Yeah, that's the core of the issue:

https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

The "lethal trifecta": To be useful, an agent needs internet access, untrusted inputs, and your private information.

So it can get prompt injected and exfiltrate your data. (Indeed I read that Claude Code puts your email address into HTTP requests it makes to random servers?)

My solution here was to just not give it anything, but that does preclude the "my claw bought a car!" result everyone's excited about.

My way of thinking here is "blast radius". Assume it will get prompt injected. What goes wrong? Then design the setup so that scenario is not bad. e.g. it has my keys but they've got $5 of credit on them. It has access to the filesystem, but only on its own Linux account. (Ok I set this up last year before they could communicate thru the bloody CPU cache, might need an update :)

FWIW, my biggest use case for agents like this is ongoing research. I.e.: check Humble Bundle weekly and tell me if there’s a book bundle I might be interested in. Has the Music Box announced a film series I might want to visit Chicago for? That sort of thing; I want filters for the firehose.

I'm on your side wrt sensitive data, but there are other use cases. I use the OpenAI one: Dot, and this is why I've found it valuable:

- it uses a very fast model for normal responses, but also does reasoning and all the agent things. It responds within a second or two. - it feels like it has multiple threads internally- it can respond to your messages and questions immediately, but also do thinking and web search like a normal thread. - it can communicate with other agent threads, as an orchestrator (although this isn't unique to it). - it has dedicated persistent compute already, with a desktop that you control, and so gives you a UI surface area that the agent can use.

And so the value for me is an always-on agent conversation, where you can tell it to perform tasks and ask it questions, and it just does all of it immediately. Those tasks can be software development instead of like ordering dinner.

It has SMS / phone comm channels also, but I don't use that.

I get a lot of value out of my Hermes setup, but it does not have my banking, or private data beyond GitHub projects that are shared with it. It has its own email and GitHub account, and access to drive Codex, Claude Code or Cursor. I treat it as an assistant via Slack.

It does research on products or real estate that I am interested in, it builds apps and other software projects for me, and does structured research on any topic. Information comes back to me via Slack, GitHub PRs, or websites/services served on the Mac that Hermes runs on.

Using an agent from Slack also adds a killer feature: multi-player contexts. I can work on changes with other human collaboators right in the same thread.

Does it work with Claude's 1Password connector? https://1password.com/blog/1password-for-claude

In the article the author mentions that Duet doesn't seek any sort of credentials and mentions connecting repos, so I think that this assistant is being used more for managing coding work in a different way than managing life work. I do agree that to get to true "personal assistant" levels, like planning a whole trip for you, booking tickets, etc. you'd have to give pretty much full access to your identity and money, but people claiming it can do that probably are just handing it over, security issues aside.

Perhaps services could permit buying things with special AI credit card numbers that link to a special account that the user needs to manually approve by some period of time or else the order is canceled? Works differently though than normal payments where they can just ship the product or deliver the service based on receiving the credit card number.

I started using Grok Bot a few days ago and I have seen zero screwups.

I don't know what I'd need a channel for, creating bots/personas seems more natural.

Adding credentials is essential, contrary to what the author of the article said. I gave it my library login and it can fetch newspapers for me instead of me clicking through the app every day.

When I had to provide a GitLab token, it nicely spawned a box for me to save the credential.

  - What did not work well -

Permission settings. There is a form where you can automatically allow actions you describe in natural language. I tried to allow it to run Claude on my computer or Send certain emails automatically, but the settings achieved nothing.

Coding. I wasn't able to make it use Claude, and its own work is worse than me using Opus 5.5 in Claude Code.

  - What worked well -

I’ve hacked together my own version of this, basically a Swift app to manage secure access so I control the thing that has full disk access.

And then run a coding agent to manage calendar, emails, research projects against my work history, etc, with TouchID for the sensitive pieces.

It’s incredible, I hope to never put a flight on my calendar by hand again, and soon I won’t be buying them, either.

There was a really good line I heard recently about how a lot of the hype comes from people who have has assistants as staff in life previously, whereas most of the population has never been in that position. So don't worry if it's not at all obvious how to benefit from this for the near future (I also have near 0 interest of delegating my personal matters)

I was feeling that way prior to Duet. Like I said in another comment, what makes Duet useful to me is that it provides project management I've been missing without trying to take over my personal life. I need a project management assistant not someone who pretends to be me on the phone.

It's finally happening. It's almost a relief.

You might be right- Duet feels more like a project management assistant than a personal assistant, so perhaps not the right comparison.

