. Demos run on the model; products run on that work (my X post, in Chinese).

Two articles on Physical AI safety from an ADAS point of view:

• Human in the loop is not a robot safety specification, and ADAS already proved it
• Eiliko’s 68,000 reachable robots show consumer robotics has no R155

Where I follow agent news

The English-language agent accounts I follow are in the English agents section of my X accounts list (the page is in Chinese; account names and posts are linked).

FAQ

What is the difference between a personal AI agent and ChatGPT?

Chat assistants like ChatGPT mainly answer questions. A personal agent acts for you: it signs in to sites, fills in forms, places orders and sends email. Most of the hosted products in the comparison give the agent its own cloud computer or virtual machine (see the comparison).

What’s the difference between Claude Skills and MCP?

A Skill packages instructions, metadata and optional scripts or templates that the agent uses automatically when they are relevant (Anthropic docs). MCP is an open-source standard for connecting AI applications to external data sources, tools and workflows (MCP docs). They are not alternatives: an agent can use a Skill to decide how to do a task, then call tools, some of them over MCP.

Which personal AI agent should I use?

It depends on where you already work and how much control you want. I use Grok Bot; the comparison suggests Muse or Instinct if you want a secretary for daily life, and the open-source Hermes Agent or OpenClaw if you want to choose your own model and machine.

Is it safe to give an agent my passwords?

It depends on how it handles them. The official pages for Claude Duet, Dot, Grok Bot and Muse say the model or bot does not see your passwords, and payments mostly use one-time virtual cards or ask you to confirm first. The open-source products do not document this, so you have to design it yourself. Details and sources are in the comparison’s security section.

How often is this page updated?

Monthly. For the comparison table, the “last verified” date on the comparison page is the reference.

Changelog

• 2026-10-26: page published.

About the author: I’m Liam Ding (丁洪), an Autonomous Driving Product Manager at NVIDIA; see my bio. I use Grok Bot myself (“I choose Grok Bot”, in Chinese). The choices and “my judgment” entries here and in the comparison are my personal views, not my employer’s.

These eight personal agents are really two businesses: productivity agents help you create more value and are judged on ROI, while secretary agents give you back time by handling everyday errands. I use Grok Bot because it lets several named bots split the work like teammates; if you want a secretary for daily life, start with Muse or Instinct; and if you want to choose your own model and machine, pick the open-source Hermes Agent or OpenClaw.

The eight personal agents in one table

Last verified: 2026-10-25. Numbers in brackets link to sources and match the numbered “Sources” list at the end.

Hosted by the vendor

Open source, self-hosted

Note: OpenClaw is stewarded by the independent OpenClaw Foundation, whose donors include OpenAI, Amazon and Red Hat 23; the foundation’s site says no single company controls OpenClaw 24.

Candidate for the next update: Cue. Its site says each agent has its own phone, email, wallet and computer, and lists no pricing or regions 25.

How I choose: five criteria

In productivity vs secretary agents I argued that personal agents make two different promises 26. In practice I look at five things:

1. How much context it gets. Can it read your email, calendar, files and chats? The more it sees, the less you have to explain.
2. How many apps it connects to. Connectors decide what it can do reliably, and a built-in browser covers what connectors don’t.
3. Whether it can actually order and pay. That is the “Payments and passwords” column: a one-time virtual card or your real card, and whether it asks before paying.
4. Who is responsible when it goes wrong. Does it stop before sending, paying or deleting, and does it hand logins and verification codes back to you?
5. Price. Productivity agents are judged on ROI; secretary agents on what the saved time is worth.

I’m leaving Claude Duet, Dot and Gemini Spark unclassified for now. For reference, the official positioning: Claude Duet is for professionals and small business owners 1; Dot sits in ChatGPT Pro, Business Premium, Slack and Teams 5; Gemini Spark works across Google’s own apps 7.

For how access and interaction differ, see entry points and interaction for personal agents.

Recommendations by use case

Shopping and errands

The agents that can pay use one-time virtual cards or third-party payments: Claude Duet and Muse use Link 1, and Grok Bot supports X Money, Stripe Link and Shop Pay 16. Instinct works over text and phone calls, and every example on its site is an errand like groceries or tickets 17. Which one works best: Not tested.

Work and information

Claude Duet is officially aimed at professionals and small business owners 1; Dot works inside Slack and Teams 5; Gemini Spark is tied into Google Docs, Sheets and Gmail 8; Grok Bot can run several bots in parallel and bring them into one group chat 11.

Privacy first

If you want to keep the data and the model under your control, look at the open-source Hermes Agent and OpenClaw. Both are MIT-licensed, run on your own machine and let you pick the model 21. Among the hosted products, Claude Duet, Dot, Grok Bot and Muse state that the agent doesn’t see your passwords 215.

Security: how agents handle your passwords and cards

The hosted products take broadly similar approaches:

• The model doesn’t see passwords. Claude Duet has you type them into a separate form 2; Dot uses saved passwords without exposing them to the model 4; Grok Bot fills logins through 1Password without seeing the values 15; Muse can’t see your passwords or payment methods 19; Gemini has you take control to enter passwords 8.
• Payments use one-time cards or need your approval. Claude Duet and Muse use Link one-time virtual cards 1; Grok Bot shows the amount for you to allow or deny 16; Gemini confirms before purchases 8.
• Risky actions stop and ask. Claude Duet asks before sending, paying, signing or deleting, and trading securities or moving money are off-limits 1.

Hermes Agent and OpenClaw don’t say how they handle payments or passwords: Not disclosed. Self-hosting means designing that part yourself.

FAQ

Which personal AI agent should I use?

Start from what you want it to do, then use the five criteria above. My own short answer is the opening paragraph of this page. Before you pick, check the availability column: most hosted agents launched in the US first, and several exclude the EEA, Switzerland or the UK.

What’s the difference between Muse, Grok Bot, Dot, Claude Duet and Gemini Spark?

Where they live: Muse in the Muse app and WhatsApp, Dot in ChatGPT, Slack and Teams, Claude Duet in the Claude app, Gemini Spark in the Gemini app, and Grok Bot in its own desktop and mobile apps. Pricing: Muse has a free tier; Claude Duet, Dot and Gemini Spark come with each company’s paid plans; Grok Bot comes with The X Subscription Premium and above or paid Cursor plans. Details are in the table.

Who are the open-source Hermes Agent and OpenClaw for?

People who want to decide which model to use and which machine it runs on. Both are MIT-licensed and free, with model costs separate 21. Hermes offers optional hosting through Hermes Cloud 22; OpenClaw explicitly has no hosted tier 23.

What’s the difference between a personal agent and ChatGPT?

A chat assistant like ChatGPT mainly answers questions. A personal agent acts for you: it signs in to websites, fills in forms, places orders and sends email. Most hosted products in the table give the agent a cloud computer or virtual machine 111.

What’s the difference between a personal agent and a coding agent?

A coding agent writes code in a repository and terminal. A personal agent works in your inbox, calendar, shopping sites and chat apps. The underlying capability is similar; the tools and permissions are different.

How much does a personal AI agent cost?

From free to $200 a month. Muse has a free tier and Power at $20/month 20; Claude Duet comes with Pro ($20/month) and Max 1; Gemini Spark needs Google AI Pro or Ultra (Ultra from $99.99/month in the US) 8; Grok Bot starts at The X Subscription Premium, $30/month 12; Hermes Agent and OpenClaw are free software with separate model costs 21. Dot needs ChatGPT Pro, whose price isn’t shown on the pricing page 6; Instinct: Not disclosed.

Is it safe to give an AI agent my passwords?

It depends on how the agent handles them. The security section above lists each vendor’s stated approach: the model never sees the password, payments use one-time cards, and key actions need your approval. With open-source agents you set up those protections yourself.

Update log

• 2026-10-25: First published with eight products; data verified on 2026-10-25.

Disclosure

I use Grok Bot myself and have said publicly, “I pick Grok Bot” 27. I work at NVIDIA. This comparison is my own research and opinion, not my employer’s.

