By Zheng Tian, Alibaba Cloud Agent Technical Expert
This article was first published by DataWhale and is included in the open-source Alibaba Cloud AI Agent Handbook. Because it is lengthy, the following page provides a better reading experience: https://aliyun.github.io/ai-agent-handbook/cases/personal-agent/
Personal Agent products were released in rapid succession in September 2026: Meta Muse on September 8; Manus 2.0 and Cue on September 28; and OpenAI dots on September 29. Grok Bot had launched on August 11, expanded individual and team eligibility twice on August 21 and 26, opened to enterprises on September 3, and introduced Team Bots on September 28.
Chinese vendors are also preparing follow-up launches. This dense release schedule indicates that models, cloud execution environments, application connectivity, and long-running task management are being packaged into complete user-facing products. These products generally aim to keep advancing tasks after users leave the page. They connect to email, calendars, and browsers; some can access payment tools or even have their own phone numbers. Some run on schedules, some start when an email or another external event arrives, and some retain project knowledge across tasks. The primary interface for assigning work is therefore no longer just a live conversation; it also includes task lists, approval pages, schedules, memory management, and execution records.
This article examines why Personal Agents have become a new competitive frontier for AI applications, the underlying technologies, and the possible directions for subsequent development in China.
The latest Personal Agent released with Manus 2.0: Cue
Personal Agents are not the first Agents capable of calling tools, running in the background, or saving memories. Early Manus could already accept a goal and use browser, file, and coding tools in the cloud to complete it; OpenClaw already supported long-term memory, scheduled tasks, and periodic wake-ups. The main change is in product organization: some vendors now build around a specific user, integrating a persistent runtime environment—a real computer—with personal identity, triggers, approvals, and memory management in one product.
Conventional chat assistants are generally centered on the current session. A user asks a question, and the system produces an answer, recommendation, or draft. Even when tools are available, tasks are usually initiated from the current conversation, while the user still decides whether and when work should continue.
Early Manus was closer to a cloud task executor. The user supplied a clear goal, and the system called browser, file, and coding tools in an isolated environment, ultimately delivering a report, website, or other result. Later additions—Sandbox, Cloud Computer, Project, and Schedules—added isolated environments, persistent machines, project knowledge, and scheduled execution. Its primary product objective, however, remained completing a task assigned by the user.
OpenClaw is closer to a self-deployable, configurable personal Agent runtime. It supports long-term memory, a heartbeat by default roughly every 30 minutes, and a task scheduler persisted in its gateway. Users can deploy it on a personal computer or server, connect messaging channels, and configure cron, Webhooks, tools, and permissions. In return, users assume more responsibility for the runtime, configuration, and security.
The Personal Agent products that appeared in 2026 turn these capabilities into complete products for general users. Some provide the Agent with a dedicated email address, phone number, or wallet; some give each user an isolated cloud computer connected to email, calendars, browsers, and payments; and products also provide task lists, approval pages, memory management, schedules, and execution records. They aim to let one Agent retain necessary information across tasks, resume work when a time or external event arrives, and let users inspect and revoke permissions. Support for these capabilities varies across products.
| Aspect | Conventional Chat Assistant (Chatbot) | Manus1.0 | OpenClaw | Personal Agent |
|---|---|---|---|---|
| Primary Unit of Organization | Current conversation | A clearly defined task | User-configured runtime and sessions | A product used continuously by the same user |
| Primary Capabilities | Answers, recommendations, and draft generation | Execute multi-step tasks in the cloud and deliver results | Self-hosting, tool integration, memory, and scheduled tasks | Integrate the execution environment, personal data, triggers, approvals, and memory management |
| How It Starts | The user starts a conversation | The user creates a task | User messages, heartbeat, cron, Webhooks, and more | User initiation, scheduled conditions, email, or other external events, depending on the product |
| Identity and Personal Data | Primarily uses the current account and session information | Primarily authorized only as required by the current task | The user configures channels, accounts, and local files | Some products provide an independent identity or maintain long-term connections to personal applications and data |
From an implementation perspective, current Personal Agents can be divided into roughly four parts.
The first part is the Agent runtime kernel. It includes the underlying model and the Harness built around it, which handle planning, memory, task scheduling, and tool calls.
The second part is an independent execution environment. A Personal Agent that can work continuously usually needs a computer of its own, such as a dedicated Linux desktop, and must be able to operate a browser, manage multiple tabs, and handle resource consumption like a person. In practice, when too many pages make the system sluggish, it must proactively close unused tabs before continuing.
The third part is the tool and service ecosystem. An Agent needs access to a sufficiently rich set of external tools to complete real tasks. Email, calendars, financial software, and similar services outside China typically offer relatively open APIs, whereas capabilities in China are concentrated more heavily in super-apps and government-service platforms. Although the latter aggregate rich capabilities such as information feeds, payments, lending, and public services, their interfaces remain comparatively closed overall.
