New AI Agents Get Their Own Cloud PC and Reach Out to You on Slack and SMS
Within three weeks, Meta launched its agent Muse (September 8), OpenAI introduced "dots" at Developer Day (September 29), and several competing agents arrived. But the most consequential shift this fall may be a researcher's admission: Ethan Mollick expected humans would have to carefully build and manage agent teams, much like building a company. It turned out that wasn't necessary — organizing work is, he writes, just one more thing AI can learn to do.
The admission that frames the wave
"I thought that getting agents to work effectively as a group would take careful construction, akin to building a company," Ethan Mollick writes in the essay "The Dot and the Swarm" on his newsletter One Useful Thing, October 1, 2026. His conclusion: "It turns out that organizing work is just one more thing AI can learn to do."
It is an unusual move for one of the most widely read AI commentators: an explicit correction of his own forecast. And it comes at a moment when the product landscape has actually changed. Mollick points to Meta's Muse — which he describes as number one in the App Store — OpenAI's competing dots, and similar offerings from Grok Bot, Instinct, and Gemini Spark. All of those product descriptions are Mollick's own reports, not independently verified. But the download figure for Muse is confirmed from another source: according to Yahoo Finance (October 2), Muse topped ChatGPT in Apple iOS downloads after launching September 8.
The admission matters because it shifts the focus. The discussion about AI agents has largely been about how humans should orchestrate them — frameworks, roles, project management. Mollick's point is that this problem partly solves itself once agents have persistent memory, their own hardware, and the ability to communicate proactively.
What actually launched
The concrete news consists of three events in under a month:
September 8, 2026: Meta launches Muse, a personal AI agent app. According to Yahoo Finance, it quickly became more downloaded than ChatGPT on iOS — but Meta has not yet reported a quarter that includes Muse, so no one knows what it earns.
September 29, 2026 (US time): OpenAI introduces "dots" — resident agents in ChatGPT — at the company's Developer Day, where CEO Sam Altman presented them as "always on" agents for ordinary consumers, according to WIRED's Uncanny Valley podcast (October 1).
October 1, 2026: Mollick publishes "The Dot and the Swarm," connecting the product wave to the broader argument about self-organizing AI.
There is no primary OpenAI documentation in the available source material. The most detailed description of how dots work comes from DenDen (note.com, October 2), a secondary summary of OpenAI's official announcements and help documentation — machine translated, according to its own system message. The mechanisms below should therefore be read with that caveat.
How the agents work
What is common to the new wave are three features that set them apart from earlier chatbots:
Persistent hardware and memory. According to DenDen, each dot has its own dedicated cloud PC, browser, and memory, and keeps working while tracking the project. It's like having a permanent employee with their own desk and machine: you can hand over tasks, and the agent keeps working even when your own PC is closed. The agent only makes contact when a decision is needed.
Human communication channels. Mollick describes the core of the products this way: "The trick is that you talk to the model as you would talk to a human, messaging it on Slack, SMS, or WhatsApp, and it also proactively reaches out to you, as a human would. For dots you can actually also hop on a call with your agent." Proactive contact is a significant change: the agent is not a tool you open, but an actor that takes initiative over channels that until now have belonged to humans.
Learned context instead of supplied context. This is Mollick's real point, and it is his analysis, not a verified property: "I think the most important thing is what you no longer have to tell them. You don't have to type in tons of context — the AI learns it from your messages. You don't have to give them a plan, they develop plans themselves."
Dots' permission model
The safety mechanisms in dots, as DenDen relays OpenAI's safety documentation, work like this: for each individual operation, the user can choose in "Custom Rules" between "execute without confirmation," "confirm before execution," or "hand over to user." In addition, a separate mechanism called "Auto-review" checks actions like sending messages or changing files against the rules — and according to DenDen, the dot itself cannot stop this check. Passwords should never be sent to the model.
