# Users fault personal agents more for holding back than for overstepping

*Users of nine personal agents fault them more for asking again and for staying silent than for acting on their own. The benchmarks the field cites mostly find the opposite failure, one test at a time.*

By Feedback Bench, 17 October 2026. Feedback Bench 1.1. Posts 2026-08-31 to 2026-10-18; bench built 2026-10-19. Web: https://feedbackbench.com/#/articles/users-fault-personal-agents-more-for-holding-back-than-for-overstepping

Two Grok Bot users, a week apart in September, described the same agent from opposite ends. One had given it standing permission: "[why is that always allow doesn't mean always allow. it appears to mean always allow until tomorrow when i'm going to ask you the same thing again.](https://twitter.com/1594881621097865216/status/2101770281874493783)" The other, comparing it with Muse, wanted it to speak up: "[with grokbot you have to set that up manually in the instructions, otherwise it doesn’t give a shit and stays quiet.](https://twitter.com/1642209153589424130/status/2104269514879951127)"

One complaint is about an agent that will not act without being asked twice, the other about an agent that will not act without being asked at all. Read across all nine personal agents that Feedback Bench tracks, they turn out to be the common case. Users report their agents holding back more often than overstepping. On asking before acting, 143 people say their agent asks too much and 58 say it acted without their consent. On initiative, 124 say it waits to be told and 78 say it said too much or got something wrong. The research the field cites mostly finds the opposite failure, models that overstep or raise false alarms, and the few benchmarks that score caution do it inside a single test. Nothing we found follows a yes across days and handoffs, or counts how often users of shipped agents complain of silence.

**Exhibit 1: On both criteria, more people fault personal agents for holding back than for overstepping.** Distinct people who describe a first-hand complaint on each side, across all nine agents, after the author screen. Each criterion was read in full under its own written rule.

|  | People |
|---|---|
| Approvals: asks too much | 143 people |
| Approvals: acted without consent | 58 people |
| Initiative: waits to be told | 124 people |
| Initiative: said too much or got it wrong | 78 people |

*Highlighted rows are holding back; the others are overstepping or wrong. Approvals: 957 control.approval posts; 60 of the 143 had already given the permission the agent asked for. Initiative: 1,059 first-hand auto.proactive posts; complaints only, praise not shown. Posts read and classified by AI agents under written rules. Window 2026-08-31 to 2026-10-18.*

## Two counts, read in full

Both numbers come from reading every post, not a sample. AI agents read all 957 posts that the bench filed under [Asks before acting: too little or too much](https://feedbackbench.com/criteria/control.approval.md), and all 1,260 candidate posts under [Unprompted suggestions, insights and check-ins](https://feedbackbench.com/criteria/auto.proactive.md), each criterion under its own rule written before classification and after a shared screen had removed sellers, bots, staff and referral posters. Counts are of distinct people. On approvals, a complaint counted as "asks too much" only if the user called an approval unnecessary, repeated or already granted, or said it stopped a scheduled job; "acted without consent" needed an outward action that had happened. On initiative, each complaint was coded as too quiet, or as too much or wrong, which covers noise, mistakes, invasive reading and money spent on work nobody asked for.

Neither split can be waved away as users wanting no limits. Praise for stopping before it sends, buys or deletes comes from 136 people, nearly as many as complain that it asks too much. When an agent speaks first about an item in the user's own accounts or devices, 122 of the 140 people who describe such a moment welcome it. People want a gate and they want an agent that notices things. What they report, more often than anything bold, is a gate that will not stay open after they have opened it, and an agent that notices nothing unless it was told where to look.

An overstep costs more per case, and the argument has to allow for it. A user on X wrote: "[when i had meta muse act as an agent for selling items on a flea market, it automatically accepted a ridiculously low offer of $10 and sent the buyer my home address.](https://twitter.com/2039955560032825344/status/2104817644474192122)" A re-asked permission costs a click. Users report holding back more often, and the field counts it only inside a single test.