The fourth part is the digital identity required to participate in the real world. To move from “operating software” to “handling affairs on a person's behalf,” an Agent also needs accounts, payment instruments, and communication numbers that real-world institutions can recognize and authorize. Internet telephony only lets an Agent make calls; a real mobile number and payment account let it register for services, verify identity, place calls, and even complete transactions.
| Product | Release | Core Form | Identity and Permissions | Persistence / Memory | Execution and Collaboration |
|---|---|---|---|---|---|
| Cue | 2026-09-28 | Standalone Personal Agent application | Email, phone, wallet, and computer; controlled payments | Event automation; limited public detail on long-term memory | Primarily cloud-based, with controllable local devices; multi-Agent group chat |
| Wajo Fo | 2026-08-25 | Action-oriented Agent with human fallback | Dedicated email, phone, voice, and payment tools | Long-term proactivity and adaptation through feedback | Cloud execution, with bottlenecks handed off to human assistants |
| Instinct | 2026 | Lightweight workbench centered on phone and messaging | Dedicated email; emphasizes a trusted network among Agents | Connects to email, messages, and device signals for proactive follow-up | Cloud-based, focused on coordination across parties |
| dots | 2026-09-29 | Resident agent powered by GPT-6 Astra | No dedicated email yet; external actions pass through Auto-review | Scheduled, event-driven, and proactive research; separates tasks from persistent memory | User-isolated cloud workspace with optional local computer; initially one primary dot |
| Meta Muse | 2026-09-08 | Persistent cloud-computer Agent | Some identity capabilities; dedicated email planned as a later extension | Persistent individual context for advancing long-term goals | A dedicated Linux virtual machine (VM) for each user, with parallel requests and side chats |
| Gemeni Spark | 2026-05-19 | 24/7 Agent inside Gemini | Authorized through a Google account | Three scheduling modes: time, Gmail conditions, and topic events | Dedicated Google Cloud VM with remote control of a Mac |
| Grok Bot | 2026-08-11 | Multiple persistent Bots in a team | A user's Bots share an account-level cloud computer | Role memory, shared group-chat context, schedules, and events | Shared cloud computer with division of labor among personal and team Bots |
| Manus | Since March 2025 | An evolving platform for general-purpose task Agents | Primarily uses user authorization rather than an independent identity | Scheduled tasks retain context; Projects update themselves | Task Sandbox, Cloud Computer, and Wide Research sub-Agents |
| OpenClaw | 2026-01 | Open-source, self-hostable personal Agent | Uses channel identities; permissions and approvals are configurable | Markdown, SQLite indexing, heartbeat, cron, and Webhooks | Personal computer or server, with primary and sub-sessions |
| Today.ai | 2026 | Everyday assistant with manageable memory | Partly identity-enabled; external actions require confirmation | Morning briefings and evening wrap-ups; memory can be viewed, edited, and deleted | Persistent cloud computer, single Agent |
Based on my own experience, Grok Bot currently offers the most complete feature set and can indeed work around the clock. I often ask it to curate posts and trending content, and it does an excellent job. Its computer is also very powerful, although Grok Bot is correspondingly more expensive. OpenAI dots has the advantage of Codex integration, and Pro users currently receive unlimited usage.
Cue has gone relatively far along this path. Manus announced the standalone application with version 2.0 on September 28, 2026, giving each Agent an email address, phone number, wallet, and computer. It can send and receive emails and messages, make payments within user-controlled permissions, and keep working after the user leaves. In the official example, multiple Agents investigate venues for a New York launch event in a group chat, shortlist candidates, and prepare a presentation. Offline, users can scan a merchant's QR code to create an Agent for that business, which can book a table, order food, or queue on the user's behalf. The website shows connectors including Trip.com, Oura, Gmail, and MyFitnessPal; early access is free and invitation-only.
 |
 |
 |
▲ Figures 1–2: Cue's QR-code creation of merchant Agents, cross-device workspace, and multi-Agent collaboration
Nearly all concrete feedback currently points to deployment friction rather than task success rates:
• Phone service is not completely free. Some users found after installation that it already cost $9.90 per month. The first month is free, after which pricing starts at about $20; on price alone, Muse is more attractive.
• The phone capability has been described as “bolted on”: some popular countries cannot receive SMS messages, and the number's country is tied to the current proxy IP, so changing regions requires changing the VPN first. The official documentation has also stated that phone service is available only in certain regions and that some locations support voice calls only.
• Sandbox Ips: restarting the container changes the “residential” IP. One user received Pakistan, Egypt, and Vietnam across three attempts; others received the Philippines and Colombia, while major Western countries were almost never available.
• Product form: some users who downloaded Cue said it essentially separates capabilities from the original Manus Agent panel into a standalone app; the next question is whether its tokens and quota are sufficient.
Wajo launched Fo on August 25, 2026. It is positioned as an action Agent that “gets things done,” with its own phone, email, voice, and single-use payment card; neither merchants nor Fo can see the user's real card. When blocked, it transfers the task to a human assistant. Public access opened on September 28 with the free Fo Mini (daily task limit), invitation-only unlimited OG, and on-demand Pro pricing. The website reports about a 71% completion rate and a 94% trust rate on 104 internal real-world errands. Founder Shivani Poddar has experience at CMU, Meta, Google DeepMind, and Google Labs, but Fo is not a Google product.
