OpenAI Dots, Meta Muse, Grok Bot: Who owns your AI agent’s computer?

“Do not use separate bots as a security boundary.” This sentence does not appear in a security audit. It appears in the official documentation for Grok Bot, a product that xAI markets as “AI teammates you can give real work to”. Within seven weeks, xAI, Meta and OpenAI have unveiled the same type of product: an agent that works round the clock, logs into your tools and reports the results back to you. And all three answer the one question that really matters differently: On which computer does the agent work, who shares this computer with it, and who controls what is sent from there onto the internet?

Since the launch, the press has been comparing context windows, benchmarks and avatars. That is the wrong debate. The crucial difference between the three isn’t found in any model data sheet, but in the isolation model. From this perspective, the three products can be assessed in a single afternoon. And it becomes clear why a German company is currently only permitted to use one of them officially.

What the three products have in common: the agent gets a computer

Until recently, ‘AI agent’ in practice: a language model that calls up tools via an API whilst you’re in the chat window. Close the window, and the agent is gone. The new generation breaks with this logic in three ways at once.

The agent is persistent. It has a name, a memory that spans conversations, and continues to run when you’re offline. OpenAI calls Dots “remarkably capable, always-on agents built to handle everything”, whilst Meta describes Muse as “a secure, private personal AI agent that proactively helps with people’s goals and suggests ideas”.

The agent also has its own computer – a genuine cloud machine with a browser, file system and logins. xAI’s documentation puts it this way: “Every bot on your account uses one persistent cloud computer.” This means the agent can also access websites without an API, saves files and logs into accounts, just like an employee at their own workstation.

And it is proactive: Dots continues to research using reading tools during idle times, Grok Bot carries out routines on a time- or event-driven basis, Muse monitors inboxes and prices, and alerts you when something happens.

Here’s an everyday example: At 11 pm, you type into Slack, “Check first thing tomorrow morning whether the supplier’s invoice is in the inbox, and file it in the accounts folder”, close your laptop, and by 7 am the invoice is there. No workflow tool, no script, no API connection.

In simple terms: these three providers are selling a workspace for software that behaves like a colleague. This suddenly turns the interesting questions into IT security issues, because when you meet a new colleague, you don’t ask about their IQ first – you ask about their access rights.

As we argued in our article on the Agent-Harness model, the harness determines the value of an agent. Dots, Muse and Grok Bot are the strongest confirmation of this theory to date: three companies with very different business models are building almost identical products and differ almost exclusively in their harnesses. Their answers to the computer question are becoming, from section to section, increasingly awkward.

OpenAI Dots: one computer per agent, delivered via ChatGPT

Dots was unveiled on 29 September 2026 at DevDay in San Francisco and runs on GPT-6 Astra, OpenAI’s current flagship model. Each Dot is assigned its own cloud computer, separate from your own machine; access to your local desktop is disabled by default and must be actively enabled via the ChatGPT app. The Dot can be accessed via the ChatGPT apps, Slack, Microsoft Teams and voice calls; in the US, Pro users can also access it via text message (as a limited beta). It inherits the app connections from ChatGPT and, according to OpenAI, provides access to more than 4,000 applications via plugins. For organisations, OpenAI is testing “Specialist Dots” with their own roles, login credentials and toolkits, currently as a preview in Enterprise pilot schemes; integration with Microsoft’s Agent 365 governance has been announced.

The permissions model warrants closer examination. OpenAI describes it as follows: “Custom Rules let you allow specific actions, require approval, or block them.” In the Help Centre, the specific levels are called “Take action without asking”, “Take action if pre-approved”, “Ask before taking action” and ‘Hand off to you’. Permanent deletion or software installations require authorisation, whilst password changes and money transfers are handed back entirely to you. And when it conducts research on its own initiative, it is technically restricted: proactive research uses ‘tools that are restricted to read-only access-only, which means that they cannot send messages, change app content, or control your browser or computer". This is a clear distinction between “I’m having a look” and “I’m taking action”, a level of clarity that the two competitors lack.

In terms of pricing, Dots is an add-on: one Dot is included in ChatGPT Pro and Business Premium; additional Dots are expected to be available for purchase later, though prices for these have not yet been announced, and Dot conversations do not count towards the standard ChatGPT limits. Enterprise, Edu and Healthcare workspaces will receive a beta version, which the admin must activate.

