Proactive AI Agents in 2026: A Practical Comparison of Dots, Muse, Grok Bot, Instinct, OpenClaw, and Hermes

An AI assistant that only answers when you type is easy to reason about, because nothing happens until you ask. The new generation of personal agents intentionally breaks that rule. That changes what you should check before handing one your inbox.

Between August 11 and October 21, 2026, xAI shipped Grok Bot, Meta shipped Muse, OpenAI shipped OpenAI Dots, and Anthropic previewed Claude Duet. All of them are built to keep working after you close the app and to message you first. Instinct, an agent you reach by text, was valued at $10 billion by October. The open source side got there earlier: OpenClaw (393,525 GitHub stars on October 31) runs a heartbeat every 30 minutes by default, and Hermes Agent (259,065 stars) runs cron jobs and signed webhooks on your own machine.

Below, six agents are compared on triggers, hosting, credentials, and price. The running example is a weekday 8 AM brief that speaks up only when a decision is needed, plus a new GitHub issue. Facts were checked, and the OpenClaw and Hermes commands run in clean Docker containers, on October 31.

Why proactive agents appeared now

The shift became possible because model latency dropped enough for an agent to run many turns quietly. A generation ago, an AI assistant had to wait for a user prompt because the cost of running a background loop was too high. Now, a frontier model can process an inbox, summarize a calendar, and decide whether to send a message in under a minute. The missing piece was not intelligence. It was permission to start a turn on its own.

Proactive agents also benefit from better tool integration. They can read Gmail, Slack, GitHub, and calendar APIs through connectors. They can run browser sessions. They can execute code. This makes them useful for real work, but it also expands the attack surface. The industry is still learning how to build safe versions of these systems.

Another driver is the API-native nature of these agents. Many of them are built on top of the same model providers and use the same webhook primitives that developers already understand. That is why a developer can set up a self-hosted agent with a GitHub webhook in a few minutes. The barrier to entry is much lower than it was a year ago.

What makes an AI agent proactive

An agent is proactive when it starts a turn without a new message from you. The trigger can be a schedule, which usually means a cron expression. It can be an event, such as a webhook, a Slack mention, or a push from GitHub. It can also be a self-wake, where the agent decides when to look again or runs a periodic pass that asks whether anything needs attention.

The self-wake is the new part, and it only works if the agent is allowed to say nothing. OpenClaw's default heartbeat prompt ends with 'If nothing needs attention, reply NO_REPLY'. Hermes skips delivery when a cron job's final response contains [SILENT]. This quiet path is important. If the agent always replies, it becomes spam, and you quickly learn to ignore it. A good proactive agent should send fewer messages, not more.

The other change is risk. An unattended agent reads untrusted text, like email messages and GitHub issue bodies, with your logins loaded. That changes the threat model. A prompt injection in an email can reach the agent's tools. The agent may not be sophisticated enough to understand that a requested action is malicious. It might send email, create issues, or update records based on text it was never explicitly asked to process. That is why every serious proactive agent now has some kind of approval layer, sandbox, or credential separation.

There is also a distinction between agent orchestration and agent execution. A proactive agent can be a coordinator that decides what needs to be done and delegates to other agents. Or it can be a single agent that performs the task itself. OpenAI Dots leans toward coordination. Grok Bot is more of a team of agents that share one environment. Hermes and OpenClaw are closer to traditional automation frameworks with an LLM in the loop. Understanding these differences matters because they affect where credentials live and how much damage a compromised agent can do.

Another important concept is delivery. A proactive agent needs a channel to reach you. Telegram, Slack, email, SMS, and WhatsApp are all common. Some agents use their own notification system. The delivery channel is not just a UX detail. It is also an attack surface. If an attacker can spoof the channel, they can inject messages into the agent's context. Some systems solve this by using signed webhooks and authenticated channels. Others rely on the provider's infrastructure.

A quick look at the field

Before comparing the six, it helps to see them side by side. The table below summarizes the main options. It is not exhaustive, but it captures the differences that matter for most developers.