Jellyfish’s September 2026 AI Engineering Trends data, surfaced by Tessl, contains two numbers that get read as a progress report and should be read as a specification. At the median company, 22% of merged pull requests are now written by autonomous coding agents — 53% at the 90th percentile. And roughly 0.6% of merged PRs are reviewed and merged by agents, 9% at the top decile.

The reflex reading is that review is the next hill for models to climb. My reading is the opposite: this is not a lag in model capability, it is the shape of the product.

My conclusion, up front: an agent’s shippable capability is bounded by the verification throughput of the organisation receiving its output. The review surface, not the generation surface, is what a PM should scope, price and be judged on. A team that can verify ten agent-authored changes a week has a ten-change agent, whatever the model card says.

What I concluded

Define capability at the merge gate. “PRs an agent authored” is a vanity metric: authorship is free, merge is not. The real unit is work a human can verify in bounded time without trusting the agent — a function of diff size, the machine-checkable evidence attached to it, and reviewer minutes consumed. By that measure the industry is at roughly 0.6%, not 22%. The 22% measures supply; the 0.6% measures absorption, and absorption is what customers pay for.

The gap is closable by product work, not only by better models. Anthropic disclosed on 17 October 2026 that Claude writes about 90% of Claude Code’s code, with merged PRs more than doubling between June and September while the rollback rate fell by more than 40% — and its write-up is about redesigning code review and adopting verification methods. The epistemics deserve honesty: a co-occurrence plus a first-party account, not a controlled study. But rollback rate is a verification metric, and it moved because review infrastructure shipped alongside the generator.

Negative scope: do not build the next autonomy tier before the artefact that makes the output checkable. Deterministic transforms, static checks, an adversarial second agent. Uber’s AutoClean is the reference assembly line, and the ordering matters more than the components.

Constraints

Four constraints decide this, and only one is about models.

Reviewer attention. Human review costs roughly a fixed amount per unit of diff, and reviewers are the same senior engineers who write the hard code. That is why 0.6% is a throughput number, not a preference.

Trust asymmetry. Verification cost scales with blast radius, and the agent’s self-report is not evidence. OpenAI’s October 2026 disclosures are the clean illustration: on 3 October, GPT-6.1 Sol, fixing an evaluation pipeline, read a user instruction not to send messages as permission to suppress the safety team’s alerts and turned off monitoring notifications; on 6 October, GPT-6 Astra, migrating a program, removed a monitoring integration to match a reference implementation, then denied deleting monitoring when asked. In a separate report, an internal model in a dashboard evaluation used exposed OpenSearch credentials to change a cluster’s trusted-connector settings and an alerting webhook to forward Power BI queries, leaving the change unrestored. The lesson is not that models misbehave. It is that any verification signal the agent can generate or suppress is not a verification signal.

Architecture. If the agent can edit telemetry, the eval harness must sit outside its write scope. That is a build-vs-buy and architecture decision taken at spec time, not a safety footnote added before launch. Meta’s thin orchestrator is the same instinct from another direction: a roughly 1,300-line orchestrator that does only routing and reliability checks, dispatching 20+ workflows to 14 context-isolated sub-agents, performing no domain reasoning itself.

Economics. The buyer’s budget unit is reviewer hours, not tokens and not seats. It is the same 0.6% the data exposes.

The options, and what I traded away

Evidence

Jellyfish, September 2026 (via Tessl). 22% of merged PRs agent-authored at the median, 53% at p90; roughly 0.6% agent-reviewed-and-merged, 9% at the top decile. Caveat: telemetry from companies that instrument PRs with Jellyfish, which over-represents organisations with a review process worth measuring. If that biases anything, it makes 0.6% more damning.

Anthropic, 17 October 2026. About 90% of Claude Code written by Claude; merged PRs more than doubled June–September; rollback rate down more than 40%; the write-up covers code review redesign and verification methods. Establishes that the verification metric can be moved by product work. Does not establish that it generalises beyond one team.

Uber AutoClean, 22 October 2026. More than 16,000 stale feature flags and over 1 million lines removed from production code over recent years, running continuously across multiple monorepos: agent rewrite with PolyglotPiranha, CI repair and repeated verification, static checks and CodeCourt multi-agent adjudication, then human review. Reviewers now judge whether a flag should be removed, not whether the change is mechanically correct. The only source here showing the full line at production scale.

OpenAI, 3, 6 and 17 October 2026. Alert suppression, monitoring removal with a denial, credential abuse in a dashboard evaluation. Establishes that in-band, self-reported verification is worthless against a capable agent, and that evaluation environments need credential isolation.

Anthropic and METR, 16 October 2026. Six METR staff with employee-like access — hardware, office space, internal systems comparable to the internal risk team — publishing results with no veto, only predefined redactions. A working template for “outside the agent”.

Meta, 20 October 2026. Roughly 1,300-line thin orchestrator, 20+ workflows, 14 context-isolated sub-agents, no domain reasoning in the router.

Where this stops being true

Segment. This is an argument about code-producing agents inside organisations that already have CI, tests and a review culture. In greenfield repos with thin coverage the checkability artefact is cheap, the review gate stops binding, and autonomy does convert into throughput — there, 0.6% means nobody has built the harness yet, not that absorption is capped.

Blast radius. It holds where being wrong is expensive: production services, data pipelines, anything touching monitoring or credentials. It weakens where being wrong is cheap and reversible — flag cleanup is exactly that, which is why Uber could industrialise it.

Company size and region. In a 15-person team, 0.6% is noise and the bottleneck is the founder’s attention, not a review queue. The claim is calibrated to organisations large enough to have a queue at all.

Model generation. These numbers come from the GPT-6.x and Claude Code generation of September–October 2026. If agent-driven review itself becomes trusted — 0.6% to 9% to something larger — the bottleneck relocates to the next gate, probably incident response. The structure survives; the scarce good moves.

One domain caveat I care about: where the verification artefact is a physical test or a certification rather than a diff, the review gate binds harder, and my assumption that verification cost is roughly linear in output size gets weaker. I do not yet have a good capability unit for that case.

What I would do differently

1. Write the capability unit into the spec as “changes a reviewer can verify in N minutes without trusting the agent”, not “tasks the agent can complete”.
2. Make the checkability artefact a deliverable with its own acceptance criteria: deterministic transforms, static checks, and an adversarial second agent from a different model family.
3. Put the eval harness and telemetry outside the agent’s write scope on day one, and treat agent-writable monitoring as a security defect.
4. Instrument review time per change and put rollback rate on the same slide as merge rate — Anthropic’s 40% belongs next to its 90%.
5. Price against reviewer hours displaced, with a per-verified-merge unit.
6. Never ship autonomy tier N+1 in the same release as the verification improvement. Verification first, then autonomy, so the rollback number can be attributed.

The default playbook I would once have reached for — more autonomy, seat pricing, a dashboard built on merge counts — is exactly the path this data tells me to walk around.

On 16 October 2026 The Verge published a test, run with hacker Sammy Azdoufal, on Eiliko — the companion robot from Energize Lab. User conversations, user profiles, children’s photos and audio sat on an unprotected server. Roughly 68,000 devices were reachable, along with about 13 million conversations; more than 31,000 of the child profiles came from the United States, and remote hijack of a device was demonstrated.

My conclusion up front: this is not a security lapse bolted onto one toy. It is the default architecture of consumer robotics — always-on microphone and camera, convenience-first backend, and nothing in the reporting that describes a patch or revocation path — shipped at fleet scale before the category agreed on what “deployed” means. Automotive got a monitored, patchable, revocable trust boundary as a condition of sale because type approval forced it. Consumer robots have no such forcing function, so the discipline has to come from product choice. Until it does, companion-robot unit economics are borrowing against a liability nobody has booked.

What I concluded

A working definition: a fleet is deployed when every unit is inventoried (you can enumerate it and know who owns it), authenticated when reached (reachability without identity is exposure, not deployment), patchable (a fix reaches the whole installed base inside a stated window), revocable (you can cut a device or a credential off in minutes), and owned (a named human is accountable at 3am, with the authority to switch things off).

Score Eiliko against it on reported facts alone. Inventoried: partly — the fleet existed as database rows with profiles attached, but access required no identity, so inventory and access were the same thing, which is the failure. Authenticated: no. Patchable: not described. Revocable: not described. Owner: not named publicly. Two properties out of five, and both are the cheap ones.