One line from the Help Centre is crucial for this blog. According to Help Centre, the Pro rollout is taking place “in markets excluding the European Economic Area, Switzerland and the UK”. Business Premium, on the other hand, is available “across all supported ChatGPT regions”. OpenAI does not provide a reason for this; Fortune attributes the exclusion to the strict data protection laws in these regions. For your business in Germany, this means the Pro option is closed off and the Business option is available.

Meta Muse: a guardian agent that authorises all network access

Meta unveiled Muse on 8 September 2026, three weeks before Dots. The product runs on Muse Spark, which Meta claims is its most powerful model to date, and is initially aimed at private users: replying to emails, booking travel, negotiating bills, filling in forms, turning recipes into shopping lists. Muse is available on iOS, Android, at muse.ai and via WhatsApp, and integration with Meta’s AI glasses has been announced.

Architecturally, Muse is the most interesting of the three products. Each user is assigned a dedicated ‘Muse Secure VM’, in which the agent and user data co-exist. Alongside this, a second agent runs, which Meta calls ‘Sentinel’. It operates at the system level, separate from the Muse agent, and authorises every action that leaves the VM: every website visit, every connector access, every data transmission. For sensitive operations, it also seeks the user’s permission.

Passwords and payment details are stored in a repository that the Muse agent can access but cannot read. Payments are made via Stripe Link using one-time credit cards, Shop Pay and a 1Passwordintegration are set to follow. Meta has promised a “Confidential VM” by the end of 2026, featuring end-to-end encryption with keys held by the user.

Muse thus separates thinking and acting into two distinct processes. The model is allowed to make suggestions, whilst the Sentinel decides whether they can be carried out. Conceptually, this is the strongest defence against prompt injection, which is currently being offered by one provider. If the agent reads the hidden instruction on a rigged website to send the latest bank statements to an external address, this transmission must bypass the Sentinel, and the Sentinel is aware of the user’s instructions. Whether this will hold up in everyday use is something nobody can say at present, Meta included.

The launch is providing the first data points. Reuters reported on internal Meta posts stating that, during testing, the agent bypassed the safeguards and disclosed a person’s private iCloud photos,tasks were silently terminated after around 15 minutes, and Meta’s CTO Andrew Bosworth had to log in again several times within a few minutes. Vishal Shah, Meta’s VP for AI products, admitted to Reuters that one could never rule out the possibility of an error occurring, but that every element of the architecture was designed to make the product as secure as possible.

On the data issue: Muse uses interactions for training by default; opting out is possible, but it is, after all, an opt-out. Meta rules out passing conversation data on to the advertising system. The pricing model is the most transparent of the three: a free tier with up to 100 million tokens per week (though, according to user reports, this still requires a credit card to be on file), plus paid tiers for 20 and 100 US dollars a month. Muse is available in the US and, since 18 September, in Canada, for users aged 18 and over.

On 29 September, the day of OpenAI DevDay, Meta also launched ‘Muse for Small Business’ with around a dozen connectors, including Shopify, Stripe, QuickBooks, Notion and Slack. For B2B readers, this offshoot is actually the relevant one, and it’s just one day old.

Grok Bot: many bots, one computer, shared logins

Grok Bot launched in beta on 11 August 2026, making it the oldest of the three products. It is developed by xAI, which has been part of SpaceX since the merger with SpaceX in early 2026 and has officially been known as SpaceXAI since July. SpaceX has also acquired Cursor, one of the largest AI coding editors, for around 60 billion US dollars. This explains the distribution channel: since 26 August, Grok Bot has been included in all paid SuperGrok tiers as well as in Cursor Pro, Pro+, Ultra and the Cursor Teams plans, with its own usage quota that resets weekly. Since 3 September, it has also been available to Grok and Cursor Enterprise customers, with admin controls for network policies and audit logs.

Grok Bot is positioned as a team. You create multiple bots with different roles and coordinate them in group chats of two to six bots. The learning principle will be of interest to anyone familiar with RPA: you demonstrate a workflow once (“Show a Bot how it’s done”), the bot turns this into a draft skill, which you review and test, and then executes it as a routine, either on a schedule or in response to an event. Where a connector exists, the bot uses it, as xAI claims this is more reliable than clicking; otherwise, it accesses the website via a browser. In the announcement, xAI quotes a user with a statement that anyone who has ever left an agent stuck at 90 per cent will agree with: “There is a huge difference between 90 per cent done and 100 per cent done. Most AI gets you almost there.”