There are two broad families here. Hosted agents run on the vendor's computer. That means they can work while your laptop is closed. Open source agents run on your own machine, so they only work when the gateway is running. Both families have security tradeoffs. Hosted agents keep your data on someone else's infrastructure. Self-hosted agents require you to secure your own box and handle secrets carefully.

Hosted versus self-hosted tradeoffs

Hosted agents are attractive because they ask for very little technical setup. You click a button, connect an account, and the agent starts running. The provider handles uptime, scaling, patching, and model updates. The downside is that you are trusting the provider with your data. Even with strong encryption in transit, the provider can access your content if it chooses to. Some providers offer enterprise contracts with data processing agreements. Others do not.

Self-hosted agents require more work. You need a machine that stays on. You need to install the gateway, manage dependencies, and keep it updated. You need to decide how to expose webhook endpoints. You also need to handle your own secrets. In exchange, you have full visibility into what the agent does. You can inspect logs. You can modify the source code. You can add your own security controls.

There is also a middle path. You can run a self-hosted agent on a cloud VM and let it communicate with the world through a tunnel like Pinggy. That gives you the privacy of your own server and the convenience of a public URL. It does not solve the patching problem, but it solves the network problem.

OpenAI Dots: a coordinator that decides when to check back

OpenAI Dots lives in OpenAI's cloud with its own computer and browser. It runs on GPT-6 Astra and decides when to pause and resume. Follow-ups need no fixed schedule. Its background research is read-only, and follow-up actions need the applicable permissions. You ask for the brief in plain words with a time zone and an end date, and it appears under Scheduled. Actions pass through your custom rules, such as 'Ask before taking action' for outgoing email.

OpenAI's docs describe no webhook triggers, so the GitHub issue waits until the dot next checks your apps. Its strength is coordination: it hands work to ChatGPT Work and Codex and chases each job. It is a supervisor agent rather than a simple task runner. The dot model is interesting because it can decide to go do research, come back, wait for a while, then continue. This is different from a cron job that fires at a fixed time.

Personal Pro excludes the EEA, UK and Switzerland, and you get one dot per account. The price is high, so this is aimed at professionals who already live inside OpenAI's ecosystem. In practice, Dots feels like a managed chief of staff. It can prepare briefings, monitor dashboards, and keep an eye on projects. It is not designed for event-driven automation in the same way as Grok Bot.

One of the things to understand about Dots is that the environment is ephemeral but persistent enough for long-running tasks. It has a browser, a file system, and access to GPT-6 Astra's reasoning. The read-only research mode is a strong safety feature. It means the dot can browse the web and read your connected apps, but it cannot modify anything unless you grant a specific permission for that action. This is a different security tradeoff from giving a bot full access to a shared computer.

A common question is whether Dots can react to external events. The answer in late 2026 is no, at least not through webhooks. It can poll apps on a schedule, but if an urgent issue arrives at 9:17 AM, you may not hear about it until the dot's next scheduled pass. That is fine for a morning brief, but it is not fine for incident response.

Another detail is the custom rules engine. You can define rules that require approval before the dot performs certain classes of action. This is a useful control, but it depends on the user writing good rules. If you allow outgoing email without approval, the dot can send email based on its own judgment. You should start with conservative rules.

Meta Muse: a second agent holds the keys

Meta Muse gives each user a dedicated cloud VM. Meta's security write-up is the most detailed of the six. The agent runs in a systemd-nspawn container, and a separate host-side agent called Sentinel decides what it may do. The key quote from the write-up is 'Muse proposes actions, but only Sentinel can grant permission to perform action.'

Muse holds only surrogate tokens. Sentinel swaps in real credentials at the network boundary. Payments use single-use Stripe Link cards, each needing your approval. This is a meaningful design improvement over agents that store your real access tokens inside the agent context. Even if the Muse container is compromised, it does not directly hold your Google or Microsoft credentials. It has to ask Sentinel, which can enforce policy, rate limits, and user consent.

Meta says Muse runs cron jobs in the background and makes unprompted suggestions, but describes no schedule screen or event triggers. You ask for the brief in chat. It runs on the web, iOS, Android and WhatsApp. It is US only, and needs a card even on the free tier. Meta also says staff access to user data is restricted by policy, not technically prevented, until a planned 'Muse Confidential VM' ships.