## The yes that does not stay given

Of the people who say an agent asks too much, 60 had already given the permission it asked for, through a setting, an instruction or an earlier tap. They lose it in four places. Seventeen lose it over time, as a saved setting stops holding; seven of those use ChatGPT Dots and six Grok Bot. Twenty-four lose it inside the request itself. A commenter on YouTube asked Gemini Spark to delete about three hundred junk emails, and "[in the end, it started asking me email by email, it was asking for authorization.](https://www.youtube.com/watch?v=eNdV_1NfqkU&lc=Ugx5DPtP6dCL41y1b2d4AaABAg)" Four lose it on a schedule, finding a routine they set up waiting for a click on every run.

The other fifteen lose it at a handoff, and all fifteen use ChatGPT Dots. A Dot splits a job across subagents and threads, and the user's yes to the Dot does not travel with the work. One user pasted the Dot's own reply, which concedes the point: "[your permission is clear; i can’t override that check.](https://twitter.com/1539267575611285504/status/2107159284924776552)" Among the 69 people who say Dots asks too much, 40 had already granted the permission, against 20 of 74 for every other agent combined (Fisher's exact test, p < 0.001), and the gap holds when the two posts we were least sure of are dropped. Dots launched at the end of September, so this is a product's first three weeks.

**Exhibit 2: Where the yes was lost.** The 60 people who say an agent asked again for something they had already allowed, by where the permission stopped holding.

|  | People |
|---|---|
| Over time | 17 people (ChatGPT Dots 7, Grok Bot 6, Muse 3, OpenClaw 1) |
| Inside the request | 24 people (ChatGPT Dots 18, Gemini Spark 3, Muse 1, Grok Bot 1, Hermes Agent 1) |
| Handed to a subagent | 15 people (ChatGPT Dots 15) |
| On a scheduled run | 4 people (Gemini Spark 3, OpenClaw 1) |

*control.approval posts in which the person had already given the permission. One place per person. Window 2026-08-31 to 2026-10-18.*

Standing rules fail in the other direction too, and here Grok Bot's users report the most cases. Eleven people say an agent broke a "never" they had set, six of them about Grok Bot. One had a draft-only rule for email: "[ii set up that email is only a draft and never can be send , all agents and grok bots were instructed and yet today it did it anyway .](https://www.reddit.com/r/GrokBot/comments/1x1s5rn/grok_bot_just_emailed_my_team_after_i_told_it_not/)" Counting both kinds, Grok Bot's users report thirteen failures of a standing decision, but they come from more than fourteen thousand people who judged the agent in the window, about one in a thousand. Dots has forty-two from under a quarter of that base. Grok Bot is also 1st of 6 on this criterion, and its users make up sixteen of the thirty-five people who praise any agent for not over-asking. One of them described the arrangement they wanted and got: "[the hang on checkout is the useful part. i keep a hard gate on anything that spends or messages a vendor. the bot can prep the cart; i tap once.](https://twitter.com/1622884506515697665/status/2098790544113897507)"

## The agent that waits to be told

Of the people who complain about an agent's initiative, 124 say it waits to be told. For four of the six agents that place on the criterion the quiet complaint is the larger one, by a wide margin for Grok Bot, Hermes Agent and Dots and narrowly for OpenClaw; Hark's users split evenly. Grok Bot accounts for 45 of the 124, though as a share of the people who wrote about its initiative, just under one in four, it is close to OpenClaw and Hermes Agent. Without Grok Bot the field total narrows to 79 to 67, so this half of the finding rests on the agent-by-agent pattern more than on the total.

The posts are specific about what is missing. An OpenClaw user: "[i have been using openclaw since the start of the year. i have never been able get it be proactive.](https://twitter.com/223924222/status/2106353582325026861)" A Hermes Agent user built an orchestrator that hands tasks to other profiles and found that a blocked task waits until the session is reopened, then asked: "[is this expected behavior, or is there a way to have the orchestrator automatically respond to changes in kanbantasks and do follow up tasks etc?](https://www.reddit.com/r/hermesagent/comments/1x2h291/kanban_task_changes_only_get_to_hermes_when_i/)"

On the bench Hark is 1st of 6 on this criterion, Muse 2nd and ChatGPT Dots 3rd; OpenClaw and Grok Bot rank low. Muse is the exception to the quiet complaint, and the exception has a caveat. It is the one placed agent whose users complain more of noise than of silence, 37 people to 13, and twenty-one of them are store reviewers, often a single line. Without the store reviews its split is 16 to 8, still the other way from the rest of the field. One user on X: "[meta muse just sending you unsolicited notes about stuff you previously engaged with is annoying.](https://twitter.com/49730253/status/2106822210291953871)"