This is a sensible architecture on paper: a decision pyramid where the user chooses the risk level per operation type, and a control layer the agent cannot bypass. But this is OpenAI's own documentation, relayed through a secondary source. How the system behaves in practice — how often Auto-review actually blocks something, how freely users grant "execute without confirmation" — we know nothing about yet.
How they should be judged
Mollick offers a concrete evaluation criterion: don't look at the agent's task list, but at what you no longer need to tell it. An agent that requires you to map everything out is fancy automation. An agent that has learned your project, your preferences, and your work patterns from your message history — and that develops plans on its own — is something else.
He illustrates this with his own first-person experiences, which should be read exactly as that: his own reports. In one anecdote, an agent caught a mistake he himself had made in an email about a permit. In another, Muse discovered that an airline credit he owned was about to expire — and when Mollick asked, the agent contacted American to request an extension.
The anecdotes are not documentation, but they point to the real product change: agents monitor, assess, and act — not just respond.
The other side: over-permissioned agents
Alongside the enthusiasm come the warnings. On a panel at the HumanX AI conference, moderated by Rob Pegoraro, Diana Kelley, CISO at Noma Security, told PCMag (October 1): "The AI agents are being very over-permissioned." She later cited Noma's research, which shows that GitHub's agentic workflow could be tricked into exposing confidential code repositories.
The warning points to a familiar security problem: an agent with broad permissions can be exploited or misdirected into using legitimate access for malicious purposes. What makes the matter especially charged is that the new generation of personal agents is designed to have broad access — to email, files, browser, messaging channels — in order to be useful. Dots' Custom Rules are an attempt to set granular limits on exactly this tension.
Kelley's broader point in the PCMag summary may be the most useful calibration for the reader: the real risk lies not in imaginative new agent attacks, but in basic things that were never updated or closed. Agents amplify existing vulnerabilities; they don't necessarily create entirely new ones.
And Mollick himself points to a consequence no producer intends. With "Clawlikes" — his collective term for this type of personal agent app — he warns that "every company's customer service agents are at risk of being overwhelmed by Clawlikes negotiating for better prices over voice and chat channels built for humans." His example — Muse contacting American — is a foretaste: when millions of agents negotiate on behalf of millions of users, the economics of customer service change from the ground up. This is his prediction, not a documented fact.
What we don't know
Several significant questions remain open:
- The revenue. Yahoo Finance is explicit: Meta has not reported a quarter that includes Muse, so "no one has seen what it earns." Download data measures curiosity, not willingness to pay. The claim that these agents are commercially transformative is pure speculation until quarterly figures are available.
- The sourcing on dots. All mechanical details come via DenDen, a secondary and machine-translated summary. OpenAI's own documents are not part of the verifiable basis here.
- Mollick's full argument. The essay is available only in excerpt form, and the complete argument about "swarms" — agent flocks at larger scale — cannot be verified in full. The admission about self-organization is documented; how far he thinks the principle extends is unclear.
- The product landscape. Mollick's list of competitors (Grok Bot, Instinct, Gemini Spark) and his statement about Muse's App Store position are his own reports. Only Muse's download-topping position on iOS is confirmed via Yahoo Finance.
- No documented incidents. There are not yet any publicly documented security incidents linking the new agents' permission models to actual breaches. Kelley's warning is preventive, based on research into agentic workflows — not on known breaches in dots or Muse.
What to watch
Three things will determine whether this wave is a shift or a cycle: quarterly figures showing whether Muse and dots generate revenue or just downloads; the default permission settings — whether vendors actually dare to ship "confirm before execution" as the default, or whether competitive pressure drives toward frictionless, broad permissions; and whether documented incidents emerge where agent permissions are exploited in practice.
Either way, Mollick's admission is worth taking away: the question is no longer whether humans can organize AI work, but who bears the risk when agents organize work — and contact the outside world — on our behalf.
Sources: One Useful Thing, DenDen, WIRED, PCMag, Yahoo Finance