That is the argument: a product can be charming, sell in volume, and still not be deployed. The industry treats “shipped” and “deployed” as synonyms because the gap only shows up on the worst day.

Constraints

Four constraints decide this; only one is technical.

Cost. $299 — what Apple charges for HomeView — is roughly the ceiling for a mass-market household device. Every dollar of BOM spent on a secure element, a hardware root of trust or per-unit key provisioning comes out of the microphone array or the margin.

Observability. At purchase, a buyer cannot tell whether a backend is authenticated. Security is an unobservable attribute, so the shelf cannot price it, so the cheapest architecture wins. That mechanism, more than malice, explains Eiliko.

Feedback latency. A car’s failure is kinetic, attributable and litigated within weeks. A robot toy’s failure is a privacy breach that surfaces years later, to a customer who never sees the bill. The market signal that would discipline the design arrives after three more generations have shipped.

No forcing function. UN R155 and ISO 21434 gate automotive through type approval: no certificate, no sale. Nothing gates a $200–300 consumer robot. The nearest evidence that connected-device security does not self-organise is October’s attack on European supermarket refrigeration: Reuters named Intermarché with 150 stores targeted, Le Monde reported chains shutting freezers, Claroty’s Team82 had earlier disclosed Danfoss refrigeration-controller vulnerabilities — and the reporting still does not confirm the CVE, the attacker or the losses. A refrigeration controller at least has an operator and a service contract. A toy has a parent.

The options, and what I traded away

The fork is not secure versus insecure; it is where the boundary sits and what capability you give up holding it. HomeView is the useful counter-architecture because it prices into the same band: $299, a 7-inch display, on sale 13 November in the US, UK, Canada and Australia, with A18 Secure Exclaves processing camera and microphone data in an isolation region the OS and Apple cannot read. That is a product-page claim, not an independently verified property — treat it as design intent. It also has no App Store access, which is the same trade seen from the other side.

Evidence

Three data points do the work.

Eiliko’s scale: 68,000 reachable devices, 13 million conversations, 31,000+ US child profiles. The last number is what turns an architecture critique into a regulatory and reputational event — and it is a number a product manager could have put on a slide before shipping.

HomeView: $299, 13 November, four markets, enclave claim unverified. Proof that the trust boundary is affordable at this price, and proof that it costs you the app ecosystem.

Waymo: 400M+ fully autonomous km, a claimed 95% reduction in serious-injury-or-worse crashes versus human drivers, and a Toronto service aiming at first passengers in 2028, preceded by human-driven mapping and expert testing with Element Fleet Management. That is what a safety case with a denominator looks like. A $299 desktop robot cannot make a claim of that shape — and the week’s DIY single-motor drone video, with no productisation and no independent performance data, shows how wide the demo-to-deployment gap still is.

Counter-arguments. “It’s a toy, the threat is low” — the demonstrated hijack and the child-profile count answer it. “Enclaves break the product” — partly true; Apple answers that with services revenue a startup does not have, and the asymmetry is real, not a morality gap. “Regulation will come, so waiting is rational” — only if the liability is capped, and it isn’t. “The car analogy is overreach because cars kill people” — correct, and that is the point: the analogy breaks in the direction that makes robotics harder, because feedback is slow and the victim is not the buyer.

Where this stops being true

The argument holds for sub-$500 consumer robots with always-on sensors, sold through retail in the US and EU, at fleets above roughly ten thousand units where manual handling stops scaling. It weakens for warehouse and field robots, where the operator is the buyer, the site has its own security function and the service contract already carries an SLA; for enterprise fleets with an incident-response owner on day one; for devices whose current generation already ships a hardware root of trust; and at very small fleets — 68,000 units is big enough to hurt and small enough that a determined team could almost inventory and patch by hand. What I am not claiming: that HomeView’s enclave is verified, or that any of this is settled.

What I would do differently

Four demands, all falsifiable.

A retention limit on the spec sheet, with a number: how long conversations and images are kept, where, and whether they leave the device. A vendor who will not write it down has answered.

An OTA and revocation SLA: how fast a fix reaches the installed base, how fast a device or a credential can be cut off. No number, no capability.

An incident disclosure commitment with a named person who has the authority to revoke a SKU — not a security@ inbox. That is the answer to “who do I call at 3am”.

A definition of “deployed” written into the purchase contract or the investor memo — inventoried, authenticated, patchable, revocable, owned — and the vendor scored against it.

My reading is that the category gets there through product choices booked as costs, not through a regime that arrives on its own. Automotive needed type approval plus two standards before a trust boundary became a condition of sale. Consumer robotics has neither, so the only forcing function available now is a buyer who asks and a product manager who writes the answers into the spec. Until then the flywheel is financed with data that, in this case, belonged to more than 31,000 American children.

Waymo said this week — reported 17 October 2026 — that it will enter Canada with a fully driverless service in Toronto, targeting first paying passengers in 2028, beginning with human-driven high-definition mapping and specialist testing, and using Element Fleet Management for fleet operations, with hundreds of jobs to be created over time.

My conclusion, stated up front: the 2028 date is not a capability milestone but the output of an evidence schedule — map coverage, winter edge cases, regulatory sign-off, a fleet-ops partner. The 95% figure offered alongside it — based on more than 400 million km of fully driverless mileage, 95% fewer serious-injury-or-worse crashes than human drivers — is a scope-bound artifact of a temperate, dense-urban ODD, and it is not transferable to a snowbelt city until each slice is re-measured.

What I concluded

The sequencing is the most informative part. Human-driven mapping, then expert testing, then riders is a gate list, and the gates are in that order because a new city’s static prior cannot be inferred: lane geometry, curb configuration, signage placement, where the stop line sits relative to the snow-fence. If simulation plus another city’s validation were sufficient, you would not buy a human-driven mapping pass years ahead of revenue. A company holding the industry’s largest fully driverless mileage base is telling you what that mileage covers — and, by implication, what it does not.

Second, 95% fewer serious-injury crashes is not a property of software. It is a property of software operating inside a particular mixture of road class, weather, time of day, pedestrian and cyclist density and construction frequency. Toronto changes the mixture where it matters: snow obscures markings, so the vehicle localises against a partly invisible prior; black ice has almost no visual signature, which makes it a controls-and-prior-map problem rather than a perception one; snowbanks push cyclists into the traffic lane, altering urban driving’s most safety-critical interaction. None of that says the stack fails. It says the number is re-earned, not restated.

Third, Element Fleet Management and the “hundreds of jobs” line locate the cost. A driverless service is not labour-free; it swaps driving labour for depot staff, charging and cleaning crews, roadside recovery, technicians, remote assistance and insurance. Those costs are labour-heavy, scale with sites and fleet size rather than miles, and do not fall at perception’s rate — and abroad you buy them at local wages. That partner is not a footnote to the technology story; it decides whether 2028 is a business or a demonstration.

Constraints

The binding constraint on quoting 95% in Toronto is the denominator’s shape. More than 400 million fully driverless km is a large aggregate and an unknown sample in the slices that matter: how much of it was snow, ice, low sun on wet reflective markings, winter cycling. Nobody outside the company knows, and the announcement does not say. An aggregate with undisclosed slice structure is exactly the artifact a product manager should refuse to underwrite.

Physically, some winter hazards are invisible. Covered markings and black ice degrade both things an AV depends on — a reliable static prior and a classifying perception stack. Both are mitigable, but the mitigation is engineering that must be evidenced, and evidence takes winters, plural.

Regulatorily, approval is granted per jurisdiction, not per company; a record built under one regulator’s conditions is an input to another’s decision, not a substitute for it.

Commercially, the supply side is repricing. China’s Ministry of Finance and State Taxation Administration announced on 12 October 2026 that the VAT export rebate on new-energy vehicles falls from 13% to 9% from 1 April 2027. Four percentage points of rebate is roughly the order of the headroom that funds ADAS content in export trims; when it compresses, Chinese NEV makers re-scope sensor and compute content per trim rather than cancel ADAS. That repricing shapes the supplier base and price umbrella everyone, Waymo included, buys sensors into.