**Exhibit 3: Among the six placed agents, only Muse's users complain more of noise than of silence.** People who complain about an agent's initiative, by what they object to: 196 people across the six placed agents (202 across all nine), from 1,059 first-hand posts about initiative, after the author screen.

|  | People, by agent and by what they object to |
|---|---|
| Muse: too much or wrong | 37 people |
| Muse: too quiet | 13 people |
| ChatGPT Dots: too much or wrong | 9 people |
| ChatGPT Dots: too quiet | 27 people |
| Hermes Agent: too much or wrong | 3 people |
| Hermes Agent: too quiet | 17 people |
| OpenClaw: too much or wrong | 11 people |
| OpenClaw: too quiet | 15 people |
| Grok Bot: too much or wrong | 11 people |
| Grok Bot: too quiet | 45 people |
| Hark: too much or wrong | 4 people |
| Hark: too quiet | 4 people |

*Too much or wrong: noise, creepy, mistaken, costly. Too quiet: waits to be told, goes silent. Muse against the other five placed agents: 37 to 13 against 38 to 108, Fisher's exact test p < 0.001. Without store reviews, Muse's split is 16 to 8 (p < 0.001 against the same five); 21 of Muse's 37 come from store reviewers. Distinct people per agent. Posts read and classified by AI agents under written rules. Window 2026-08-31 to 2026-10-18.*

What users praise when an agent does speak first is easy to recognise. "[grokbot alerted me that name on my train ticket doesn’t match my name. saved me from a minor disaster.](https://twitter.com/3884240176/status/2106034636534985038)" A Dots user: "[mine found a safety recall email for my office chair that i’d missed, flagged it without me asking, and then walked me through checking it.](https://twitter.com/892952244131434496/status/2105411128448766084)" Of the people who praise Dots for initiative and say what set it off, 44 of 93 describe a catch like this from their own accounts, against 82 of 391 for every other agent together (p < 0.001). Grok Bot's share from the start of October is lower (p = 0.03), and only Hark's is higher. OpenAI's launch post describes the design: when a dot is not busy, it "looks for ways to help in the background", which OpenAI calls "proactive research", using tools restricted to read-only.

Grok Bot's praise changes inside the window. Before October 1, none of the 35 people who praised its initiative and named a trigger described a catch from their own accounts; from that day, 17 of 60 did. The first such post is dated October 1, so the zero before it is built into the split, and we give that cut no test. One user posted that afternoon that the app had just asked them to choose a primary Bot, and xAI's changelog, dated October 2, says "Your primary Bot, marked with a star, will now spot work it can take off your plate and offer to handle it." Split on the changelog date instead, three of 42 such people described a catch before it and fourteen of 53 after (p = 0.02), with more than a third of the seventeen posts in the first two days.

**Exhibit 4: Catches from the user's own accounts lead Hark's and ChatGPT Dots' praise and appear in Grok Bot's only from its October 1 rollout.** Of the people who praise an agent's initiative and say what set it off, the share who describe it raising an item from their own email, calendar, files or devices.

|  | Share of people who praise the agent's initiative and say what set it off (%) |
|---|---|
| Hark | 54% (27 of 50) |
| ChatGPT Dots | 47% (44 of 93) |
| Grok Bot, from Oct 1 | 28% (17 of 60) |
| Muse | 20% (34 of 173) |
| Hermes Agent | 6% (2 of 35) |
| OpenClaw | 4% (1 of 25) |
| Grok Bot, before Oct 1 | 0% (0 of 35) |

*Grok Bot's split falls on the date of its first such post, 2026-10-01, when the app began asking users to pick a primary Bot, so the zero before it holds by construction. Split on xAI's changelog date, 2026-10-02: 3 of 42 against 14 of 53, p = 0.02. Dots against all other agents: 44 of 93 against 82 of 391, Fisher's exact test p < 0.001. Dots against Grok Bot from Oct 1: p = 0.03. Muse's largest group names suggestions drawn from what the user told it (76 of 173). Distinct people per agent. Posts read and classified by AI agents under written rules. Window 2026-08-31 to 2026-10-18.*

Dots has the most praise for noticing things in a user's accounts, and more people than any other agent who say it asked again for a yes already given. The launch post describes both sides of that design. Proactive research uses tools "restricted to be read-only", and actions that "could affect your accounts" pass through an auto-review that decides "what needs approval". The users' posts suggest that the second check is the one a Dot cannot override.