The lack of a visible schedule screen is not a deal breaker for everyone. You can still say 'every weekday at 8 AM, check my inbox and calendar' in natural language, and Muse will set up a background job. The problem is discoverability and control. With no event triggers, you cannot make Muse react to a GitHub issue. You can only ask it to check periodically. For many users, that is enough.

Muse's pricing tier starts with a free tier, then Power at $20, and Maximum at $100. The VM per user is a strong privacy feature because it prevents cross-tenant inference. But it also means Meta cannot cheaply scale to millions of users. The requirement to add a card on the free tier is likely to reduce abuse.

A useful mental model for Muse is that the agent is not the principal. The user is the principal, and Sentinel acts as a policy enforcement point. This is similar to how a service account works in cloud security. The agent can propose, but it cannot act without authorization. This separation is worth emulating in your own agent projects.

Grok Bot: a team of bots on one shared computer

xAI launched Grok Bot in beta on August 11 as 'a team of always-on agents', with the most explicit triggers of the hosted group. A routine runs on a schedule, at least five minutes apart, or on a Slack mention, GitHub, Linear, Sentry or PagerDuty activity, email to the bot's address, or a webhook. It is the only hosted agent here that reacts to our GitHub issue instantly.

The catch is the computer. xAI says 'All of your Bots use the same cloud computer, sharing its files, browser sessions, and app logins.' It runs in Cursor cloud. A triage bot reading a poisoned issue shares your inbox bot's Gmail session. This is a serious security consideration. If one bot is compromised, all bots on the same account share the same environment.

xAI adds an independent Auto Review model for risky actions. Connector tokens are kept on Cursor's backend, and passwords are filled by reference. These controls reduce the risk of the shared computer, but they do not eliminate it. The shared computer means that any file written by one bot is visible to another bot. If a workflow requires isolation, Grok Bot is not the right choice.

Grok Bot comes with The X Subscription's Premium, Super and Ultra plans and paid Cursor plans. It is in beta. The breadth of triggers is impressive. GitHub, Slack, Linear, Sentry, PagerDuty, and generic webhooks cover most developer workflows. For teams that already use these tools, Grok Bot can act as a central automation hub. It can triage issues, respond to incidents, and send summaries to a Slack channel.

The 'at least five minutes apart' limit is worth noting. You cannot run a cron job every minute. This is probably to prevent abuse and to keep costs manageable. If you need sub-minute scheduling, a self-hosted agent like Hermes or OpenClaw is better.

The shared computer model also has implications for secrets. Because all bots share browser sessions, a login to a third-party service is available to every bot. The Auto Review model can intercept risky actions, but the model itself is an additional system that must be audited. If you use Grok Bot, you should carefully define which bots can access which tools. The provider's documentation does not currently allow per-bot isolation.

Instinct: an agent you text, that texts you first

Instinct has no app. You text or call it, and it can use a phone and computer in the same way that you do. The company, Spear Street Technology, Inc., was founded by Noah Shinn. A hands-on review from October 25 says it 'checks in, keeps track of ongoing tasks, and takes the initiative to remind you to cancel a subscription.' It has since added phone calls, its own email addresses, and group chats.

Instinct publishes no trigger model. There are no docs on schedules, events, or approvals beyond purchases. Purchases use one-time Stripe Link cards for amounts you approve. Before connecting Gmail, you should read its terms. The terms were revised August 26, 2026. They include language like 'You also authorize us to access, copy, collect, and index data from your Connected Services' and 'You hereby appoint the Services as your agent to enter into agreements, commitments or transactions on your behalf.' Training on your data is on by default, with an opt-out.

For a developer, Instinct is the least transparent option. It is also the most consumer friendly. There is no app to install, no dashboard to configure, no API. You just text it. That makes it ideal for non-technical users, but it also makes it hard to audit. If you care about knowing exactly what the agent can do, Instinct is a risk.

The $10 billion valuation in October shows how much investor interest there is in proactive agents. Even without a public pricing page or a detailed security model, Instinct has captured attention. The service is in early access. Early users report that the agent is good at following up on tasks it has seen in text messages. It can set reminders, monitor ongoing conversations, and send proactive suggestions.