Its representative design formalizes handoffs between humans and machines: when automation reaches a bottleneck, a task can be transferred to a trained human executive assistant, who handles the real-world step that the machine cannot complete and returns the result to the task flow. In other words, Fo can hire people as contractors to help complete tasks—primarily phone calls here—and can learn from them in the process.
 |
 |
 |
▲ Figure: Fo communicates with a merchant by phone and books a table. It can also request human assistance to complete work (Figure 3 above).
Use cases:
• One user tried it for eight days. When a doctor's office did not answer, Fo repeatedly called and left messages, getting through and making the appointment on the third attempt. To investigate a delayed package, it found the tracking number in email, contacted the merchant from its own email address while copying the user, asked whether the user preferred a replacement or refund, and had the merchant ship a replacement by FedEx overnight.
• When Costco blocked the Agent, it did not simply buy a more expensive substitute. It compared prices, confirmed Costco was still the least expensive option, prepared the cart, and handed payment back to the user.
• Officially listed early-user tasks include ordering and paying for food across countries and languages; sending birthday gifts and hospital flowers; asking cafés about wait times; booking haircuts and massages; checking in for flights; comparing hotels against a budget; finding a licensed repair technician available the same day; and renewing domains.
Feedback:
• Repeated phone attempts and “hand it to a person when stuck” are viewed as practical advantages over peers.
• A criticism is that insurance quotes still require filling forms one question at a time instead of requesting all fields in a batch. When sensitive information such as an ID number and date of birth is collected through iMessage, the absence of a confirmation such as “stored in the vault and used only for this request” weakens trust.
OpenAI launched dots at DevDay on September 29, 2026. It uses GPT-6 Astra, has its own cloud computer, and connects to more than 4,000 applications through a plugin ecosystem. The launch product provides one primary dot; specialist dots for organizations remain in pilot programs with selected enterprises, while integration with Microsoft Agent 365 is a prospective area of collaboration.
It distinguishes current-task context, relevant ChatGPT memories, and the dot's own persistent context, which is not a verbatim copy of every conversation. Execution takes place in a user-isolated Linux/Chrome cloud workspace. Passwords enter the browser through a secure sign-in process without entering model context, while a separate Auto-review checks whether actions that could affect the outside world comply with authorization. The official engineering scenario continuously organizes recurring user feedback, creates a tested fix PR, and attaches a video for review.
The following is my own dots setup. I stay on the phone with it for extended periods and direct its work through voice, which genuinely makes it feel like interacting with a person:
Use cases:
• An early tester's Dot noticed that the user had forgotten to invoice a publication, extracted the details from an email thread, created a PDF, and sent it after the user approved.
• One review reported good results for research briefs, small websites, and quiz pages.
• The Neuron's one-day trial found naming the Agent and connecting applications easy; on the second day, it proactively called to continue the conversation and felt more natural than expected.
Community feedback is currently polarized:
• On the positive side, it is quick to start, its personality is customizable, it can proactively find work through existing connectors, and its message-style iOS interface has been praised.
• Negative feedback centers on its being “not ready yet”: some users say its proactivity is little more than scheduled tasks, it lacks common sense, and they must undo its actions. Remote/cloud connections to Codex are unstable and can consume tokens while idle; voice is worse than standard GPT Live and slow to connect; it cannot edit its own AGENTS.md, limiting user control for use as a long-term daily assistant.
• One reviewer said there was not yet a reason to switch from Claude in the browser, Grok Bot, or Hermes: computer operations were slow, calls did not connect during testing, image output was slow, and simple tasks took several minutes. Some users also reported that computer use on local Windows machines was unavailable.
Meta officially announced Muse on September 8, 2026. Each user receives a persistent cloud computer and browser accessible from iOS, Android, muse.ai, and WhatsApp; work continues after the app is closed. One persistent primary conversation can handle multiple requests in parallel and accept interruptions, while complex topics can be moved into side chats. Users can name the Agent and customize its appearance, and deliverables can include files, webpages, or interactive artifacts.
U.S. users can connect Stripe Link. A person must still confirm the total transaction amount, and the Agent does not see the underlying real payment information. Other scenarios can use a single-use virtual card tied to an approved transaction. Extensions announced in late September include integration with AI glasses in the coming months, Muse for Mac already being able to operate the computer, and a dedicated email address. Small-business integrations include Asana, Canva, Notion, QuickBooks, Shopify, Slack, and Stripe.
Muse here refers to the personal AI Agent and should not be confused with the underlying Muse Spark and Muse Image/Video model families.
Muse's technical focus is its Secure VM. Each user gets an independent Linux virtual machine. The Agent runs in a systemd-nspawn container inside the VM; even if it obtains administrator privileges in the container, it cannot directly control the host. Credentials, approvals, and security services remain outside the container. authd manages credentials, while the model primarily sees surrogate tokens. Sentinel checks connector actions and destinations when a network request is initiated; only after the operation is approved does the system use real credentials at the network boundary. eBPF provides traffic control and data-taint tracking. A separate browser broker manages the browser, and sub-Agents mainly read the UI through the accessibility tree, reducing the scope for arbitrary execution of webpage JavaScript.