## Why the products hold back

The research and the users disagree for a reason that sits in the products. Benchmarks test models. Users meet the defaults that makers put around them, approvals that expire or fail closed and initiative that runs only from a trigger the user has set up.

On approvals, Grok Bot's help page says an approval for work that started without the user, from "a routine, a trigger, or a message from another Bot", "expires after about 10 minutes". Hermes Agent's scheduled jobs default to deny a dangerous command, which "blocks the command (the agent must find another path)". OpenClaw says that "with no approval surface connected, the request is denied immediately". Google's help page for Spark says Gemini is "designed to ask for your review and confirmation before it completes certain actions", among them "modifying your data", and most of the thirteen people who say Spark asks too much were deleting or changing something. On initiative, Grok Bot's documentation warns that broad event listeners "create noise, consume usage, and increase the chance of acting on irrelevant input." OpenClaw wakes its agent on a timer, every half hour by default, and drops replies that have nothing to say. Hermes Agent runs scheduled jobs and, where the user wires one up, jobs set off by a webhook.

Each of these is a defensible choice for an agent that may act while nobody is watching, and the bold failures in our data show what they guard against. They are also a plausible reading of the pattern users report, though nothing here tests it. A model that over-acts in a test sits, in a shipped product, behind expiring approvals, deny-by-default schedules and timers, and the over-action users see is rarer than the silence.

The strongest objection to more initiative is about reading, not speaking. To find the one email that matters, an agent has to read all of them. On the last day of September a Muse user posted: "[so @muse said it only searched gmail when i asked. but it scanned my email daily without permission, then made up explanations twice when i caught it.](https://twitter.com/14207787/status/2105375571505262789)" The same user, who posts often about Muse, later drew the line a builder could adopt:

> good: monitor gmail for responses to my muse-logged complaint about a delayed flight. (scoped gmail search filters)
> bad: scan daily *every* email in case something muse decides is worth alerting on.

[A user on X, 2026-10-01](https://twitter.com/14207787/status/2105720732089250283)

## What the research counts

The field's benchmarks do measure both errors, but not evenly and not over time. ProactiveBench found in 2024 that about half of the help GPT-4o proposed was not needed. In ProEvent, released in July, every model's false-alarm rate was higher than its missed-need rate; GPT-5.1 acted at 24.0% of the steps where nothing was needed and stayed silent at 14.5% of the steps where something was. Those are rates per step of a test built from chats that a language model generated, each over a different set of steps, and they are not comparable with counts of people. They describe a model that sees every message and must decide, which is a fair test of the model and not of a shipped agent's defaults.

On authority, two recent benchmarks, MasDrift and EAL-Bench, follow a user's limits across subagents and memory and mainly score the agent that does too much. MasDrift also found the holding-back failure in the lab: carrying a strict policy down a chain of subagents "blocks required work". micro1's provisional PersonalAgentBench scores authority "in both directions" and calls over-confirmation "its own failure mode", with no rate reported. DelegationBench, posted in early October, counts models that ask again after the user has said yes, within a single exchange. Anthropic reported this March that "Claude Code users approve 93% of permission prompts," and called the result approval fatigue.

None of this work follows one person's yes across days, schedules and subagents, or counts silence complaints from agents people actually run.

## What a builder could measure

Two numbers would catch the drift toward holding back, both taken over weeks and per user.

The first is re-asks per granted action: for every action a user has allowed, by setting, instruction or earlier tap, how often the agent or any of its subagents asks again inside the scope that was granted. It needs a record of decisions that every part of the agent consults before it asks, and a scope the user can read. A Hermes Agent user, reviewing a booking plugin, said where a scope should end: "[i'd have it ask again with the new total and itinerary rather than carrying the old approval forward.](https://www.reddit.com/r/hermesagent/comments/1x1x3ty/i_made_a_flight_and_hotel_booking_plugin_for/pf04tzz/)" Meta's approval card already offers scopes of this kind, once, for this task, for this site, or always for a connector.