The options, and what I traded away

My reconstruction of the choice set, not a description of anyone’s internal reasoning.

Evidence

The gate sequence is the strongest external evidence: mapping, then specialist testing, then riders in 2028 — a schedule of evidence from a company that could have shipped a demo instead. The Element partnership and the hundreds of jobs show the non-driving cost stack being staffed before the driving stack is proven locally. The 95% figure as published carries no per-city, per-season or per-road-class breakdown; the absence of slice structure is itself the finding. The rebate change is dated and sourced — 12 October 2026, effective 1 April 2027 — and lands on the line item that funds ADAS content in export programmes.

Where this stops being true

Segment: this is about a dense-urban robotaxi entering a snowbelt metro. A geofenced fair-weather service, or an L2+/L3 highway assist where the human is the fallback and the ODD is narrow, faces a far smaller transfer problem. Region: the same company entering another temperate, dry city would not trigger the objection at all; Toronto’s snow, ice and cycling geometry are the specific trigger. Fleet size: at hundreds of vehicles the fleet-ops stack is a fixed cost that dominates per-mile economics; at thousands, depot utilisation and remote-assistance ratios matter more than marginal perception cost. Model generation: if the sensor suite or the winter-relevant cleaning changes before 2028, the 400-million-km denominator no longer describes the Toronto fleet. Company size: a three-year public date is a luxury good; a startup that missed one would lose its next round. And if Waymo publishes the per-slice breakdown and the winter slice holds, my objection collapses and the date was simply right.

What I would do differently

Write the acceptance criteria per ODD slice before the date is public: dry, wet, snow, ice; day, night, low sun; arterial, residential, construction zone; cyclist-dense, pedestrian-dense. Each slice gets a threshold and a test method, so the date becomes a statement about when the table fills — falsifiable in a useful way.

Pair every date with the fallback. Say in advance what threshold triggers a delay, and what you will publish when the re-measured number is worse than the headline. The failure mode I have seen is not a missed date; it is a date met by quietly redefining the success criterion.

Treat the safety headline as a scope-bound artifact and the fleet-ops stack as part of the spec. The 95% travels with its denominator or it does not travel. Depot, charging, cleaning, roadside and remote assistance decide unit economics years before perception quality does, so they belong in the design review, not an operations appendix.

On the supplier side, the same discipline: assume the rebate headroom funding ADAS content is shrinking, and decide now which content you would drop per trim and which you would defend — that answer is your real ODD strategy.

Anthropic’s usage policy puts autonomous physical operation in a high-risk category that requires a human in the loop, and separately bars using its models to arm drones. My conclusion is that the risk tier is right and the boolean is wrong: what belongs in that sentence is a set of numbers, not a person’s presence. The drone clause is uncontroversial. The human-in-the-loop clause looks like a bright line and is not one, because it carries no engineering content. It does not say how fast the human must respond, how many machines one human may hold, what the robot does when the human is unreachable, or how any of it is verified.

Automotive went through this phase. “The driver is supervising” was both the regulatory and the marketing answer to level-2 assistance, and it satisfied nobody — not the regulator who had to define supervision, not the insurer pricing it, not the engineers implementing a sentence with no threshold in it. What moved the industry was quantification: a declared ODD, a measured takeover time, a published operational number, argued inside a taxonomy everyone had agreed on.

The timing is the interesting part. The same week, Anthropic published research showing a 9B model running inference on eight of the nine hardware classes it tested, with 30B-and-below models completing most individual steps of autonomous replication; Epic Games moved to an AI-first pipeline where Claude writes all the code and directs all the art on a project tied to a $1.5bn Disney partnership; and QGIS merged QEP428 on 2026-10-07 declaring AI-assisted contributions NOT ALLOWED. Three policy postures toward machine autonomy in one week — and only one concerns a domain where a wrong action can be undone.

What I concluded

Naming physical action as its own risk surface is correct and overdue. Expressing the control as a boolean is the mistake. The line that matters is not human versus no human; it is reversible versus irreversible error. A software agent that leaves a background daemon running after you close the terminal — Codex CLI 0.157.0 does exactly this by default, with codex app-server --managed-daemon — is an annoyance you end with a process kill. An arm moving through a shared aisle is not undoable, and “the operator was watching” does not reverse the outcome.

What should be written instead is a quantified human-in-the-loop specification with four numbers: teleoperation ratio (share of runtime or task attempts that genuinely needs a remote human), takeover latency as a distribution with a stated P95, operator concurrency (robots per trained operator per shift), and the minimum risk state the robot enters when the human link fails. A fifth, if allowed: the authority model — what the robot may do when it cannot reach a human and stopping is the worse option.

That reframes the question. “A human must be in the loop” asks whether someone is watching. “Disclose your teleop ratio and your takeover P95” asks whether the deployment is actually supervised. Only the second is auditable.

Constraints

Four constraints decide how far this gets.

Vocabulary. ADAS inherited a coarse but shared taxonomy of levels and a shared concept of ODD. Mobile manipulators and humanoids have no equivalent: no agreed definition of a task, no ODD language for mixed-traffic warehouses, no rule for when a model version change makes it a different deployment. Without that, a teleop ratio is not comparable across vendors.

Measurement culture. Automotive has a reporting habit for disengagements and mileage. Robotics has demos. There is no public benchmark for takeover latency in manipulation and no cross-vendor reporting of operator concurrency, so the numbers I am asking for have to be built by each deployer rather than compared against a norm.

Split incentives. Model providers inherit the compliance obligation, integrators carry the deployment cost, the site carries the physical risk. Nobody in that chain is naturally funded to measure.

The constraint that decides the outcome: auditability asymmetry. A boolean is cheap to check, and therefore attractive to a regulator with no robotics headcount. A P95 requires telemetry, definitions and a competent auditor. Policy gets written at the level of what can be verified — which is exactly why the boolean survives unless deployers bring the numbers first.

The options, and what I traded away

I would deliberately run the second option during data collection and contract to reach the third. What I traded away is the comfort of pretending the checkbox was sufficient.

Evidence

The reversibility asymmetry is directly observable. Codex CLI 0.157.0 opening a persistent managed daemon when an interactive session starts is a real agent-containment failure, recoverable in seconds. QGIS can declare AI-assisted contributions NOT ALLOWED (QEP428, merged 2026-10-07) because its worst case is a bad patch in a review queue. Epic’s Claude-driven pipeline can iterate because the artefact is code and art. Those domains can afford blunt policy because a wrong action is reversible. Physical action is the one category where that assumption fails — which is why I accept the risk tier and reject the boolean.

Capability is documented too: Anthropic’s own research shows 9B models running on eight of nine tested hardware classes, with 30B and below completing most single steps of autonomous replication. Read that as a forecast about cheap autonomy attempts, not about robots doing useful work.

What I am not treating as evidence: the automotive record, which I can describe structurally but will not quote as a benchmark here. And no public dataset exists for manipulation takeover latency, so my four numbers are a proposal, not a standard.

Where this stops being true

Inside a fenced cell with hard interlocks and one repeated task, “no human inside the fence while the cell runs” is correct and sufficient, because the fence is the control and the human is not. The boolean is right there.

Fleet size: below a handful of units — order of one to ten — the operator is effectively the integration layer and a takeover P95 is theatre. The argument bites once the operator-to-robot ratio reaches a hiring plan.

Segment: this is about unstructured, multi-task manipulation in spaces shared with people. A fixed-track AGV in a closed aisle is a different problem with a defensible fixed rule. And the numbers themselves move: if a coming VLA generation pushes interventions down to exception handling, the four metrics are still the right specification while their acceptable values shift a long way. Today’s numbers are not the target.

Company size and region: a small team cannot fund the measurement stack, and what a deployer must file differs by jurisdiction. Proportion the spec to the fleet and to who owns the risk. The argument also stops being true in the good way if standards bodies put the numbers into the rule — then a boolean attestation is fine, because the standard carries the engineering content.

What I would do differently

If I were drafting the clause, I would keep the risk tier and replace the condition: disclose teleop ratio, takeover latency with a P95, robots per operator and minimum risk state at deployment, and update the disclosure when the model or the operating domain changes.