From an architecture perspective, Instinct likely runs on its own phone and computer infrastructure. The agent has a phone number and can send SMS messages. When you send a message, the agent parses it and may start a task. Later, it can initiate a text to you. This is a different model from a cloud workspace because it is built around the phone as the primary interface.

One concern is the terms of service. The phrase 'appoint the Services as your agent' is broad. It means Instinct may be able to enter into agreements on your behalf. The use of Stripe Link cards limits financial risk to amounts you approve, but other actions are less constrained. You should not connect critical business accounts until the security model matures.

OpenClaw: a heartbeat on your own Gateway

OpenClaw v2026.10.9, released October 29, runs a Node.js Gateway on your machine. Automations run inside it, so nothing fires while it is down. The self-wake is the heartbeat. It is a system-owned job that runs an agent turn every 30 minutes by default and messages your own DM. The checklist now lives in a monitor scratch instead of HEARTBEAT.md. You can set it with a command like this:

openclaw cron scratch <jobId> --set 'your checklist here' 

The openclaw doctor --fix command migrates from the older HEARTBEAT.md format. This is a good example of how quickly the open source agent space is moving.

The morning brief is a separate isolated job. openclaw cron is an alias for openclaw automations. Here is the full command:

openclaw cron create '0 8 * * 1-5' 'Check my inbox and calendar. Tell me only what needs a decision today. If nothing does, reply NO_REPLY.' --name 'Morning brief' --tz 'Asia/Kolkata' --session isolated --announce --channel telegram --to '123456789' 

After that, openclaw cron list --all shows both jobs. The output looks something like this, trimmed and with a test agent named dev:

Name Schedule Target Delivery Heartbeat (dev) every 30m main not requested Morning brief cron 0 8 * * 1-5 @ Asia/Kolka... isolated announce -> telegram:123456789 (explicit) 

A cron expression parser will explain 0 8 * * 1-5 if you do not use cron often. The schedule means 8:00 AM from Monday to Friday. The time zone is important because the shell's time zone is not necessarily the one you want. OpenClaw lets you set --tz directly on the job.

One default to change immediately. The job allowed every tool because toolsAllow was set to ["*"]. You should pass --tools with an allow-list. This reduces the attack surface if the agent's prompt is manipulated. The OpenClawCVEs tracker counted 543 CVEs and 211 advisories on October 31. That number sounds alarming, but it reflects a very active project. Still, self-hosting means you are responsible for patching.

OpenClaw has a large ecosystem of plugins, automations, and community extensions. It can connect to many messaging platforms, CRMs, file systems, and developer tools. The default heartbeat is the fastest way to get a proactive agent running locally. You need a model API key, and you pay for the tokens.

Hermes Agent: cron jobs and signed webhooks

Hermes Agent v0.22.5, released October 23, runs its scheduler inside the gateway. It ticks every 60 seconds. Schedules can be plain English. Failed runs always deliver, and a monitor mode with --monitor-url or --monitor-script skips the LLM entirely when a cheap check's output has not changed. That is a useful optimization for health checks.

Here is the same morning brief in Hermes:

hermes config set timezone Asia/Kolkata hermes cron create 'weekdays at 8am' 'Check my inbox and calendar. Tell me only what needs a decision today. If nothing does, reply [SILENT].' --name 'morning-brief' --deliver telegram 

The output shows the job ID and the next run time:

Created job: 115c4cda804e Next run: 2026-11-02T08:00:00+05:30 

Nothing runs until hermes gateway run is up. Set the time zone first. In our test, changing the time zone afterwards did not move the stored next run. For the model side, you can run Hermes on free OpenRouter models. That makes it possible to experiment without paying for an API key.

Hermes has the clearest scheduler and webhook model for developers. The gateway is a Python process, which is easy to extend. The monitor mode is particularly effective. If you have a script that checks whether a service is healthy, you can run it on a schedule and only invoke the LLM when the script reports a change. This keeps token costs low and makes the system more predictable.