Muse has received substantial overall feedback. Use cases include:
• A New York Times reporter's two-week trial: Muse called a dental insurer, provided the membership number, answered security questions, and waited for transfer; after a credit card was connected, it imported spending into Google Sheets, identified and canceled two duplicate subscriptions; it recovered a $44.99 refund for an expired newspaper trial by email; and it booked dinner and produced a podcast. The author called it the most useful AI application they had used.
• TechRadar reported that ordering breakfast, filling forms, and sending emails worked more smoothly than with virtual-browser products.
• One analyst asked it to find accommodation based on Airbnb history and Instagram saves; it found a farmhouse that could be booked directly with the owner for about 60% less than the platform price.
• Everyday-user cases include downloading it after seeing an advertisement and buying shoes for a parent, with very little setup.
The other side of the feedback is almost entirely about permissions and conflict with platforms:
• WIRED and privacy organizations criticized the default use of conversations for model training and the absence of a switch to disable memory, which can only be cleared by asking in chat. One columnist denied Messages permission yet still had more than 187,000 iMessages synchronized, and the explanation did not reconcile with what happened.
• Amazon blocked Muse purchases, citing unauthorized access and privacy. Internal testing was also reported to have exposed users' iCloud photos.
• In practice, some users say it can run complex processes for a while but makes mistakes when deeper reasoning is required; search can also be unstable at peak times. Convenience and discomfort with “handing your life to Meta” are repeatedly mentioned together.
Overall, Muse is distinctive for its approachable plush character design—perhaps a collaboration with POP MART could work in China, with a similar plush vinyl texture—its ability to reply to and like users' messages, which feels very human, and its solid Agent model performance (second place on AA). It briefly became highly popular overseas.
Gemini Spark's advantage comes from Google's ecosystem. Announced at I/O on May 19, 2026, it runs inside the Gemini product, combines Gemini models with the Antigravity runtime framework (harness), connects to Workspace, and executes in a dedicated Google Cloud virtual machine. It supports three scheduling modes—time, Gmail conditions, and topic events—with up to 50 active schedules and 15 concurrently running tasks.
In June it added a Mac client, Keep, Tasks, and custom MCP (Model Context Protocol) support. In July it could, with user permission, use Chrome sign-in state and saved passwords to handle web transactions and expanded to more than 160 countries. Google Photos integration followed in September.
Google DeepMind's AI Control Roadmap research on asynchronous monitoring supports real-time oversight; the company says it analyzed more than a million coding-Agent tasks.
Spark requires users to be at least 18 years old and may be delayed during high traffic. When using a local Chrome path, both the device and Chrome must remain on. Google still describes it as an early experimental feature and warns about prompt injection, erroneous actions, and leakage of personal information.
Today was the first company in China to launch a Personal Agent. It has not disclosed a source-code architecture at the same level of detail, but it puts memory management directly in the user interface. Personal memory includes people, projects, and preferences and can be viewed, edited, and deleted. The product provides morning briefings and evening wrap-ups, connects email, calendars, notes, and tasks, and requires confirmation for external actions. In its customer-rescheduling example, the Agent reads email, looks up project dates, and prepares a reply and a new milestone. The interaction is relatively simple and also supports proactive linking: for example, if the user works in computing, Today can proactively find and push relevant information.
▲ Figure: Today.ai interface, via Gui Zang
A controversial aspect of Today is the breadth of permissions it requests. After installation and sign-in, it scans the local disk to understand the user deeply and provide highly personalized assistance. The cost is extensive use of user data, which has drawn criticism from some overseas users. Possibly for cost reasons, its “cloud computer” is actually a sandbox rather than the full cloud computers used by several overseas Personal Agents.
Grok Bot launched on August 11, 2026. A group of Bots shares a cloud computer and can continue working after the user closes the laptop. They execute across applications, pass context among themselves, and divide work in group chats. The product supports macOS, Windows, Linux, iOS, and Android. The main interface uses a Bot roster to show who is doing what and where user judgment is required. A skill describes “how to do it,” while a routine defines “when to do it.” Teach a task can record up to ten minutes of visible computer operations and generate a skill draft, and each Bot can have up to 50 routines.
The engineering case demonstrates two layers of specialization. Outer Bots are assigned roles for iOS, desktop, Android, and infrastructure, while an inner layer dispatches Cursor cloud Agents. Bots read task records, screenshots, and PR evidence, asking follow-up questions or interrupting on anomalies. Team Bots, released in public beta on September 28, can share files, tools, skills, and team knowledge while preserving each user's private conversations. In an official procurement example, an Agent organized about 125 vendors; one finding identified 43 paid seats unused for 90 consecutive days, while one order was reduced from $14,629 to $6,143.
▲ Figure 10: Official Grok Bot procurement example—reconciling a renewal quote with existing spend and organizing about 125 vendors
Multiple Bots do not imply multiple security zones. A user's Grok Bots share files, browser sessions, and application logins. Although each Bot has its own screen, Bots are not isolated from one another, and deleting a Bot may not remove files and sessions from the shared computer.
