OpenClaw, Hermes, Grok Bot, OpenAI dots and Claude Duet: What an Always-On Agent Needs in Your Business

An early tester had forgotten to invoice a publication. His AI agent noticed, prepared the invoice and sent it once the tester had approved it. OpenAI used this story to introduce dots on 29 September 2026, AI agents that work for their user around the clock. It is a well-chosen story, because in three sentences it shows what this class of product promises: the agent acts unprompted, it knows its user's affairs, and it acts only after an approval.

OpenAI is not the first. The open-source OpenClaw, started in November 2025 under the name Clawdbot, had around 393,000 stars on GitHub on 25 October 2026, on 25 February 2026 Nous Research introduced its Hermes Agent, also open source, and on 11 August 2026 xAI launched Grok Bot. Just over three weeks after dots, on 21 October 2026, Anthropic followed with Claude Duet, for now as a research preview.

Whether such agents exist is settled; what remains open is which of them you give which access to your business.

What makes an always-on agent

All five products are built from the same parts. Each agent works on a computer of its own, in the vendor's cloud for dots, Grok Bot and Claude Duet (Grok Bot's bots share one computer per account), and usually on a server you run yourself for OpenClaw and Hermes. It has a memory that outlasts individual conversations, connections to programs such as the mailbox, the calendar or the CRM, and a schedule on which it acts without being asked. You reach it through a chat, depending on the product in ChatGPT, an app of its own, Slack, Teams, Telegram or WhatsApp. We call this class always-on agents below. Claude Cowork and ChatGPT Work essentially carry out jobs you give them, including at set times, since Cowork can schedule recurring tasks (how far these desk tools carry is the subject of our article on Claude Cowork and ChatGPT Work). An always-on agent, by contrast, holds an ongoing responsibility, looks for work on its own, keeps track of the state over weeks and gets in touch when something needs deciding.

The technology behind it is not new. Our own agent hub follows the same pattern: it proposes work from Outlook and selected WhatsApp conversations, agents carry it out, and the results wait for review and release. What is new is that xAI, OpenAI and Anthropic now sell this setup as a subscription. One of our own recurring jobs runs through this article, because it shows what about an always-on agent can be swapped and what cannot: since August 2026, AI agents have researched companies for our prospecting every week and prepared first contacts, and our founder sends every message himself.

Who runs the agent's computer

The five products differ mainly in who runs that computer and is therefore responsible for updates, credentials and logs. For dots, Grok Bot and Claude Duet it is the vendor; for OpenClaw and Hermes it is usually you. Hermes is now also available as a hosted version from Nous Research.

dots from OpenAI

With dots, OpenAI runs everything. Each dot has its own cloud computer with a browser and uses supported plugins to access your programs. When you are not working with it, it looks for work in the background; OpenAI calls this “proactive research” and restricts the tools for it to read-only, so it can neither send messages nor change content while doing so. Everything else follows built-in rules that you can extend by allowing an action, requiring approval for it or blocking it. Changing a password always stays with the person, and OpenAI says it does not use content from Business and Enterprise workspaces for training by default. ChatGPT Business Premium is an option for a German business. According to OpenAI's access overview, checked on 25 October 2026, rollout is gradual worldwide; an eligible plan therefore does not guarantee immediate access. The Pro plans still exclude the European Economic Area. Current terms are on OpenAI's pricing page.

Grok Bot from xAI

Grok Bot also runs in the cloud, technically on Cursor's platform. It uses plugins where they exist and operates every other program through its interface, with mouse, keyboard and screen. When it reaches a login, it hands you its computer; you type the password and the two-factor code yourself, and the signed-in session stays in place for later tasks. A separate review model decides which actions it carries out without asking, and you can allow individual actions once or permanently. According to Cursor's security documentation, checked on 25 October 2026, the computers run in the United States only. Audit logs, automatic user provisioning and network rules come only with the Enterprise plan.