Triggering Hermes from GitHub through a Pinggy tunnel

Grok Bot gives you a webhook URL, but Hermes can only recieve webhooks on port 8644 of a machine with no public address. To receive GitHub events, you need to expose that port. This is a common problem for self-hosted agents. A tunnel solves it.

The docs suggest setting WEBHOOK_ENABLED=true in ~/.hermes/.env, but in v0.22.5 hermes webhook subscribe refused with the error 'Webhook platform is not enabled' until the flag was placed in config.yaml. This is exactly the kind of configuraton detail that can eat an afternoon. The fix is:

hermes config set platforms.webhook.enabled true hermes webhook subscribe github-issues --events 'issues' --prompt 'New issue #{issue.number} in {repository.full_name}: {issue.title}. Triage it and tell me if it needs me today.' --deliver telegram hermes gateway run 

Subscribing prints a generated HMAC secret and http://localhost:8644/webhooks/github-issues. In a second terminal, run:

ssh -p 443 -R0:localhost:8644 free.pinggy.io 

Pinggy prints an HTTPS URL ending in .run.pinggy-free.link. Under the repository's Settings, go to Webhooks, then Add webhook. Enter that URL plus /webhooks/github-issues. Choose application/json, paste the secret, and select only the Issues event.

We tested teh path with a signed GitHub-style issues event. Our test gateway had no Telegram bot, so the --deliver telegram route answered with HTTP 503 and the error {"error": "Admission unavailable; retry this delivery"}. The lesson is to connect the delivery channel first.

With the route switched to --deliver log, a valid X-Hub-Signature-256 got HTTP 202 with {"status": "accepted", ...} and the gateway logged the rendered prompt. A wrong signature got HTTP 401 with {"error": "Invalid signature"}. This shows that the HMAC verification works.

A free tunnel expires after 60 minutes with a new URL, so a saved hook needs a Pro token with a persistent subdomain. The command looks like:

ssh -p 443 -R0:localhost:8644 <token>@pro.pinggy.io 

More details are in the Pinggy guide to receiving webhooks on localhost. Steps one through five were tested on October 31, 2026 with Hermes Agent v0.22.5.

This example matters because it shows how a self-hosted agent can participate in event-driven workflows. You are not limited to cron. With a tunnel, you can expose any local port and receive signed payloads from GitHub. The same pattern works for Stripe, Slack, or any service that sends webhooks.

Security considerations for self-hosted agents

Self-hosting gives you control, but it also gives you responsibility. Your gateway is a target. The default heartbeat in OpenClaw runs every 30 minutes. That means the agent is constantly reading your data, and an attacker who can inject content into a data source may be able to influence the agent. Here are a few practices to follow.

First, use allow-lists for tools. Do not let the agent use every tool by default. In OpenClaw, pass --tools with a specific set. In Hermes, configure the gateway to restrict available tools. This limits the damage a prompt injection can do.

Second, separate job sessions. Use isolated sessions for tasks that read untrusted input. If an email causes the agent to take an action, the action should not affect the rest of your system. OpenClaw has an --session isolated flag. Hermes has job-level configuration for similar isolation.

Third, use signed webhooks and verify signatures. GitHub sends an HMAC signature. Hermes verifies it. If you build your own trigger, always verify the payload signature before processing. Also use HTTPS for the tunnel endpoint. Pinggy provides HTTPS by default.

Fourth, patch often. OpenClaw has a high number of CVEs. This is not a reason to avoid it, but it is a reason to update the gateway frequently. You can automate the update process with a cron job or a CI pipeline.

Fifth, audit your agent's messages. Start with one job and read every message. Count how many times the agent acted without being asked. If it takes actions you did not expect, tighten permissions. If it sends too many irrelevant messages, refine the prompt with a quiet path.

How to choose a proactive agent

If your work lives in ChatGPT and Codex, pick a dot. It coordinates well and has read-only research. For cheap US errands, Muse's free tier and Sentinel design are the safest hosted bet on paper. Grok Bot suits teams that want event-driven routines and accept one shared computer. Instinct suits people who only want to text, if its terms are acceptable. OpenClaw has the biggest ecosystem but needs frequent patching. Hermes has the clearest scheduler and webhook model for developers.