Grok Bot provides a strong user experience, primarily in the following respects:
 |
 |
Manus demonstrates how a general-purpose task Agent can gradually add team collaboration and continuous operation. At its March 2025 launch, the core flow was for the user to provide a goal and for the Agent to use tools in the cloud and deliver results. Manus published its context-engineering approach in July; Wide Research distributes work across parallel sub-Agents, each a fully capable Manus instance. The January 2026 task Sandbox provides an isolated cloud VM for each task, including networking, file system, browser, and tools; it sleeps when idle and wakes when the user returns. The April Cloud Computer is a dedicated persistent machine that can run bots, scripts, services, and periodic collection. Project self-updating, introduced in May, extracts reusable decisions, formats, and processes from tasks and writes them back to project knowledge after user approval. This is not online model training and does not mean that the system records the entire account without boundaries.
OpenClaw began as the WhatsApp Relay “Clawd” in November 2025 and was renamed in late January 2026—the lobster that went viral early that year and then quickly faded from view. It is an open-source personal Agent runtime that can be deployed on a personal computer or server.
A long-running Gateway maintains messaging-channel connections. The web interface (Web UI), command-line interface (CLI), and clients connect through persistent WebSocket connections. Tasks from the same session run sequentially, and the system also limits global task concurrency.
Memory is distributed across USER.md, MEMORY.md, and date-based notes, while a SQLite database provides the retrieval index. A background dreaming process consolidates eligible historical material into a more compact long-term layer and retains review records. heartbeat performs periodic wake-up checks, cron stores schedules, and Webhooks receive events from external services.
Open source and auditable does not mean secure by default. A sandbox can place tool execution in a constrained environment, but the Gateway still runs on the host, and the documentation at the time explicitly stated that the sandbox was disabled by default. Command approvals must be bound to the approved command, working directory, and executable so the content cannot change at execution time. An official audit retrospective dated September 21, 2026, also stated that permissions in long-running tasks must propagate with each request, authorization must target the resource ultimately accessed, and revocation by the user must affect tasks already in progress.
An always-on Agent remembers a task, waits for changes, and resumes it at the appropriate time even after the conversation has ended.
It does not merely respond to the current message; it acts based on previously saved task state and new events. For example, you might say: “Monitor this purchase. If the supplier is delayed, find an alternative, but ask me before changing suppliers.” Closing the chat window does not end the task. The next day, an email reports a supplier delay. The Agent wakes on the event, prepares alternatives using yesterday's instructions, and requests approval. If you do not respond immediately, it saves its progress and waits. Once you approve, it continues instead of asking you to restate the request. The key is not that it “ran once for two days,” but that across two days, multiple executions, and periods of waiting, it continued handling the same assignment.
The essence of an always-on Agent is a change in the runtime, not a model that chats better. Planning, browsing, and drafting in the previous generation of Agents were largely tied to the current session context. When the window closed, the task, permissions, and intermediate results disappeared with it. This generation of Personal Agents stores long-lived state outside the session, including the task ledger, memory, permissions, credentials, triggers, and actions already taken externally. After the user closes the app, a new email, calendar event, or missed call can still wake the Agent so that it resumes work on its own cloud computer.
Email, phone, and a budget-limited wallet are not new model capabilities either; they give this persistent process an identity through which the outside world can reach it. It communicates and pays through its own accounts instead of borrowing the user's sign-in state. This creates three requirements: memory must support consolidation, compression, and forgetting; identity must persist across models and hosts; and sent messages and spent money must be auditable and cannot be silently undone. Cue, dots, Muse, and Fo are products built along this path. But solving “the process and identity survive the end of a conversation” does not guarantee reliable task completion.
Memory is commonly divided into episodic memory (what happened), semantic memory (what is known), procedural memory (how to do something—skills), and the working memory currently in use. This taxonomy comes from cognitive science: Tulving distinguished episodic from semantic memory, Baddeley proposed working memory, and Soar and ACT-R provide perception–decision–action loops.
Reviews of memory in the LLM field summarize its evolution in three stages: first storing trajectories, then reflecting on them, and finally abstracting them into reusable experience (From Storage to Experience, arXiv:2605.06716; Agent Memory in the Second Half, arXiv:2602.06052). Always-on scenarios require this final stage: the next task can apply established rules and skills without replaying the entire conversation.
A long-running task cannot place its full history in context, yet compression may discard details whose value becomes apparent only later. FlowState stores three things separately: typed state nodes, relationships among nodes, and references to raw tool output. The loop updates state incrementally and looks back into history only as needed during reasoning. With the same model, MemoryArena success and τ3-Bench pass rates rose by approximately 4.6 and 14 percentage points respectively, while token consumption fell by about 40% (FlowState, arXiv:2609.34565).
This resembles the approach of harnesses such as Manus Cascade: load tools and context on demand instead of packing every capability into the prompt every time.
After switching models, harnesses, or hosts, the Agent should still be the “same” Agent. One architecture paper represents this continuity as Pt=(It,Mt,Bt), corresponding to identity, memory, and the executable “body,” separated from replaceable execution bindings. The migration flow is pause, checkpoint, verify, bind, rehydrate, and resume (Runtime-Independent Persistent Agents, arXiv:2609.00546).
The companion benchmark PAI-Bench distinguishes “being able to recall identity facts” from “actually behaving according to that identity”; the two often diverge (arXiv:2609.13637). The email addresses and phone numbers provided by Cue and Fo turn identity from a persona in a prompt into an externally addressable account.
