Personal AI Agents
Muse, Instinct, Tab, OpenAI's dots and Grok Bot took over the shluchim chats in September and October 2026. What each one is, what shluchim tried, the privacy argument, and a checklist before you connect one to your WhatsApp or email.
On this page
A personal agent is an AI assistant that does tasks for you, not just answers: it reads your email, fills in forms, books things, posts for you and keeps working after you close the app. You usually talk to it by WhatsApp, iMessage or text, like a virtual assistant (VA).
In September and October 2026 a wave of these launched, and for a few weeks they were most of what the shluchim AI groups talked about. The appeal is obvious: a shliach can voice-note "send the minyan reminder to the Shabbos list" and it happens. So is the risk: to do that, the agent needs your contacts, your inbox and often your passwords.
The products
Facts below are from the companies and from press coverage, checked on 2026-10-21. These products change weekly, so check the current terms before you sign up.
| Product | Who makes it | How you reach it | Price and access (Oct 2026) |
|---|---|---|---|
| Muse | Meta | Its own app (iOS, Android), muse.ai on the web, and WhatsApp | US only. Free for most use, with paid plans for heavier use |
| Instinct | Spear Street Technology, a San Francisco startup | Text message and WhatsApp | Private access by invitation. No announced price |
| Tab | Tab (tab.bot) | iMessage and WhatsApp | Private beta with a waitlist |
| dots | OpenAI | ChatGPT, Slack, Microsoft Teams | ChatGPT Pro and Business Premium first |
| Grok Bot | xAI (now SpaceXSI) | Mac, Windows and iPhone apps | Included with Premium ($30/month) and higher plans, Teams and Enterprise (x.ai/bot) |
Muse launched on 2026-09-08 (Meta's announcement). Meta says each user's agent runs in its own cloud virtual machine, a second "Sentinel" agent must approve anything it sends out, it cannot see stored passwords or card numbers, purchases use one-time card numbers through Stripe's Link, and you can opt out of your conversations being used for training. Two weeks after launch Amazon blocked Muse from shopping on Amazon.com, saying it had not been told and that the agent stored customer credentials (Adweek), and a security researcher showed that malware already on a Mac could hijack the Muse desktop app's account token. Meta called it a local attack and shipped a fix (9to5Mac).
Instinct connects to email, messaging, calendar, and the device's audio, location and screen. TechCrunch reported on 2026-08-24 that testers had flagged its terms of service (a "perpetual and irrevocable" license to user material, including for training, and permission to enter binding agreements for you), an email it sent without checking first, and inbox data it kept after Google access was disconnected. The company said it was taking the concerns seriously (TechCrunch).
Tab has its own phone number, computer and wallet, so it can call a business, wait on hold and text you what happened. Payments need your approval each time (Tom's Guide).
dots were announced at OpenAI's DevDay on 2026-09-29: always-on agents, each with its own cloud computer and browser, running on GPT-6 Astra and working toward goals you set (BGR).
Grok Bot entered early beta on 2026-08-11: persistent bots that each get a cloud computer and can operate websites and apps without an API (xAI). Press reports say a user's bots share one machine and set of credentials, so they are not separated from each other.
Other names that came up in the chats (Gemini Spark, Poke, Hark and several more) were not checked for this page.
What shluchim tried
From the shluchim and shluchos groups, September and October 2026. These are individual reports, not tests.
What worked
- Muse "lives in WhatsApp, I just voice note and it does it." Members used it to enter Zelle, Venmo and check donations into a CRM over Tishrei, to sort Google Drive, to cut video clips, and to draft personalized texts from a list of names with a button per person that opens the draft for you to send.
- Instinct drew the most praise for getting instructions right the first time: organizing email lists, filing flyers into Drive folders, adding RSVPs to a sheet, editing old flyers. One user made it "by far the go-to"; another keeps Instinct for business and Muse for personal.
- Tab was called the best of the group at reading old seforim from photos.
- A shlucha let an agent edit her ChabadOne pages while she watched every step and told it to ask instead of guessing. Instinct sent her a screenshot before it updated anything.
What went wrong
- Muse sent minyan texts at 2 a.m. without asking. Several reports said it has no sense of time, over-promises, and takes 10 to 15 minutes on tasks.
- An agent opened Amazon customer-service chats nonstop for 72 hours until Amazon flagged the account.
- An agent logged into a cellphone account with a password it found in the user's email.
- An agent filing police permits for the holidays entered the wrong date. Another deleted phone numbers from a CRM.
- Salesforce locked out a member after agent use, and passkey or security-key prompts stopped Muse at Salesforce and Meta business logins.
For anything complicated, several members went back to Claude Cowork or ChatGPT, where they can watch the work.
The privacy and trust argument
This was the longest debate in the groups, and it did not settle.
The cautious side: these companies are new, or in Meta's case have a long record of privacy fines, and the agent needs your whole inbox and contact list. Donors and community members never agreed to have their details sent to a startup's AI. One member refused to connect Instinct to anything Chabad-related for exactly that reason. A widely shared warning in Hebrew from an AI professional in the community said not to connect Instinct at all.
The other side: "If you're gonna go down the agent route you're gonna have to give up some privacy," you can remove permissions afterward, and you can turn off training. Several shluchos use and like these tools.
The practical middle that most people landed on, in one member's words: "only share with Muse what you are willing to share with a VA." Give the agent its own email address and its own limited CRM login, no credit card, and no main inbox, so you can see and undo what it did. The group admin uses Hermes and dots and said he will not give his whole Gmail to a new unknown company.
Self-hosted agents (GabAI, NanoClaw, Hermes Agent) are the alternative: your data stays on your server and you decide what each agent can touch, at the cost of setting it up yourself. One member noted their real advantage is group settings: separate agents for separate people and chats.
Should I connect this to my WhatsApp or email?
Go through these before you link a personal agent to anything that holds other people's information. If you cannot answer one, wait.
- Does it ask before it sends, posts, buys or changes a record? Turn that on and test it. If it can send without asking, do not connect your real email.
- Does it keep a log of what it did, so you can check it afterward?
- Can you limit each connection? Read-only email, one calendar, one folder, rather than everything.
- Can you fully delete your data, not just disconnect? Check what the company says it keeps after you unlink.
- Is training on your data off, or can you turn it off? Is that the default?
- Can you keep family, donor and staff information apart from what you give it?
- Can you export everything and leave?
- Who is responsible when it makes a mistake? Read the terms for language about agreements made on your behalf.
Then three rules from the groups' own mishaps:
- Use a dedicated email address and phone number for the agent, never your main ones.
- Tell it in writing: "Show me every draft and wait for my OK before sending." Agents that were not told sent things on their own.
- Linking an agent through WhatsApp Web or a QR code gives it your whole WhatsApp. That can break WhatsApp's terms and get the number banned (see WhatsApp Automation).
The checklist is adapted from one a shliach compiled in October 2026. More on the security side is on Agent Safety.