Also worth watching are Anthropic's Claude Duet, a US waitlist preview that sends a morning brief and checks your apps every few hours, and Google's Gemini Spark. These two are too new for a direct comparison, but they confirm that proactive agents are becoming a standard feature.

Think about your delivery channel. An agent that texts you first is useful, but text is asynchronous. A Slack or Telegram message can be more searchable. Email is fine for long-form briefs. Choose the channel that you actually check. If you do not check Telegram, an agent that only publishes to Telegram will be ignored.

Think about the data the agent can read. Hosted agents read your data on their servers. Self-hosted agents read your data on your machine. Which is more comfortable depends on your threat model. If you handle sensitive client data, self-hosting gives you more control over compliance. If you want zero maintenance, a hosted agent is simpler.

Think about cost. Hosted agents have monthly subscription prices. Self-hosted agents have model API costs. At high volumes, API costs can exceed a $100/month subscription. At low volumes, self-hosting is much cheaper. You should estimate the number of agent turns per day. A heartbeat every 30 minutes is 48 turns per day. Each turn may include several LLM calls. A simple email check might cost a few cents. A complex research task can cost more.

Think about trigger flexibility. If you need to react to webhooks, Hermes and Grok Bot are the best choices. If you need fine-grained scheduling with seconds or minutes, Hermes and OpenClaw are better. If you want a coordinator that can decide when to check, Dots is unique. If you want no configuration at all, Instinct is the easiest.

Frequently asked questions

Can I use these agents without giving them access to my email? Yes, to various degrees. OpenClaw and Hermes only access what you configure. Dots requires connecting apps for research. Muse uses Sentinel to gate credentials. Grok Bot shares browser sessions, so be careful. Instinct can access connected services, and its terms are broad.

Which agent is best for GitHub automation? Grok Bot has native GitHub triggers and is the easiest hosted option. Hermes with a Pinggy tunnel is the best self-hosted option because you can run it on your own machine and verify signatures. OpenClaw also has GitHub integrations, but its default heartbeat is not event-driven.

Do I need a separate computer to run a self-hosted agent? Not necessarily. A laptop or a small cloud VM is enough for a single user. The gateway is lightweight. The heavy work is done by the LLM API. You do need the machine to be online when you want the agent to run.

Are these agents safe to connect to my bank? Probably not yet. The only payment-related safety feature among these is the single-use Stripe Link card used by Muse and Instinct. That reduces financial risk. However, no agent is safe if its prompt can be injected with malicious instructions. Keep sensitive financial accounts out of any agent until the security model matures.

Can I run OpenClaw and Hermes at the same time? Yes, but they cannot share the same delivery channel without careful configuration. Both can send to Telegram, and each has its own gateway. Running both lets you compare them on the same workflows. You should use separate job names and separate sessions.

How do I make the agent silent when nothing needs attention? Use the explicit quiet path. For OpenClaw, prompt it to reply NO_REPLY. For Hermes, include [SILENT] in the final response. Some hosted agents also have an option to only message when an action is needed, but you should verify that behavior in practice.

Conclusion

Whichever you pick, start with one scheduled job that has a quiet path. The quiet path can be NO_REPLY, [SILENT], or 'message me only if a decision is needed.' Then add one event trigger, with approvals on for anything that sends, pays, or deletes. After a week, count how many of its messages you were glad to get. That number is the real measure of a proactive agent.

Proactive AI agents are a new category. The differences in security models are more important than the differences in features. A shared computer is risky. A policy enforcement agent is promising. A broad terms of service is a warning. A persistent local gateway is powerful. Choose the model that fits your data, your risk tolerance, and your workflow.

If you are a developer, the self-hosted options are the easiest to audit. Hermes gives you signed webhooks and a transparent scheduler. OpenClaw gives you a large ecosystem and a heartbeat. Both are free and open source. They require more work, but they give you ownership. In a space that changes this fast, ownership is a real advantage.

Reference

• Proactive AI Agents Compared: Dots vs Muse vs Grok Bot vs Instinct vs Hermes vs OpenClaw (2026)