Events such as new emails, calendar entries, and missed calls first enter trigger state; only when conditions are met do they wake the cloud computer for an execution. This is more like subscriptions and transactions in a distributed system than chat completion. External payments and sent messages are committed, irreversible side effects and must be accounted for separately from internal plans; otherwise they cannot be audited or rolled back.
A long-running task first needs a recoverable task state machine. The system must record which steps remain planned, which have executed, which await approval, which are safe to retry, and which require rollback or handoff. If an email has already been sent or a calendar event created, simply rerunning from the beginning may duplicate actions. Parallel tasks must also avoid resource conflicts: OpenClaw serializes work by session and sets a global concurrency limit; Grok Bot roles share a cloud computer and must avoid modifying the same file or occupying the same browser session simultaneously.
dots separates stopping into three operations: pause the primary task, stop a subtask, and cancel future plans. This may appear more complex than one stop button, but it accurately reflects the simultaneous presence of a current process, parallel branches, and future triggers. Stopping the current task does not necessarily revoke future plans, and stopping a subtask does not mean the primary task is finished. The task-control interface must make these differences clear.
Continuous execution also needs interruption points. LangGraph Persistence/Interrupts provides a practical pattern for session checkpoints and “pause for approval, then resume from the same location.” Pare/Pare-Bench uses an event-driven environment and distinguishes the operational surfaces visible when a user acts through the interface from those exposed when an Agent acts through an API. π-Bench examines long-horizon proactive assistants facing hidden intent and interaction. Together, these efforts show that long-running tasks must preserve internal steps while tracking the external environment and user decisions.
▲ Figures 18–19: Pare's event-driven environment and asymmetric user/Agent interfaces, and the π-Bench framework for evaluating long-horizon proactive assistants
The system must also decide when to interrupt the user. Low-risk information can be aggregated before notification; high-risk actions should pause before execution. When conditions are uncertain, investigate first; when user judgment is required, present a small set of clear options. Experience can be measured by how often a user must return to monitor progress, correct steps, or restate context. The higher this number, the less user attention background execution actually saves.
Borrowing a user's sign-in state quickly connects many applications, but external systems may record the action as having been taken by the user. The system must identify who initiated an email, who placed a call, which Agent submitted a payment, and where the user approved it. Cue, Fo, and Instinct distinguish the actor through dedicated email, phone, or payment tools; ecosystem products rely more on credential isolation, action approval, and audit records.
Identity and permissions must span the entire task lifecycle. Collaborating Agents need to verify each other's identities; a shared calendar should disclose only the information required for coordination; credentials need expiration; revoking permission must prevent in-progress tasks from continuing to use it; and files, sessions, and authorizations need explicit disposition when an Agent changes roles or is deleted. OpenClaw's September 21, 2026, permissions retrospective emphasized that permissions must propagate with requests and that authorization must bind to the resource ultimately accessed rather than being checked only once at task start.
Muse Secure VM places credentials, approvals, and security services outside the Agent container. The model mainly uses surrogate tokens, while Sentinel evaluates connector actions and network egress at the network boundary. dots secure sign-in puts passwords into the browser while keeping them out of model context. Both designs reduce the model's direct exposure to real credentials. An independent identity improves auditability but does not automatically provide security; limits, expiration, revocation, and execution records are still required.
Long-term memory must address not only remembering but also provenance, scope, update time, expiration, and deletion. Once an incorrect preference enters the long-term layer, it may recur across many subsequent tasks. Users therefore need to know which conversation or project produced a memory, which tasks it currently affects, when it was updated, and how to correct or delete it.
In October 2023, MemGPT modeled memory reads and writes as tool calls: limited context is divided into system instructions, a writable workspace, and a message queue; conversations and archives live outside context, and the model retrieves and edits them as needed. Letta's MemFS uses Git to store memories shared across sessions, while background sub-Agents review sessions and consolidate experience through dreaming. Mem0 provides a pluggable memory layer, and Zep/Graphiti organizes incoming conversations into a temporal knowledge graph. At the product level, dots separates task context, relevant ChatGPT memory, and its own persistent context; Today lets users view, edit, and delete memory; and OpenClaw stores different information layers in files and indexes.
▲ Figure 20: MemGPT's layered memory and mechanism for updating saved information
▲ Figures 21–22: LongMemEval's unified framework for indexing, retrieval, and reading, and Sleep-time Compute moving part of the reasoning workload ahead of queries
Sleep-time Compute described in April 2025 one use for background processing when the user is not asking a question: preprocessing reusable context. The authors reported that, in the paper's setting, query-time computation could fall to about one-fifth at the same accuracy. This number cannot be generalized to mean that every product will reduce cost by 80%. LongMemEval and V2 separately test long-term-memory indexing, retrieval, and reading, reminding teams to evaluate independently whether memory is written correctly, whether it can be found when needed, and whether retrieved content supports the current task.
A Personal Agent breaks a high-level goal into a sequence of tool calls. A one-time confirmation at task start cannot cover later goal changes, resource substitutions, and newly arriving data. Permissions must propagate with each request; approvals should bind to the final action and resource; real credentials should remain outside model context whenever possible; execution and security decisions should be layered; and revocation must affect tasks already in progress.