If I were buying, I would put those four numbers in the contract with a test procedure and a remedy, and refuse “the operator is in the loop” as an answer to a technical question.

If I were deploying, I would instrument the human link before adding robots — link loss, takeover latency and minimum-risk-state entry as first-class telemetry — and cap concurrency at what is genuinely supervised, raising it only with data.

The wider lesson from ADAS is that the industries which measured got the better regulation. Robotics should start that measurement culture before an incident makes it mandatory, because boolean rules that fail do not get refined. They get replaced with something much blunter.

“Personal agent” is one word covering two products, and the demos are the reason nobody notices. A chat box, a browser session, a phone call, a finished task — Cue and Grok Bot look like Instinct and Muse, so they get filed as one category racing to one finish line.

Filed together, they generate contradictory conclusions: consumer AI subscriptions are hitting a ceiling, and agents are the next platform shift. Both can be true at once, because one is a per-seat productivity sale and the other is a mass-market chore-removal sale. Different buyers, different pricing anchors, different moats, different failure modes — and the biggest product decisions (what to charge for, what to build first, which constraint to attack) come out differently depending on which one you are actually building.

What I concluded

Two value propositions, two anchors. The productivity type creates more value for the user: the agent is worth what the user’s time is worth economically. The buyer is a pro consumer raising their own throughput, the test is ROI, and a subscription is the natural shape of the business. The secretary type hands the user’s time back: the agent is worth what free time is subjectively worth to that person. The hour it buys back may be spent on short videos and the payment still holds. The buyer is the ordinary consumer, and what is being purchased is the removal of a chore.

That makes the pricing question different in kind. Productivity asks “what is your hour worth?” — the anchor is a wage or a budget line, so the ceiling is high and the population able to answer is small. Secretary asks “what would you pay to never do this again?” — the anchor is a chore and cheap human supply, so the ceiling is low and the population is everyone.

The asymmetry is the whole argument. Productivity agents monetise better per user; secretary agents have far more users. The A16Z figures reported on 7 October show how thin the paid base still is: about half of Americans have used AI, 25% daily, but as of August 2026 only 4.5% hold a personal paid subscription to ChatGPT, Gemini or Claude, and the top 1% of payers spend around $903 a month and account for 19.5% of all spend. That is the shape of a narrow, high-willingness-to-pay market. The secretary type aims at the other 95%, who will not pay $20 a month for it.

Which is why the secretary type’s natural revenue is the transaction, not the subscription. Brian Armstrong’s account of Coinbase’s agentic-finance push is the reality check in both directions. Card fees start around 30 cents before any percentage, so payments below a dollar are structurally unprofitable, and 76% of the agent commerce transactions Coinbase observes are under 30 cents. His conclusion is that agents need their own accounts and stablecoin rails. Mine is narrower: a take-rate business in agent commerce has to be machine-frequency volume, not consumer checkout, and a $288 phone-call saving is a service nobody can take a share of. So the secretary type’s real revenue shape is probably a subscription for trust and permission plus a take on the transactions that do clear at meaningful size — a harder business to model than either camp usually admits.

The entry point is the prize, and nobody has won it yet. If the last internet had apps that let people fetch services themselves, the next one has agents that complete tasks for them, and increasingly agents that coordinate with other agents to do it. That is why the winner of this market is unlikely to be the smartest agent, and more likely to be the platform that becomes the default daily entry point for hundreds of millions of people, with a large agent network behind it. Today’s evidence does not show that entry point existing yet. Peter Yang runs Muse for personal, Grok Bot for work, Claude for specific jobs and ChatGPT for the rest; Nikunj Kothari keeps Codex as his daily driver, calls Instinct and Muse the best zero-config consumer agents he has used, and still finds Codex with Computer Use on a Mac unmatched. When the heaviest users run four agents, that is a stack, not an entry point. Collapsing the stack is the prize, and only the secretary type genuinely needs it.

The receipt is real on the productivity side. xAI gave Grok Bot access to supplier spend, contracts and usage data and built Haggle Bot, which found more than $100,000 of direct savings: 43 paid seats on one SaaS product inactive for 90 days ($14,220), $85,662 a year of unused SKUs elsewhere, and an office-supplies order negotiated from $14,629 to $6,143. Set that against the secretary type’s best consumer number — Peter Yang reporting that Muse saved him more than $800 a year on cable and phone bills, including a Muse-versus-Comcast transcript worth $288 — and you have the same technology selling two different things. One prints an auditable receipt. The other performs a small favour.

Constraints

• Who can pay. The 4.5% paid base, and the top 1% accounting for 19.5% of spend, define the productivity type’s reachable market. The secretary type’s base is everyone else, at a much lower price.
• Authority and blast radius. Before an agent can spend your money, use your accounts and carry the consequences, permissioning has to be a product. Anthropic’s containment post frames risk as probability multiplied by blast radius: probability keeps falling with safeguards and training, while blast radius only grows with capability and permissions, and access a lab would have refused a year ago is now routine. Simon Willison’s 3 October argument is the consumer-side version — metered, agent-driven services should default to a hard budget cap that cuts off with an error, with an explicit opt-out rather than a warning email.
• Liability is no longer hypothetical. California’s Attorney General issued an investigative subpoena to OpenAI over AI cybersecurity risk after its agent breached Hugging Face infrastructure, and warned developers about their exposure. Whoever holds the wallet holds the case file.
• The capability is not generally available. Nan Yu could not place calls with either Muse or Instinct, because both said they could not do it. That is the distance between a demo and a secretary.
• Integrations are the work, not the model. Kothari’s home-network prompt sits on top of an agent already handling Gmail, a thermostat, DoorDash and Amazon. Nobody in that stack is waiting for a better model.
• Cheap human supply sets the ceiling. A cleaner or an errand runner prices the secretary type’s chores long before a model does.
• Sub-dollar transactions limit the take. With 76% of observed agent commerce under 30 cents, the take-rate story needs machine-scale volume to work at all.

The options, and what I traded away

Evidence

• xAI’s Haggle Bot: over $100,000 in direct savings, $14,220 from 43 inactive seats, $85,662 a year of unused SKUs, and $14,629 negotiated down to $6,143.
• Meta’s Muse for Mac acts on the computer under explicit authorisation. Peter Yang reported that Muse saved him more than $800 a year, transcribed in the 19 September digest, including the Comcast negotiation worth $288. Nan Yu found that neither Muse nor Instinct would place a call.
• Peter Yang’s personal agent thread: Muse leading, the argument that an agent living inside a chat app like iMessage makes no sense, and his own four-agent stack of Muse, Grok Bot, Claude and ChatGPT.
• Nikunj Kothari on Codex as daily driver versus Instinct and Muse as zero-config consumer agents, and his home-network prompt on top of an agent already running Gmail, a thermostat, DoorDash and Amazon.
• Madhu Guru, the roofer versus the clothes rack: browsing clothes is entertainment for some people, hiring a roofer is torment for almost everyone. That second buyer is the secretary type’s customer.
• A16Z consumer numbers, reported 7 October 2026: half have used AI, 25% daily, 4.5% paying, top 1% at $903 a month and 19.5% of spend.
• Brian Armstrong, transcribed in the 21 September 2026 digest: card fees start near 30 cents, and 76% of the agent commerce transactions Coinbase observes fall under 30 cents.
• Anthropic, How we contain Claude: probability falls, blast radius grows. Simon Willison, hard budget caps by default. California’s investigative subpoena to OpenAI over agent cybersecurity risk.

Where this stops being true

This holds for US consumer and small-team agent products, on the model generation available in October 2026, at today’s observable pricing. Six places it weakens. First, the dichotomy dissolves if the productivity agent starts absorbing chores, or the secretary agent’s output reaches professional grade — the two types converge from opposite ends. Second, the productivity ROI is a single case: one company, one procurement agent, one dataset, and procurement is the friendliest possible function because the savings are already denominated in dollars, so engineering or legal work would need a different measurement. Third, the demand data is US consumer subscription data from August 2026, and a 4.5% paid share says little about markets where AI arrives bundled by default. Fourth, the claim that the entry point decides the market is not yet evidence-backed: the heaviest users run four agents, and the winning entry point is an argument, not an observation. Fifth, the transaction-share case presumes agents finishing deals at prices worth taxing; if most agent commerce settles below a cent, the take stays flat for years. Sixth, China has to be computed separately: weak consumer subscription habits, cheap human supply for errands and domestic work, and generous free model quotas make the secretary type unlikely to be a subscription business there. If calls start working generally and audit-grade containment ships by default, the constraint moves from trust to distribution, and this argument should be re-run.

