On 11 August 2026, xAI shipped Grok Bot into early beta and described it in one sentence: your team of always-on agents, each with its own computer, working inside your tools 24/7. Rather than answering questions in a chat window, a Bot gets a persistent desktop, signs into your applications the way a person would, and keeps working after you close the tab. You show it a workflow once, and it saves that workflow as a routine it can run again on its own. Multiple Bots can coordinate with each other in shared threads, splitting a job the way a small team would. It is available today to SuperGrok Plus and Heavy subscribers, and to Cursor Pro+, Ultra, and Cursor Teams subscribers, with an Enterprise tier currently on a waitlist.
Buried in the launch page sits a customer quote that should stop any security engineer mid-scroll. A sales lead says he showed a Bot a workflow once, now trusts it to run forever, and estimates he is two to three times more efficient “because it does it without me verifying and reviewing.”
That quote is the product working exactly as designed. It is also a precise description of an unreviewed agent holding production credentials, reading attacker-writable text, and taking irreversible actions on someone’s behalf. Both readings are correct at the same time, and that tension is what makes this category hard to evaluate.
Grok Bot is not alone in this space. A wave of managed and self-hosted agent platforms shipped recently, each making a different bet about where the agent runs, who approves its actions, and how much control it hands back to the buyer:
OpenWorker— free, open-source, local-first desktop coworker with bring-your-own-key model access and enumerated approval gates.https://openworker.com/Perplexity Portable Computer— fully local agent stack on an NVIDIA DGX Spark, gating cloud escalation and outbound actions at the boundary crossing.https://www.perplexity.ai/hub/products/portable-computerClaude Tag— Slack-native agent bounded to admin-selected channels, tools, and memory scopes.https://www.anthropic.com/news/introducing-claude-tagClaude Managed Agents— developer runtime for building and hosting agents in Anthropic-managed or self-hosted sandboxes, currently in beta.https://platform.claude.com/docs/en/managed-agents/overviewOpenAI workspace agents— policy-bound, Codex-powered agents shared across a ChatGPT workspace, with a Compliance API for visibility and control.https://openai.com/index/introducing-workspace-agents-in-chatgpt/Microsoft Copilot Studio / Agent 365— enterprise agents represented as identities in Microsoft Entra, with Conditional Access and Purview/Sentinel integration.https://learn.microsoft.com/en-us/microsoft-copilot-studio/Kimi Claw— Moonshot AI’s browser-native, one-click cloud deployment of OpenClaw, with persistent memory and access to more than five thousand ClawHub skills.https://kimi.com/bot
And there are more, and I did not list them all due to page limits.
Each of these products makes computer-use or tool-use agents dramatically more capable. Each also inherits the same underlying failure mode: a language model with no reliable boundary between data and instructions, reading content it did not choose, holding credentials it did not issue itself, and able to act outward on your behalf. Feature checklists do not capture what actually differs between these platforms. What differs is how much control each one gives you to bound the consequences when — not if — something goes wrong.
As the first attempted comparison across Grok Bot, OpenWorker, Perplexity Portable Computer, OpenClaw, Claude Tag, Claude Managed Agents, and leading enterprise agent platforms, this analysis bypasses superficial feature checklists. Because these systems share a core failure mode, their true differentiator is how much control they give you to bound risk. To set a rigorous baseline, I examined the primary documentation for every platform, cross-tested vendor claims directly, and evaluated each architecture through two purpose-built frameworks: a fast diagnostic screen and a layered threat model.
The diagnosis comes from Simon Willison, who named the lethal trifecta in June 2025: access to private data, exposure to untrusted content, and the ability to communicate externally. A language model has no reliable boundary between data and instructions, so untrusted text that reaches the context window can carry a command, and the agent will execute that command using whatever private data and outbound channels it already holds.
Figure 1 shows why the arithmetic matters more than any feature list. When all three properties overlap, the centre of the diagram is not an elevated risk score. It is a working exfiltration path that no amount of system prompting closes.
Figure 1: The lethal trifecta, as named by Simon Willison
The trifecta is a fast diagnosis and a narrow one. It describes a single agent in a single session, which means it goes quiet exactly where this product category gets interesting: multiple agents coordinating, memory persisting across sessions, and skills arriving from public registries. Meta's Agents Rule of Two, published in October 2025, turns the trifecta into a design constraint, and I have argued at length that the constraint is necessary but nowhere near sufficient. The deeper analysis in this piece therefore runs on MAESTRO, the seven-layer agentic threat modeling framework I published with the Cloud Security Alliance in February 2025.
The full analysis below runs through every major platform in this category. Here is what it works through, and what you get for reading it.
I screen every platform against the lethal trifecta using nothing but each vendor's own published documentation, and show which ones ship holding all three properties by default. I then take Grok Bot apart as the reference product, map each advertised capability onto the trifecta edge it closes, and surface a tier gap that decides whether the whole posture is defensible in an enterprise: the controls that would make Grok Bot safe live on a tier that cannot currently run Bots.
Next I separate the three architectures an approval gate can use, because human oversight means three incompatible things across these products, and only one of them survives an attacker. I test the claim that local-first software is inherently safer, and show why blast radius rather than hosting model decides how bad an incident gets. I then examine Perplexity Portable Computer, which is the only product here that gates the boundary crossing rather than the action, and name the residual risk that design still carries. I walk the five-step attack chain Microsoft published against self-hosted agent runtimes, and cover the retention exclusion in Claude Managed Agents that catches buyers who assumed self-hosting would fix it.
The second half switches instruments. I set out the seven specific places Meta's Rule of Two runs out, then run a full MAESTRO analysis across all seven layers, showing which threat bites hardest at each layer for these particular products and which control actually helps. I walk a cross-layer goal misalignment cascade in which every individual agent stays compliant while the system as a whole is compromised, because that is the failure no single-agent rule can see. I finish with the zero-trust agentic architecture that replaces constraint with defence in depth, a decision procedure keyed to the constraint that actually binds you, and minimum deployment controls mapped to zero-trust pillars.
You also get seven large-format comparison tables, eleven diagrams, and working code for a taint-tracking approval gate, an enumerated permission policy, the four commands that prove your controls work, and the audit event shape you should demand from any vendor.
For paid subscribers, the complete analysis continues below. Everything above is free. You can unlock this piece and every paid deep dive across the Agentic AI and AI Security series at 50% off a yearly subscription here: kenhuangus.substack.com/subscribe.