The second is silence complaints per proactive praise: of the users who write about an agent's initiative, how many say it waits to be told, set against how many welcome something it raised. A team that tracks only false alarms will tune toward the quiet agent and read the result as safety. This ratio would show the cost, and the praised catches in these posts show the target, an item the user would have missed, raised from a scope the user agreed to, with a question before anything is done about it.

## Limits

These are two criteria out of fifty-three, and complaints on them are a small share of what users write. Collection differs by agent: Muse's sample includes many store reviews, Gemini Spark comes only from X and YouTube, and Dots exists for three of the seven weeks and Hark for two. The research counts steps or runs and we count people, so the contrast is about what each measures, not a comparison of rates. A bold failure can cost far more than a careful one, and nothing here argues for looser gates on money, messages or deletions.

## How we measured

The window is the seven weeks from 31 August to 18 October 2026, with public posts from X, Reddit, YouTube and the two app stores, collected differently for each agent. Feedback Bench counts user-weeks, one person writing about one agent in one week, and places an agent on a criterion only with at least 30 rated user-weeks; bench labels come from large language models, and positions are computed from them. For this essay, AI agents read and classified every post labelled on the two criteria, after a shared author screen, under rules written before classification. Counts are of distinct people per agent, and comparisons use Fisher's exact test.

## Sources

- Feedback Bench, [Asks before acting: too little or too much](https://feedbackbench.com/criteria/control.approval.md) and [Unprompted suggestions, insights and check-ins](https://feedbackbench.com/criteria/auto.proactive.md), personal agents, built 2026-10-19.
- Li, Pan and Wang, [ProEvent: An Event-centric Benchmark for Proactive Agents](https://arxiv.org/abs/2607.17701), 2026-07-20, read 2026-10-17.
- Lu et al., [Proactive Agent: Shifting LLM Agents from Reactive Responses to Active Assistance](https://arxiv.org/abs/2410.12361) (ProactiveBench), 2024, read 2026-10-17.
- Xu, Zhang, Luo, Jin, Dong and Salam, [MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures](https://arxiv.org/abs/2608.07556), 2026-08-02 (v3 2026-10-15), read 2026-10-17.
- Cerruti, Okamoto and Erol, [Agent Memory Is a Surface for Endogenous Authorization Laundering](https://arxiv.org/abs/2609.01836) (EAL-Bench), 2026-09-01, read 2026-10-17.
- Pochampally, [DelegationBench: Measuring When AI Agents Should Ask Before Acting](https://arxiv.org/abs/2610.05532), 2026-10-04, read 2026-10-17.
- micro1, [PersonalAgentBench](https://www.micro1.ai/personal-agent-bench), provisional, read 2026-10-17.
- Anthropic, [Claude Code auto mode](https://anthropic.com/engineering/claude-code-auto-mode), 2026-03-25, read 2026-10-17.
- OpenAI, [Introducing dots](https://openai.com/index/introducing-dots/), 2026-09-29, read 2026-10-17.
- xAI, [Grok Bot changelog](https://x.ai/changelog/bot), v0.66.0, 2026-10-02, read 2026-10-17.
- xAI, [Grok Bot approvals, security and privacy](https://docs.x.ai/grok-bot/approvals-security-and-privacy) and [Skills, routines and automations](https://docs.x.ai/grok-bot/skills-routines-and-automations), read 2026-10-17.
- Nous Research, [Hermes Agent security](https://hermes-agent.nousresearch.com/docs/user-guide/security/) and [Scheduled tasks (cron)](https://hermes-agent.nousresearch.com/docs/user-guide/features/cron), read 2026-10-17.
- OpenClaw, [Exec approvals](https://docs.openclaw.ai/tools/exec-approvals) and [Heartbeat](https://docs.openclaw.ai/gateway/heartbeat), read 2026-10-17.
- Google, [Use Gemini Spark to manage your tasks and workflows](https://support.google.com/gemini/answer/17094507?hl=en), read 2026-10-17.
- Meta, [How Muse works with your guidance and approval](https://www.meta.com/help/artificial-intelligence/1385290430137537/), read 2026-10-17.