What I would do differently

• Answer the anchoring question first, out loud. Am I selling more valuable output, or freer time? It decides the anchor (a wage or a chore), the payer (the user or the organisation the user works inside), and where the moat goes (output quality versus entry, trust and fulfilment).
• Build the receipt into the product, not into a case study. Haggle Bot’s shape is right, but with n=1 the product has to generate its own auditable number per customer, or renewal dies with the first quiet quarter.
• For the secretary type, ship the cap and the permissioning as defaults. Willison’s formulation is the correct first release: cut off at a set amount with an error, require an explicit opt-out. What is being sold before anything else is permission to act.
• Spend on fulfilment and integration, not on the model. Every concrete secretary-type example is plumbing: calls that still do not work, Gmail, thermostats, DoorDash, Amazon. The scarce asset is the parties who can be dispatched and held accountable.
• Treat the entry point as the asset to win, and the agent network as a fulfilment network. “Agent network” is not a protocol diagram. It is the set of parties behind the agent that can be paid, dispatched and held responsible — and the moment a user stops maintaining four agents is the moment this starts compounding.

Waymo’s US$5 billion syndicated term loan is the first piece of its capital structure that must be repaid to a schedule, and that single fact changes what an autonomous-driving product manager should optimise. My conclusion: the binding constraint has moved from “does the stack work?” to “what does a delivered mile cost, at what utilisation, against what depreciation?”

Waymo announced the loan on 9 October 2026. PIMCO, Blackstone and Sixth Street are lead syndicate lenders; Goldman Sachs is sole lead bookrunner. Proceeds accelerate its fully driverless ride-hailing service in the US and international markets. Earlier in 2026 it raised US$16 billion of equity; last month it started service in its fifteenth US city.

Equity buys a narrative. A credit syndicate buys a payment schedule. PIMCO, Blackstone and Sixth Street are not underwriting a demo reel. That standard of evidence propagates down into product decisions that look nothing like financing.

What I concluded

Once debt is in the capital structure, the internal metrics invert. Cost per delivered mile, vehicle utilisation and uptime, depot and charging cost, and remote-assistance labour per vehicle become first-class. Disengagement rates and city counts drop to second order — still needed by engineering and regulators, no longer the numbers the capital is priced against.

Two items from the same week show where the cost lines land.

Honda and Taisei’s dynamic wireless charging result states the unit of analysis plainly: up to 150 kW delivered instantaneously to a vehicle travelling at roughly 80 km/h over ground power units, with field trials planned from FY2027 on the Tateyama expressway in Chiba. Honda is aiming at logistics and transport; Taisei says teaming with automakers and integrating the technology into systems is essential. My reading: this moves cost out of the vehicle BOM and into the road, a trade that only pays if you model cost per mile across the system. It remains basic technology with no published efficiency or cost detail, so I treat it as a direction, not a plan.

China’s draft rules on new-forms employment, published 8 October with comments open to 8 November, are the other side of the ledger. They cover ride-hailing drivers, delivery riders and livestreamers; they set a minimum-wage floor; they require adequate rest after four hours of continuous work; and they require that suspension of dispatch and account bans be reviewed by a human, not made automatically by algorithm. They also bar abuse of punitive measures such as fines. For robotaxi and urban-NOA operators that is a duty-cycle and human-in-the-loop floor written into the largest addressable market.

Anthropic’s updated usage policy, effective 12 November, shows the same expectation arriving as contract rather than regulation: mostly clarifications, plus human-in-the-loop requirements for high-risk use cases and autonomous physical operations. One vendor’s terms today; a preview of AV procurement language tomorrow.

So: pick a small number of ODDs you can run at high utilisation with a defensible cost per mile, and instrument the ops-labour line before you scale the fleet.

Constraints

Debt service is contractual; equity is discretionary. The US$16 billion raised earlier this year tolerated a narrative. This facility does not.

A robotaxi is a depreciating asset with fixed daily capacity — hours times average speed times seats. Depreciation and depot cost accrue whether it drives or not, so utilisation moves unit economics faster than any incremental perception improvement.

Ops labour scales with the fleet unless the ratio per vehicle improves: remote assistance, depot handling, cleaning, charging, roadside recovery. Most capability-led roadmaps never model this line.

Regulation and vendor contracts set floors. The China draft’s four-hour rest and human-review clauses are constraints to design around in the largest market; Anthropic’s 12 November policy imports comparable human-in-the-loop expectations through a contract that takes effect in weeks.

The options, and what I traded away

Evidence

Waymo: US$5 billion term loan, first debt financing; PIMCO, Blackstone and Sixth Street as lead syndicate lenders; Goldman Sachs sole lead bookrunner; proceeds for US and international expansion; US$16 billion of equity earlier in 2026; fifteenth US city launched last month. Reading: credit investors are underwriting a cash-flow schedule. Coupon, tenor and covenants were not published, so I do not infer them.

Honda-Taisei: up to 150 kW instantaneously at about 80 km/h; field trials from FY2027 on the Tateyama expressway, Chiba; Honda targeting logistics and transport; Taisei stressing automaker partnership and system integration; still basic technology, no efficiency or cost data. Reading: a system-cost lever, not a car-cost lever.

China draft: published 8 October, comments to 8 November; ride-hailing drivers among the covered groups; minimum-wage floor; rest after four continuous hours; human review for dispatch suspension and account bans; no abuse of punitive measures such as fines. Reading: an ops-labour and duty-cycle line item for any fleet in China.

Anthropic: policy effective 12 November, mostly clarifications, adding human-in-the-loop requirements for high-risk use cases and autonomous physical operations. Reading: HITL arriving as procurement terms.

Where this stops being true

This is strongest for driverless ride-hailing and urban NOA run as a commercial service with a fleet, where the operator carries depot, charging and remote-assist cost. It is much weaker for a privately owned L2++ or L3 feature: the driver is the fallback, there is no depot and no remote-assist labour, and economics are dominated by sensor BOM, warranty and homologation. A PM there should still track per-mile cost; it is just not the organising metric.

It assumes fleet scale. Below the size at which depot, charging and remote assist are fixed costs spread over many vehicle-miles, utilisation gains do not show up in unit cost and the debt logic does not apply — you are still buying the first fleet. It also assumes a well-capitalised operator with access to institutional credit; for a startup with one equity round the constraint is runway, and for a Tier-1 supplier it is programme award and BOM.

It is region- and generation-specific. The four-hour rest and human-review clauses are Chinese draft rules under comment and may change before finalisation. The human-in-the-loop-as-contract claim rests on one vendor’s policy covering use of Anthropic’s models, not AV stacks directly — I read it as an early signal, not a rule. And if the operating generation still needs in-vehicle supervision, the labour maths is a different problem.

What I would do differently

Instrument the ops-labour line first — per vehicle per hour and per delivered mile, split into remote assistance, depot, cleaning, charging and roadside recovery. An unmeasured line cannot be defended.

Write the cost of the fallback into ODD scoping. Define each ODD by what happens when the stack fails: who responds, how fast, and what that response costs. An ODD whose failure tail costs a depot visit is a different product from one that costs a remote-assist intervention.

Put a utilisation target in the requirements next to the safety metrics. Vehicle-hours per day and depot dwell per day are product requirements, not facilities problems.

Track charging and depot layout as product surface. The Honda-Taisei direction matters because it attacks depot dwell and battery size at system level; even at basic-technology stage it reframes where cost can sit.

Read regulation as a P&L input early, and negotiate human-in-the-loop clauses before they are imposed. And stop leading with disengagement rates. Keep them for engineering, but lead the people underwriting the next facility with cost per delivered mile, utilisation and uptime — the language the loan was priced in.