The Model Context Protocol (MCP) standardizes tool interoperability. The protocol is stateless. It makes application connectivity easier, but it does not decide who may access a resource, how long an authorization remains valid, whether the target file has changed, or whether tool-returned data is contaminated. Browser automation also faces layout changes, expired logins, misaligned clicks, and untrusted page content. If the browser holds a real login session, a single recognition error can cause a message to be sent, data to be deleted, a purchase to be made, or information to be disclosed.
Public materials for Muse, dots, and Spark do not claim to have completely solved prompt injection. Muse uses an isolated environment, credentials outside the container, and Sentinel for layered control; dots adds an independent Auto-review; OpenClaw binds command approvals to directories and executables. These measures reduce risk but cannot provide absolute immunity. As long as an Agent reads untrusted webpages, emails, or documents while it can call high-privilege tools, the system must continuously distinguish external content from user instructions and record the actual resource affected by every authorization.
Websites change, accounts expire, real-world services cancel, and user requirements may conflict. The system must detect failure early, preserve evidence, explain what remains incomplete, and choose among retrying, rolling back, waiting, asking the user, or handing off to a person. LangGraph interrupt supports resuming a paused task; dots manages primary tasks, subtasks, and future plans separately; Grok Bot asks follow-up questions or interrupts on anomalies; and Fo hands machine-blocking steps to trained human executive assistants, then writes the external result back into the task.
Completion cannot be verified solely from an Agent's own report. Whether an order exists, an email was delivered, a calendar was updated correctly, a file exists, or a PR passed tests are more reliable external states. GAIA evaluates general assistants, OSWorld evaluates operating-system tasks, τ-bench and τ²-bench evaluate tool use and multi-turn interaction, and LongMemEval evaluates long-term memory. Each benchmark covers only part of the system; a high score on one cannot prove that a complete Personal Agent is reliable.
Wajo built a simulated world with controllable merchant websites, email, phone, and synthetic people to test action-oriented Agents, including spoofed websites and dark patterns in the flow. Scoring prioritizes external-system state and execution records; model judges handle only cases that deterministic checks cannot decide and cannot overturn hard results. On September 26, Wajo reported an autonomous completion rate of about 71% and a trust rate of about 94% for Fo; the completion rate excludes fallback results completed by human executive assistants. The associated arXiv paper includes 104 completion tasks and 60 trust tasks, with each task run three times per configuration. It compares a base model, Fo without guardrails, full Fo, and OpenClaw; OpenClaw completed about 42% of shared tasks.
These numbers come from simulated tasks and fixed test procedures, and differences may reflect the model, tools, and execution environment simultaneously. The paper's authors are from Wajo and the work is a developer preprint, not an independent comparison or peer-reviewed conclusion. The results should not be presented as market share or a general success rate among real customers. The positions of Muse and Instinct in the website chart are the authors' subjective judgment and are not based on actual test data.
My assessment is that the Personal Agent is not a suddenly emerging need, but an old goal repeatedly interrupted by technical capability, execution cost, and trust concerns. It has returned to the center of product strategy because several previously immature paths can now be combined into a usable whole.
▲ Figure 25: ReAct's reasoning–action–observation loop—the academic starting point for modern Agents
The Personal Agent is not a suddenly new need. It revives the old vision of “delegating things to a personal assistant” after several detours. Early Siri and chatbots could follow commands but relied mainly on predefined flows. Large models brought general understanding, leading products such as AutoGPT to attempt full automation directly; long tasks soon exposed drift, cumulative errors, and frequent takeover requirements. Real deployments instead leaned more heavily on Copilots, fixed workflows, Coding Agents, and Harnesses: first narrow the task boundary, then let AI finish work in an environment where results can be checked and errors corrected.
That detour accumulated the execution foundation required today, but “completing one task” is not the same as “working for you over time.” “Organize supplier quotes” is a one-time deliverable; “keep following up until next Wednesday, update the list when a new quote arrives, and ask me before making a purchasing commitment” is an ongoing assignment. The latter requires not only a stronger model but also cross-session task progress, waiting for external events, scheduled wake-ups, and clear boundaries between actions the Agent may take autonomously and those requiring authorization.
Personal Agents are appearing together at this stage because general understanding, tool execution, and persistent state management can now be assembled, while lower inference costs make the ROI of continuous service more plausible. Products are therefore shifting from “you ask once, I act once” to “you give me a goal, and I keep following through.” This does not mean AI can be left completely unattended; it means we can begin assigning it some ongoing responsibilities within explicit boundaries. Success ultimately depends on whether the attention it saves exceeds the burden of inspection and correction.
In my view, Personal Agents should not be understood only as personal assistants. Commercially, I expect the consumer side to become free, while the enterprise side culminates in digital employees.