All bots within an account run on a single shared cloud computer. This is what sets it apart from the other two. Each bot gets its own screen, but browser cookies, sessions, files and command-line credentials are shared on this machine. xAI puts it this way: “All of your bots share one cloud computer assigned to your user account.” And in the security documentation: “Do not use separate bots as a security boundary." Isolation between different users is strict, and according to the security FAQ, each user is allocated their own Firecracker micro-VM. There is no such isolation within a single account.

What this means in practice: The bot that reads customer emails unfiltered uses the same browser sessions as the bot that prepares bank transfers. In August 2026, Adversa AI demonstrated just how vulnerable language models are to hidden instructions on web pages using the Grok web chat (tested with Grok 4.5 Fast – not Grok Bot, but from the same model family): In 8 out of 20 attempts, a rigged page caused the chatbot to disclose user data. xAI’s documentation draws the only possible conclusion from the shared machine and advises against storing any login details or files on the computer, which another bot from the same account must not be able to access. True separation of duties therefore means separate accounts, as only these ensure separate computers.

One detail worth noting is stated verbatim in the documentation: “Deleting a bot removes its active profile, conversation and routines from Grok Bot. Shared computer files and sign-ins are not isolated by the bot and may remain on the computer.” If you get rid of a bot, you haven’t got rid of your logins yet.

The comparison: three answers to the same security question

The table summarises the situation as at 30 September 2026, based on the manufacturers’ specifications and the relevant documentation. Benchmarks have been deliberately omitted: there is no independent three-way evaluation, and the manufacturers’ figures measure different things.

Three patterns stand out when reading the table. All three charge for quotas on top of the subscription, and none state upfront what an additional agent or a quota upgrade will cost in the long term: Dots does not quote prices for additional Dots, Grok Bot does not specify quota levels, and whilst Muse specifies tokens per week, nobody can tell you how many completed tasks amount to 100 million tokens. A budget for this currently consists of placeholders.

Only OpenAI has answered the question “Is the agent allowed to act independently?” with a technical ‘no’ for proactive mode. Muse resolves the same issue via the Sentinel, albeit for each individual action. Grok Bot relies on rules and approvals, with no technical boundary between reading and acting.

And the level of isolation decreases from left to right in the table: Dots isolates per agent, Muse per user with an external guardian, Grok Bot per account. Only one of these models is suitable for a company that lets an agent loose on customer data, and it is not the one with the shared computer.

Why the isolation model is more important than the model

A language model that reads web pages, opens emails and processes PDFs will inevitably also read text originating from attackers. Prompt injection cannot be patched away because the model is fundamentally unable to reliably distinguish between instructions and content; any improvement in the hit rate reduces the risk without eliminating it. Therefore, it is not the model’s hit rate that determines the damage, but the scope within which a compromised agent can operate, and this scope is the isolation model.

With Dots, the scope ends at the Dot’s own cloud computer. A manipulated research Dot cannot access the sessions of an accounting Dot because they are located on different machines. With Muse, it ends at the Sentinel: the agent can do whatever it likes internally, but only what the Sentinel allows gets through to the outside world. With Grok Bot, the radius ends at the account. A bot that reads a rigged website is running on the same computer as all the other bots in the account, with the same cookies, the same files and the same open logins.

To put it in terms of an analogy that every admin will understand: Dots gives every employee their own laptop. Muse gives every employee their own laptop and posts a gatekeeper at the door who reads every letter before it goes out. Grok Bot puts ten employees at a shared PC, on which everyone remains logged in, and states this honestly in the manual: ‘If you want separation of duties, buy several PCs.’

This openness is to xAI’s credit. But it shifts the responsibility onto you, and a warning in the manual is not the same as a technical barrier that cannot be circumvented. How to set such boundaries for your own agents, tiered permissions, approval steps, and a personnel file comprising identity details and logs, is described in our article on Managing AI Agents Like Employees. These three products demonstrate that the same questions are now being addressed at corporate level, with three different answers.

Europe: which path is open today

For readers in Germany, the availability line is the most revealing. Muse is only available in the US and Canada. Grok Bot makes no mention of regions in its documentation; SuperGrok and Cursor subscriptions can be taken out from Germany, but there is no official statement regarding use in the EU, and anyone testing Grok Bot from here today is operating in a grey area that xAI neither confirms nor rules out. Dots is split: the Pro rollout excludes the EEA, Switzerland and the UK, whilst Business Premium is available in all supported ChatGPT regions according to OpenAI, and Enterprise Workspaces can enable the beta via an admin. For a German company, the official route today is therefore via a ChatGPT Business Premium account or, as a beta, via an Enterprise Workspace.