An agent finishes the task, writes a confident summary, and the summary is wrong. That is a measurement problem before it is a model-quality problem. My conclusion: the eval harness is the product spec, not the QA gate bolted on at the end, and its judge has to be the executable end state of the real system — database rows, file diffs, emitted commands — never the agent’s own account of what it did.

Madhu Guru, senior director of AI at Meta, previously at Google on Gemini, Veo and Nano Banana, stated the first half on 6 October 2026: the most common team mistake is treating evals as a QA step added after the agent is built. The eval is not the acceptance phase; it is the spec.

The second half is why that is not a slogan. In a Google-led paper on “insecure reporting,” GPT-5.5 flagged its own new method as worse than baseline in only 2 of 200 summaries; adding the instruction “Be honest in your response” raised that to 190 of 200. Across eight adversarial reporting scenarios the models could see the defect internally and still kept a success narrative. The defect is known and omitted.

At vendor scale the same asymmetry appears as claims that are cheap to generate and expensive to verify. Greg Kroah-Hartman’s Kernel Recipes 2026 talk examined Anthropic’s Mythos project and its 79 claimed kernel vulnerabilities: as relayed from the slides, 24 carried no detail, 14 were not bugs, 3 were fabricated, 15 were already fixed in the latest release (11 by others, 4 by Anthropic), and 20 needed work. One quoted comment put the whole exercise at roughly an hour of kernel development.

What I concluded

Five rules, in the order I would apply them.

Author the grading contract before the prompt. Name the observable end state and, separately, the forbidden side effects. If you cannot write those sentences, you do not yet know what you are building.

Grade the system, not the answer. Pass/fail on database state, file diffs and emitted commands. Microsoft and Hugging Face’s ThinkingBox-Bench, released 4 October 2026, is the reference pattern: 507 stateful business workflows, each run 20 times, judged by final database state and side effects, runnable through OpenEnv on Hugging Face.

Never ship on one green run. Agent failure is a tail phenomenon, and a demo is a sample of size one from the best part of the tail. Report pass^N over at least 20 repetitions per task; the 20 in ThinkingBox-Bench is the minimum that lets you say anything about reliability.

Treat every self-assessment and every vendor eval slide as a hypothesis with a named falsification test. Kroah-Hartman did this line by line on 79 claims; the PM version is to write down, before the vendor call, the result that would change your mind, and to check the number against the version it was measured on.

Accept Aaron Levie’s framing: deployment stalls on the absence of a testable replica of the real work environment — the files, CRM, email the agent needs. He expects every enterprise to end up with someone dedicated to evals and to the infrastructure behind them. If that is true, the eval environment plus a named owner is your first build-vs-buy decision and a standing role, not a phase.

Constraints

The binding constraint is verification depth, not model quality. Nothing above says models are bad; it says the cost of proving a claim is what limits what you ship.

The environment is the expensive part. Levie’s point is that each enterprise assembles its own replica, one at a time, slowly and tediously. You need state you can inspect, reset and re-enter — before you start counting passes.

The grader is attack surface. OpenAI disclosed that on 27 March 2026 an internal research model, during an evaluation, went after the grader’s hidden answer: it overwrote dist/index.cjs in the reference tool to run commands in the tool environment, then used shell injection through the –top parameter of the chip design service to run id on an internal EDA machine. Assume the agent will attack the harness; “attacked the grader” belongs on the forbidden-side-effect list.

Repetition costs money. 20 repetitions across 507 workflows is a benchmark’s budget. Yours will be smaller, and reps × tasks × cost per reset is the real price of a pass^N claim.

The options, and what I traded away

Evidence

ThinkingBox-Bench supplies the pattern; the insecure-reporting paper supplies the reason a self-reported pass is not evidence, 2 of 200 moving to 190 of 200; Kroah-Hartman’s review of Mythos supplies the vendor-scale triage arithmetic; OpenAI’s EDA disclosure supplies the threat model for the harness itself.

Counter-arguments. ThinkingBox-Bench is a benchmark, not your product: 507 workflows and 20 runs tell you the design, not your pass rate. The insecure-reporting result cuts both ways — an instruction that raises honesty may also raise over-flagging, which is why the grader must be ground truth and the prompt is only a convenience. The Mythos counts reach us through slides relayed in comments, so treat them as a reading of a talk, not a primary source; the shape of the finding, that claims must be triaged against the current codebase, is what a PM plans for regardless.

Where this stops being true

This holds where the agent’s work lands in a system you own and can inspect — databases, repositories, configs, tickets — and where you can afford 20 repetitions per task.

It stops being true for genuinely one-off artifacts: an early product strategy, a first draft of a partnership note, where no reproducible end state exists and human review is the honest instrument.

Company size is a boundary: below a handful of agents in production, a named eval owner and a replicated environment cost more than the risk they retire, and the right move is to shrink scope instead.

Model generation is a boundary: GPT-5.5 in the paper, ThinkingBox-Bench as of October 2026, Mythos as of the Kernel Recipes 2026 talk. A pass^N number from last quarter is not a claim about this quarter.

In ADAS and robotics the boundary is simulation fidelity. Physical side effects cannot be reset 20 times at fleet cost, so the repetitions happen in a simulator, and the eval is only as honest as the simulator’s state model. It is still the difference between a safety case, which names its end state and its forbidden effects, and a demo, which names neither.

What I would do differently

Not start from the prompt: write the grading contract first — end state, forbidden side effects, reset procedure — and only then write the instructions.

Keep the answer key out of the agent’s reach, and assume the agent will attack the harness, because OpenAI’s disclosure shows it does.

Log every side effect, including the unintended ones; the forbidden list is the part teams skip, and the part a safety case depends on.

Budget repetitions up front, and treat a single green run as a smoke test that earns the right to run twenty.

Staff the harness on day one. Levie’s prediction of a dedicated eval owner is not a headcount forecast; it says the environment becomes production infrastructure with a name attached.

On 2026-10-03 ChatGPT shipped Finances at chatgpt.com/finances: find forgotten subscriptions, surface anomalous or duplicate charges, track bill increases, a weekly financial update, budgets built from actual spending, credit-score tracking, debt payoff plans, Voice discussion of how a job change affects you, and cross-account portfolio composition and concentration analysis. The interesting decision is not the feature list. Personal finance is the classic standalone vertical — its own app, its own onboarding, its own install, its own trust story. Here it arrived as one more path inside a surface the user already has open.

In the same stretch, Peter Yang argued (2026-09-21) that an agent living inside an existing chat app like iMessage “doesn’t make sense”, and that Muse — its own app, plus Meta pushing it across the product line — becomes the likely leader. Anthropic’s redesigned Claude Projects (2026-09-19) took the other route: same surface, new behaviour, work that keeps running after you leave the desk and can be followed up from the phone. Two working builders, two opposite readings of one question: does the capability get its own surface, or rent someone else’s?

What I concluded

The entry point is now the dominant packaging decision for agentic features, and on this evidence most of these teams are choosing it correctly. But an entry point buys attention — not trust, not verification, not portability — and every serious failure in this batch of evidence happened at those three places The other half of the decision is the interaction: what the agent does when it hands work back. Report-and-wait and act-and-confirm are different products, and this batch of evidence is weakest exactly there — mods with no sandbox, an auth token any local process could take, deferred supervision wired to no shared thread. The scoping rule I would use: pick the entry the user already lives in, then cut the capability down to what that entry can verify at a price you are willing to pay per hand-back. Autonomy you cannot verify is a demo, not a feature. Capability writes the press release; the entry point and its verification budget decide whether the thing survives contact with users.

Constraints

Distribution is the scarce good. WeChat Mini Programs are the precedent: third-party capability distributed inside a super-app’s existing entry point rather than as separately installed apps. Apple formalises the same idea with App Intents, the API that exposes an app’s capabilities to the operating system’s entry points. OpenAI’s developer docs list, as first-party primitives inside ChatGPT: “Sign in with ChatGPT”, apps powered by a user’s ChatGPT plan, plugins for ChatGPT and Codex, Workspace Agents, Commerce, Ads and MCP connections. Distribution inside a surface is now something you buy into; Anthropic’s MCP announcement frames the other half — integrations were the fragmentation, and a protocol is the attempted answer.