For individual users, the core positioning of a Personal Agent is “someone who handles things for you,” not a tool that requires a paid subscription. To become an entry point used every day, it must first be free, minimize adoption barriers, and build sustained dependence through scale. Monetization occurs when the Agent helps users make decisions and complete transactions, primarily through two paths:
This path has one prerequisite that must be protected: trust. If users perceive that the Agent favors the highest bidder when making decisions for them, dependence collapses. Monetization must therefore rest on recommendations that are best for the user: commercial content must be clearly labeled, ranking must prioritize user interests, and payment may affect only who is eligible to enter the candidate set—not who is ultimately selected. The essence of the free path is to exchange user trust for scale and then monetize scale and transaction data.
For enterprises, the Personal Agent becomes a digital employee: every role and employee can have a dedicated Agent bound to that role, its permissions, and its knowledge. It does not merely answer questions; it performs tasks inside enterprise systems, including data queries, process approvals, report generation, cross-system coordination, and exception handling.
Unlike consumers, enterprise customers will pay for deterministic value, and monetization is more direct:
• Per-digital-employee subscription: “activate” a digital employee as if hiring one, priced by role and quantity.
• Pricing by task volume or outcome: charge for completed work, tickets processed, or labor cost saved, directly linking price to value.
• Platform and ecosystem: digital employees built or purchased by enterprises run on a common foundation, and the platform earns continuing revenue from foundational capabilities, the skill marketplace, models, and compute.
Enterprise defensibility comes from a deep understanding of company data, business processes, and permission systems, together with secure, compliant, and auditable operations. The digital employee that can truly enter the business and own metrics will create lasting customer retention. Enterprise operations, product, and engineering involve large workforces, each corresponding to individual employees. Generalized further, each is a Personal Agent. Such a Personal Agent is no longer divided by person and function, but by a business domain or a more horizontally abstracted business unit, supporting the work of that unit.
Here is my own assessment: Personal Agents in China will exist as ecosystem Agents:
In the consumer market, it will be difficult to create a single “glue layer for every scenario.” Chinese user behavior is highly concentrated in a few super-apps, whose operators have neither the incentive nor the willingness to open their core capabilities. The reason is their business model: advertising, search, memberships, and paid promotion all depend on users remaining in the app to browse and click. If an Agent replaces the user in filtering and decision-making through GUI automation, those monetized touchpoints are bypassed, directly threatening platform revenue. This is the fundamental reason platforms often resist or block GUI Agents. Recruitment sites, for example, may restrict GUI Agents from screening résumés because they bypass paid steps built into the platform. A general assistant based on simulated cross-platform operation therefore remains fragile in terms of platform relationships and risk controls.
The value of a Personal Agent should lie more in “helping users solve everyday problems.” Its core territory spans everyday consultation and information search through concrete work and life tasks. Differentiation follows from the exclusive data and capabilities each player controls. Xiaohongshu content, for example, is not available externally, so its own Personal Agent would have an irreplaceable source for travel guides and other proprietary information. Put simply, each ecosystem will develop its own Personal Agent and establish advantages within its own domain.
Trust will be central to consumer monetization. I have observed that many users accept results from products such as Doubao and Qwen almost directly. As Personal Agents become users' “external brains” and build strong trust, recommendation conversion and transaction completion rates can greatly exceed those of traditional information feeds and search. Advertising and transaction revenue sharing may therefore command higher commissions and ad rates. In the long run, users will outsource much of their judgment and thinking to Agents; whoever owns that trust owns a new traffic gateway. But trust is a fragile asset. Once users sense that recommendations serve commissions, trust can collapse quickly—the Wei Zexi incident is a warning. The more monetization depends on trust, the more restrained monetization must be.
The enterprise opportunity is to move from “point integration” to “digital employees.” Today, AI is still mostly embedded in tools as a point capability. As capability deepens, an Agent can gain full enterprise context, take ownership of tasks through persistent mechanisms such as ledgers, and accumulate and evolve through execution. That is a true digital employee. At that point, Agents can expand the enterprise labor supply exponentially.
Personal Agents are therefore very important in China as well, but the market will not be dominated by one standalone general assistant. Instead, the pattern will be “embedded in ecosystems + monetized through trust.” Consumer offerings will differentiate through each ecosystem's exclusive capabilities and use trust to improve commercial conversion; enterprise offerings will build Agents deeply into the organization as digital employees. The key is to understand which data and capabilities you possess that others do not, and how user trust will ultimately translate into commercial value.
AgentTeams Dashboard: Unified Management of Teams, Projects, and Assets
791 posts | 60 followers
FollowAlibaba Clouder - March 23, 2020
Justin See - March 19, 2026
Neel_Shah - March 27, 2025
Alibaba Cloud Native Community - May 20, 2026
ApsaraDB - May 11, 2026
Clouders - January 12, 2022
791 posts | 60 followers
Follow
Qoder
From Assisted to Autonomous — Adapting to Every Programming Need
Learn More
QwenWork
QwenWork is dedicated to helping employees strengthen their professional competitiveness in the AI era and to enabling enterprises to improve organizational effectiveness.
Learn More
AgentCore
AgentCore unifies agent construction, governance, and execution capabilities so enterprises can deploy diverse agents with confidence.
Learn More
Wan3.0
Unleash Your Creativity Try Wan 3.0 now — longer narratives, greater control, endless creativity.
Learn MoreMore Posts by Alibaba Cloud Native Community