Claude Duet from Anthropic

Claude Duet also works on a computer of its own in the cloud, a virtual machine with its own browser. It takes its memory, skills and connected apps from your Claude account. It reaches your programs through Claude's connectors and plugins and uses its browser for sites without a connector. When a site asks for a password, you type it into a separate form that passes it straight to that browser; according to Anthropic, the agent itself never sees passwords or sign-in tokens. It checks your accounts every few hours, because checking nonstop would use up the plan's limits too quickly, so an urgent message can go unnoticed until the next check. According to Anthropic, before a potentially sensitive message, a payment, a signature or a deletion, it shows you the step with its recipients and content and waits for your approval. You can turn off repeated approval requests for some steps, but not for payments, deleting an order or creating an account. In addition, an automated check outside the working model assesses whether each action matches your request. Trading securities, moving money between accounts and accessing someone else's account stay off-limits even with approval. According to Anthropic's help article, checked on 30 October 2026, Claude Duet is available during the research preview only in the United States, only on the Pro and Max plans and only by invitation from a waitlist. Anthropic plans to bring it to the Team and Enterprise plans later, and Microsoft 365 cannot be connected yet.

OpenClaw and Hermes Agent

With OpenClaw and Hermes Agent, you run the computer yourself, on your own or a rented server. Both are released under the open MIT license, remember conversations, run on a schedule and can be reached through messengers such as Telegram, WhatsApp or Teams. Both also work with the language model you choose, down to a locally run model or a European provider such as Mistral. That makes them the two options in which data and model can stay entirely in your hands. Since July 2026, OpenClaw has belonged to a non-profit foundation; Hermes is developed by Nous Research. On 25 October 2026, version 0.22.5 is the current release, still below 1.0. You pay for this control in operating effort, because updates, keys, logs and outages are yours, and the OpenClaw releases and the Hermes releases still show several new versions a week when checked on 25 October 2026.

What are the downsides of OpenClaw?

The downsides of OpenClaw are well documented, because they happened in public. On 1 February 2026, the vulnerability CVE-2026-25253 was published, in which a single click on a crafted link was enough to steal the agent's access token and take it over; version 2026.1.29 had already closed it. A day earlier, the internet scanner Censys had counted 21,639 OpenClaw installations reachable from the internet, though most still required an access token. In February, the Dutch data protection authority estimated that about one fifth of the extensions in the ClawHub marketplace contained malware and advised against running OpenClaw and similar agents on systems with employee, financial or confidential data. When checked on 25 October 2026, the project's security page still reports 722 published and fixed security advisories, including 14 critical ones. The page gives 11 September 2026 as its last update. That so many advisories are public, however, also speaks for the project's openness. It now scans every new extension automatically for malware, and a report on an audit by Trail of Bits, published on 21 September 2026, lists 23 issues found and since fixed, none of them critical. According to its documentation, checked on 25 October 2026, isolated execution of commands in a sandbox is still switched off by default.

More important than any single vulnerability is the mechanism behind it. The developer Simon Willison calls it the “lethal trifecta”: an agent that holds private data, reads outside text and can send data out can be turned against its owner by a hidden instruction in an email or on a web page. Every product in this comparison meets the first two conditions as soon as it reads your mailbox; whether it can also send depends on the permissions you give it. In its guidance on AI agents, Germany's federal security authority BSI therefore advises that no agent should have access to emails, a bank account and personal files at the same time. OpenClaw adds a fourth route, because a skill from the marketplace contains instructions, and often scripts, that a stranger wrote and that the agent follows on your computer.

As long as an agent loads extensions from an open marketplace and runs commands without a sandbox, it therefore does not belong on a company mailbox.

What are the alternatives to OpenClaw?

Anyone who installed OpenClaw for the idea finds the same operating model in Hermes Agent. Hermes keeps its memory in two small text files that you can read and edit, checks extensions from its own Skills Hub with a scanner, and has a second language model rate risky commands before it runs them. That does not make it automatically safer than OpenClaw. Its developers write in their own security policy that the only security boundary against an adversarial language model is the operating system, and by default Hermes runs commands directly on the server. For a business, that means running Hermes in a container or a virtual machine of its own, looked after by someone who knows how to secure a server.

If you do not want to run a server, you end up with dots or Grok Bot (the access guidance and FAQs we checked on 25 October 2026 did not explicitly confirm access for German accounts). Claude Duet is not an option for a German business for now, because Anthropic opens it only to US accounts; if your mailbox and calendar run on Microsoft 365, you could not connect them yet anyway. Provided your business is on the Business Premium plan, dots currently has the edge, for two reasons. First, dots works primarily through connections to your programs, whereas Grok Bot works through the screen wherever no plugin exists. Anthropic, which offers screen control itself, describes it in its documentation as the slower and more error-prone route, and for recurring work in an ERP or CRM we see it the same way (why agents need APIs rather than screens). Second, a European storage region is gradually becoming selectable for ChatGPT Business. According to the storage policy, checked on 25 October 2026, a copy of every prompt and response stays in the United States for a limited time. The storage region does not determine where processing happens; OpenAI directs customers with dots residency requirements to their account team. Grok Bot's computers, by contrast, run in the United States only.