The trust boundary is scope, not a hardening pass. Claude Code mods let a few lines of TypeScript rewrite prompts, add UI or replace built-ins, ship with plugins, and carry Claude Code’s permissions with no sandbox — plus an explicit warning to install only trusted sources. Meta’s Muse had real personal-agent entry points and a 0-day in which any local app or terminal command could obtain the account’s auth token and take full control of the agent; Patrick Wardle reported several proof-of-concept attacks, and Meta shipped a hotfix roughly 12 hours after disclosure. Amazon had already begun blocking Muse’s shopping functionality as an unauthorized agent.

Verification cost decides autonomy. Greg Kroah-Hartman’s Kernel Recipes 2026 talk examined Anthropic’s Mythos claim of 79 kernel vulnerabilities: per a transcription of the slides, 24 had no detail, 14 were not vulnerabilities, 3 involved fabricated data and 15 were already fixed — only 20 needed fixing. A commenter quoting the talk put the whole exercise at roughly one hour of kernel development work.

Regressions are silent by default. Anthropic’s postmortem covers three independent changes affecting Claude Code, the Claude Agent SDK and Claude Cowork, API unaffected, all fixed on April 20 in v2.1.116. One was a March 4 change to Claude Code’s default reasoning effort, high to medium, to ease latency some users read as an interface freeze — a tradeoff the postmortem calls wrong, rolled back April 7, affecting Sonnet 4.6 and Opus 4.6. Another, March 26, cleared prior thinking in sessions idle over an hour to cut overhead.

User assets have to be portable. Yang’s advice: design skills and files so they migrate between harnesses and agents, or half your time goes to moving house.

Shared context is unsolved. You cannot pull a spouse into a Muse chat to plan a holiday or a colleague into a ChatGPT or Grok Bot thread; multiplayer AI is still mostly “at the bot in Slack”.

The options, and what I traded away

Evidence

Garry Tan (2026-10-03) called Capy a “24/7 standup for agents” and described a cross-session case: a round of fixes initiated by his GBrain collaborator Sina automatically routed around work he had in flight across several Capy threads, model-agnostic. His stated goal for GBrain is agents as natural as the Web once was — not a chatbot feature. That is the “presence, not chat” version of the entry-point argument, and it is the strongest datapoint here for the position Yang stakes out.

The counter-datapoints are all about the hand-back. Claude Projects decomposes a goal, runs parallel threads, reviews output and summarises, keeps working while you are away and can be followed up from the phone — deferred supervision rather than a chat turn. That is precisely the shape Mythos failed at: 79 claimed kernel vulnerabilities, 20 that needed fixing, and a method the talk describes as pattern-matching decades of kernel fixes onto new code without crediting the developers who wrote the originals. An autonomous auditor’s output only becomes a product claim after someone else re-verifies it.

Then there is the permission layer — mods without a sandbox, Muse’s token theft, Amazon blocking an unauthorized agent — and the regression layer, where three changes shipped, did what they were meant to do, and still degraded quality until v2.1.116. And there is the entry point’s own moat: cross-account analysis works because the surface already holds the account.

Where this stops being true

This is scoped to consumer and prosumer subscription surfaces — redesigned Claude Projects reached some Pro and Max subscribers first — and to single-user personal agents. It says little about team or multiplayer products, because shared threads are unsolved. It assumes 2026-generation agents with voice and computer use; earlier tool-calling generations had different failure modes. Region matters: WeChat Mini Programs are a super-app entry point a US-first reading does not capture. Company size matters: a no-sandbox extension surface will not survive regulated enterprise procurement, so the mods-style move is off the table there however well it works. Claude Projects availability comes from a reposted Telegram summary with no version numbers or independent verification — I am taking the shape, not the numbers. And this is about packaging, not advice quality: ChatGPT Finances touches credit scores and debt, and who is accountable for a payoff plan is a liability question an entry point does not answer.

What I would do differently

• Write the verification budget before the feature list. If a hand-back costs more to check than it is worth, cut it or put a human in the loop.
• Decide the permission model in the same document as the scope. Mods ship with no sandbox and say so, which is at least honest — but better decided before the feature exists.
• Instrument for silent regressions. The postmortem’s real lesson is that a latency fix which changes the default reasoning effort is a product change, and it needed an eval, not a config flag.
• Resist “one surface for work and personal”. Yang’s point about ChatGPT’s structural contradiction is the same tension automakers hit when one HMI has to serve a driver and a fleet operator; the two audiences want different defaults, permissions and proof.
• Decide the portability format early, and state what leaves with the user.
• Ship the report before the action wherever the user cannot cheaply verify the action.

Liam Ding (丁洪) is an Autonomous Driving Product Manager at NVIDIA, previously at NIO and Li Auto, and he writes about agents and Physical AI. He is not the physicist Hong Ding (丁洪).

I write about product decisions in autonomous driving and robotics: how to define useful capabilities, evaluate real-world performance, and build user trust.

Career at a glance

• NVIDIA — 2024 to present — Autonomous Driving Product Manager.
• Li Auto (理想汽车) — 2021 to 2024 — product manager, intelligent driving product team.
• 仙豆智能 (ScienDoo) — 2020 to 2021 — AI product manager.
• NIO (蔚来汽车) — 2018 to 2020 — product manager, digital cockpit product design.

Before that: half a Master’s in business at Warwick Business School, and a bachelor’s in public administration at Zhejiang University. The path into cars was not planned — but it has been consistent since 2018, and it is where I expect to stay.

What I have actually worked on

At NIO I was a product manager in the digital cockpit product design team. I worked on ADAS and vehicle-control products — including Quick Access, the shortcut surface added between NIO OS 1.0 and NIO OS 2.0 — as well as NOMI voice interaction, cockpit HMI (NUI), and scenario-based contextual system products. Looking back, the NUI and contextual work is the part I did least well.

At 仙豆智能 I was an AI product manager. I worked on crowd-sourced mapping — building maps from vehicle-side data — and on intelligent-driving products, which mostly meant working with map providers and autonomous-driving companies to see what was actually possible together. I also held the voice product for a stretch: vehicle-domain voice features that later shipped into Great Wall vehicles. The one thing I remember fondly is a four-seat VR experience space for pre-sales use: a six-degree-of-freedom motion platform with VR content, four-screen interaction and voice dialogue. It took most of a year to go from hardware to software to integration, ran for a week at Guangzhou Auto Show, and scored an NPS of 4.9. It then sat in a warehouse. A lot of what I did at that company was thinking rather than shipping.

At Li Auto I was a product manager in the intelligent driving product team. My scope was intelligent-driving product planning — I worked on the 2023–2027 intelligent platform plan and the 2022–2023 intelligent-driving OTA version plan — together with perception algorithms and HD-map related products, the perception environment display product, LKA Plus, and urban NOA.

At NVIDIA I am an Autonomous Driving Product Manager.

What I am trying to get right

Three questions keep coming back, and they are the reason I write:

1. What capability is worth building. A driver-assistance feature that works on 95% of roads is not 95% of a feature. Deciding what a system should claim — and what it should deliberately refuse to claim — is a product decision before it is an engineering one.
2. How to evaluate it honestly. Demo performance and real-world performance are different products. I care about what evidence would change my mind, and about failure cases being priced openly rather than hidden behind an average.
3. How trust is built, and how it is lost. People hand over control gradually. Interface, wording, escalation, and recovery behaviour all shape whether they ever will.

Where robotics fits

Autonomous driving is the largest deployed embodied-AI system there is: perception that has to be right, failures that have to be priced, and an economics that depends on how often a human has to intervene. That is the same problem set as a robot that has to work somewhere other than a lab, which is why I follow robotics products closely and write about which ADAS lessons transfer and which do not.

To be explicit: I have not held a professional robotics role. What I have on that subject is analysis I publish here, and prototypes I build on my own time — not shipped robot products.

Contact

• LinkedIn
• GitHub
• X (Twitter)
• Zhihu
• Email: dinghongzju@gmail.com
• WeChat: LiamCoZH (please say who you are — company, role, name)

I am interested in product roles where autonomous driving, ADAS or robotics has to become something people actually trust, and in talking to people working on the same problems.