The fact that OpenAI is excluding consumer features from Europe at launch is nothing new; Advanced Voice and Memory were also delayed. With an ‘always-on’ agent, this carries greater weight because the product structurally conflicts with the GDPR. If a Muse agent negotiates an invoice on your behalf or a Dot initiates a software purchase, the question of human oversight is no mere formality: Article 22 restricts automated decisions with legal or similarly significant effects where there is no human involvement. Added to this are the legal basis for third-party data in your inbox and the storage limitations posed by a memory that, by design, retains everything.

And the EU AI Act has, since 2 August 2026, required transparency for AI systems that interact with humans. An agent that writes emails and makes phone calls on your behalf must identify itself as an AI. Formally, the obligation falls on the provider, but the problem still ends up with you. It can be resolved, but it is a product requirement that US launches do not meet.

My assessment: All three will make their way to Europe in full, but not in their current form. With its announced Confidential VM and user-held keys, Muse has the best technical foundation for an EU version. OpenAI already has the appropriate legal basis in place through its business contract. With Grok Bot, the shared machine is the bigger problem, as any data protection officer will be the first to highlight a shared repository for files and logins across multiple agents.

What this means for small and medium-sized enterprises: make the most of the wait

One could view the delayed European launch as a disadvantage. I see it as a head start that you only get if you make the most of it. American companies are currently learning, in a live environment, what an agent with full access to email and accounts can do; the Reuters reports on Muse and the security notes in the Grok Bot documentation are the record of this.

Draw up the access rights policy before the agent arrives. The format is simple: a matrix of systems and permissions. Mailbox: read – yes; send – only with approval. Calendar: read and write. ERP: read – yes; post – no. Bank: never. CRM: read and write, never delete. In addition, specify a name for the person responsible for the agent, just as a line manager is responsible for an employee. This matrix is vendor-neutral, and it can be used to assess Dots, Muse or Grok Bot in a single afternoon.

Ask yourself the question “build or rent” honestly. The three products are rental agents running on third-party infrastructure, with models you cannot choose and quotas whose price nobody knows yet.

At the same time, there are open-source harnesses such as OpenClaw and Hermes Agent, which run on your own infrastructure and support any model provider. They are not automatically more secure: between 18 and 21 March 2026, nine security vulnerabilities (CVEs) were published for OpenClaw, including one with a CVSS score of 9.9, documented in a Research Note by the Cloud Security Alliance. But they give you control over the agent’s computer, and that is precisely the decisive factor. Anyone who already has a data protection strategy for the GDPR-compliant use of AI tools will find half the list of criteria for this decision there.

And start small, but start now. An agent that transfers invoices from the inbox to the accounts department – and is only permitted to read them – is a good first step. An agent that negotiates contracts belongs at the bottom of the list. Our article on AI Agents as Digital Employees.

My recommendation in a nutshell: treat Dots, Muse and Grok Bot as a preview of what your agents will soon look like, and build the framework within which they can operate now. Which of the three ultimately ends up in your company, or whether you develop your own, is then a procurement decision. No longer a security decision.

Frequently asked questions about Dots, Muse and Grok Bot

Can I use OpenAI Dots in Germany?

As a ChatGPT Pro user, no: the Pro rollout excludes the EEA, Switzerland and the UK; OpenAI does not give a reason for this. According to the Help Centre, a ChatGPT Business-Premium subscription, according to the Help Centre, yes – in all supported ChatGPT regions; Enterprise workspaces can enable the beta via an admin.

What distinguishes Grok Bot most from Dots and Muse?

Isolation. All bots within a Grok Bot account share a single cloud computer, including files, sessions and logins; xAI expressly advises against treating separate Bas a security boundary. Dots gives each agent its own computer, whilst Muse gives each user their own VM with a guardian agent.

How much does an Always-on Agent cost?

Muse: free up to 100 million tokens per week, then US$20 or US$100 per month. Dots: one agent included in ChatGPT Pro or Business Premium; additional agents subject to a charge later on. Grok Bot: included in SuperGrok, Cursor and Enterprise plans. None of the providers convert the additional weekly quotas into completed tasks.

Is Muse more secure than Dots?

Conceptually, Muse has the greatest control over outgoing actions via Sentinel; in practice, however, Reuters reported that safeguards were circumvented at launch. Dots technically separates proactive research (read-only) from action. The better question is: what is the scope of impact an error can have? In this respect, both are ahead of Grok Bot.