Even so, dots is not without gaps for small businesses. The dots administration help page explicitly describes its controls for Enterprise workspaces. When we checked it on 25 October 2026, it did not promise the same controls for Business Premium. Establish which controls your plan actually offers before connecting a company mailbox.

What our own prospecting shows about always-on agents

Back to our prospecting, because it shows how much of an always-on agent is the product and how much is the rules around it. Every week, the agents research a pool of around 1,900 companies from the exhibitor lists of three trade fairs (AMB, Z Zuliefermesse and Intec). They work from written instructions in Markdown and a standard CRM, Notion since September, produce a handful of researched dossiers per week and prepare first contacts. Nothing goes out without our founder.

Some rules are fixed before an agent drafts its first sentence. A company that is already a client, supplier or partner gets no first contact, and every company we evaluate goes into a list with its result, so research does not pick it up a second time. A fixed rule like this does not need an agent, because a fixed program checks it faster and the same way every time. It belongs in the written instruction and, where the tool allows it, in the agent's permissions, for example by not letting it send at all. In xAI's own example for sales outbound, Grok Bot researches accounts overnight and drafts emails and LinkedIn messages. Whether such a draft turns into a send is decided by the approval rule you set, not by the quality of its copy.

We drew one lesson from this loop that applies to all five products. The interchangeable part of our setup is the agent. The instruction that defines a suitable company, the CRM as the single source for the state of every contact and the approval before sending are things we would have had to write in exactly the same way for dots, Grok Bot, Claude Duet or Hermes. The approval is the same step that OpenAI's invoice example leaves with the person. None of the five vendors' standard products comes with this part ready-made.

"I send every one of these first contacts myself, and a better product would not change that. In our own agent hub, Claude and Codex work side by side, and where a result needs an independent review, it normally goes to the other vendor. So in our setup the agent is already the interchangeable part; what we maintain are the instructions, the sources and the approvals. When a client asks me which of these products to choose, my first question is which subscription they already pay for. If everything has to stay in-house, I choose Hermes, sealed off in its own environment. I do not propose OpenClaw to new clients, and where a client already runs it, we secure and maintain it," says Sebastian Behler, founder of CERTAINCE.

OpenAI apparently sees it similarly. For its “specialist dots”, which get credentials of their own and are connected to a company's core systems, OpenAI's own engineers work with the company to define which tasks the agent takes on, which tools it uses and how people review and approve its work. For now, this is offered only in pilots with enterprise customers.

Seven questions before an always-on agent gets access

These questions belong on the table before anyone connects an agent to the company account. If one of them stays open, the agent is not ready yet.

• Which programs may the agent read, and which may it write to? Reading broadly and writing narrowly is the safe starting point.
• Does it hold private data, read outside text and have a way to send data out? If all three apply, take one of them away.
• Which actions need an approval? Everything involving money, dates or customers, set as a rule in the product rather than as a request in the chat.
• Under whose name does it act? An account of its own keeps the log readable; an account borrowed from an employee does not.
• Where does what it learns about your business end up, and can it be deleted? With dots and Claude Duet, according to their vendors, disconnecting an app deletes nothing the agent has already taken from it.
• Who installs updates and reads the logs? With a subscription it is partly the vendor; with your own server it is entirely you.
• Does every system involved have an interface for programs, or would the agent have to click through screens?

Answering these questions and putting the answers into the tool is what our setup stage does, in which we connect the programs your team already uses, order the sources and settle who approves what. Where a system has no ready connector, we build the interface in the development stage, so the agent does not have to work through the screen. Discuss the setup

What “learns over time” means is still open

OpenAI writes that a dot learns your preferences, how you think and what good looks like to you over time. How much of that is learning you can inspect and withdraw cannot yet be judged from the outside. Hermes keeps its memory in files you can open; about dots, the help center so far mainly reveals that disconnecting an app deletes nothing and that only a reset removes the dot with its conversations, memories and scheduled tasks. According to Anthropic's safety page, Claude Duet keeps its conversation history and memory until you delete or reset them, and it also sees what Claude has remembered from your earlier chats. A language model starts every day as if it were its first anyway (why context matters more than the choice of model), and whether the vendors' memories change that in principle remains to be seen. Until that is clear, the rules of your business belong in files you own; an agent's memory at most supplements them.