I did try OpenClaw myself when it came out. But I felt like there was nothing really new there over what we had been building for the previous years; just consumer adoption happening. Definitely feels like this new wave of products (Muse, Duet, Dots, etc) is onto something. I have been them daily, feel like they are incredibly useful, and have clients ask to build something like this for them (they never asked for OpenClaw'esque products).

Agreed. I don't want the extra bits that try to mimick humans.

Sometimes it's as though they added background noise to make it sound like it's looking for things. Or even the long "hmmm, let me cheeeckkkk...".

Also, I think I'm ready to be able to choose from a robotic voice.

The lack of a true voice mode is curious at this point: ChatGPT has had it for a long time, I'm curious what the product managers at Anthropic are thinking here.

But I'm surprised you have trouble spinning up coding sessions: I have delegated that down from the top channel without any problems. Maybe you mean that you would like them to show up in the Claude Code UI? Today I can go to main channel and say "We need x and project y" and it delegates that down to a subthread in #y that soon has a PR ready. It's doing all of that in code sandboxes, and I have some of the usual settings for adjusting sandbox network access (though noticeably fewer knobs than CC environments).

That is the trend for sure. Duet is where I go from an agent manager to a manager of agent managers, and I have mixed feelings about that.

I guess I'm behind then! I presume Grokbot has to be powered by Grok? It's hard for me imagine delegating work to it when I have Opus 5.5. as an option.

What backend do you use for Hermes?

Via the webUI maybe?

Have you compared it to others, like Hermes or Dot? I have not forayed into Grok Bot so I have no basis for comparison.

What do you mean copy? This is the copy, it's already behind Muse, Dots

The killer feature is having the best model behind it. Not so easy to copy. Grok Bot tries to compete with a really good harness/infra and the team is doing a great job but having Grok as a model behind id is a huge disadvantage.

This is very close to my Nanoclaw setup. rpi5 on an isolated network.

I will say the Dot computer is a nice escape hatch for when built in plugins fail. Duet seems more inclined to give up if something doesn't have a clean integration option.

I don't trust Facebook or Zuckerberg, but I also don't really care about my own personal privacy from large corporations. I will use whatever is best/cheapest, generally. And I say this as someone who hates advertising and adtech.

Or GrokBot that isn’t an Elon employee.

Ive never had a meta account. Zuckerberg still has all my data and knows everything about me. At some point people decide its not worth hiding from mega corps

That's because HN is an echo chamber. Plenty of tech people use and enjoy Muse/Instagram/Facebook, but the would be downvoted if they expressed it.

[flagged]

Well the start the article saying they're not affiliated with Anthropic, and then talk about "Duet", saying "anthropic has done it again". They then list a handful of products they've tried, including "a host of other personal-assistant-type harnesses".

Is it not obvious that this is an Anthropic-made "personal-assistant-type harnesses"?

https://claude.com/resources/articles/claude-duet

The first two sentences menthon anthropic so its this. https://claude.com/resources/articles/claude-duet

Meh, I think it's fine for blog posts to assume familiarity like this if it reflects their niche. They're writing for the type of person who already knows what Duet is. It's not the NYT where there's a massive general audience.

In fact, the choice not to explain things tells me a lot about the shared knowledge of a niche when I'm looking in from the outside. I don't mind the extra digging to decode it and the implied familiarity gives me information about its importance.

Touche. I should have at least linked to the product announcement.

[flagged]

Are you talking about self-organising maps or the sci-fi level capability we've seen in the last year?

These kinds of replies always astound me. Like, I have a better use for my attention and token limit than building and fiddling with my custom agent harness?

I’m on the same opinion. Why do I need to limit myself to something proprietary and in somebody else’s control when I can build and morph a tool to my needs.

The only reason I even look at frontier lab apps is for inspiration or shortcuts to my own implementation.

Using their apps feels like QA testing a trainwreck anyway with all of their UI/UX being an afterthought.

It is just rsync after all right?

I do agree. We have a household assistant and it's not particularly different in functionality from the ones by mainstream labs. It's not a lot of work to build. Because we run on our own LLM base we can also do things like plumb our home cameras into it and so on.

I think it's more cron jobs, RESTful-type wait and react methods, and a harness that is calibrated to being a good assistant.

i.e. It saw I had an optometry-type appointment this morning and supplied some questions I might want to ask or consider.

The first sentence really do reads like trolling.

You're getting downvoted, but I do increasingly find myself building products for a user of 1 (myself), sometimes not even bothering to create a Github repo. But integration is often the hard part, and it's nice when a company makes a core product that does the hard parts for you.