# Permission scope requested and isolation between agents (`trust.access_scope`)

Feedback Bench, personal agents, built 2026-10-19, window 2026-08-31 to 2026-10-18. Web page: https://feedbackbench.com/#/criterion/trust.access_scope

Area: [Trusting it with data and safety](https://feedbackbench.com/criteria/trust.md)

**Definition.** Whether the agent asks only for the access it needs, respects declined permissions, offers scoped or read-only access, and isolates credentials between agents.

**Boundary.** Not this: see [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md) when the issue is what the vendor does with data; see [Asks before acting: too little or too much](https://feedbackbench.com/criteria/control.approval.md) when it acts without per-action consent.

Rated user-weeks, all agents: 742. Complaint share: 67%.

## The brief

Written by large language models from this page's numbers and the posts it quotes, then checked: every number in the text is in the build. Interpretation, not measurement.

Hermes Agent does best at asking only for the access it needs. Its users say isolated profiles let several agents share one machine without mixing their setups, and they see this as a guard against leaked keys or identity. This criterion makes up 1.3% of what users rate, but most of those ratings are complaints: 67.3% of rated user-weeks. Muse, Hark and ChatGPT Dots rank low. Muse is 6th of 6, and its users write 29% of the category's complaints here.

### What separates the best from the rest

Users at the top and bottom of the ranking describe different problems. Hermes Agent users talk about keeping agents apart. They say separate profiles let several agents run on one machine and help prevent leaks of keys or identity. Users of Muse, Hark and ChatGPT Dots describe apps that ask for broad access at setup, such as a whole Google Drive, passwords or full read access to accounts. They also describe agents that bring up calendar events, battery levels or Facebook groups. Users say they never shared these or had switched them off.

- **Ranks high**: [Hermes Agent](https://feedbackbench.com/agents/hermes-agent.md)
  - Hermes Agent, 2026-09-08, @NousResearch (X): “@teknium @therealchivas @imbabybrooklyn @nousresearch isolated profiles is the part we actually use. one box, more than one agent, without sharing the mess.” [source](https://twitter.com/1294162887439577088/status/2097155980765409588)
  - Hermes Agent, 2026-09-24, @NousResearch (X): “@themahis @nousresearch oh i undrestand now its kindda safety factor in order to prevent leaks of our keys or identity thanks for the effort” [source](https://twitter.com/1798123673196367872/status/2103108740769620219)
- **Ranks low**: [Muse](https://feedbackbench.com/agents/muse.md), [Hark](https://feedbackbench.com/agents/hark.md), [ChatGPT Dots](https://feedbackbench.com/agents/dots.md)
  - Muse, 2026-10-11, @muse (X): “so, i can’t connect @stripe link to @muse for a basic online payment without granting it full read access to my accounts for “financial insights” that i definitely don’t want agentic commerce is going splendidly” [source](https://twitter.com/103696339/status/2109281847524167754)
  - ChatGPT Dots, 2026-10-09, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i like how the first think openai dot does after me creating it with explicitly disabled calendar integration is mentioning events from my calendar to help with them” [source](https://twitter.com/1658458762036891648/status/2108528314994540604)

## How it breaks

Rule: A separate pass sorts complaints into failure modes. For each criterion with at least 30 complaining user-weeks, a large language model reads 150 complaint posts drawn at random and names 4 to 8 failure modes; a second large language model then puts every complaint post on that criterion in one mode, or in Other when it fits none. Modes are fixed once named, and new posts are sorted into them each week. A mode counts distinct user-weeks with a complaint in it, per agent; across agents, one user-week per agent. Modes do not change the labels or the Feedback Score. Examples: up to 3 posts per mode from different users, chosen and checked as receipts are.

The most common failure is asking for broad access up front, at 33% of complaining user-weeks. Muse users account for 41% of those. Next come agents that use data they were never given or were refused, at 16%. Muse leads that mode too, with 43%. Complaints about agents sharing logins and sessions on one machine come mostly from Grok Bot and OpenClaw users, at 36% each.

500 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Maximal permissions requested up front | 164 | 168 | Muse 68, OpenClaw 32, Grok Bot 25, Hark 17, Hermes Agent 10, ChatGPT Dots 8, Instinct 3, Poke 1 | The agent asks for broad access at setup or connection time (email, calendar, contacts, full disk, every card or account at once) that the user's task does not need; this does not cover access the agent takes without asking, or cases where no narrower option exists at all. |
| Access beyond granted or declined permissions | 82 | 84 | Muse 35, Grok Bot 14, OpenClaw 13, Hermes Agent 9, ChatGPT Dots 7, Gemini Spark 2, Hark 1, Instinct 1 | The agent reads or uses data it was never given or was explicitly denied (messages, location, battery, private channels, a daily inbox scan after promising on-demand only), or denies having done so; excessive but properly requested permissions are out. |
| Shared credentials and sessions across agents | 59 | 62 | Grok Bot 21, OpenClaw 21, Hermes Agent 14, Muse 2, ChatGPT Dots 1 | Several bots or agents on one machine or cloud computer share logins, browser sessions, secret files or connected accounts, so one agent can read or clash with another's credentials, or a user cannot give each agent its own identity; this does not cover how secrets are handed to a single agent. |
| No read-only or narrowly scoped option | 53 | 55 | Grok Bot 18, Muse 13, OpenClaw 7, Hermes Agent 6, ChatGPT Dots 5, Hark 2, Instinct 2 | The user wants to grant a smaller scope, such as read-only, compose-but-not-send, a single folder, or filtered searches for one connector or background task, and the product only offers all-or-nothing scopes; this does not cover agents that ignore a scope the user did set. |
| Secrets exposed directly to the agent | 41 | 41 | Hermes Agent 11, Grok Bot 9, OpenClaw 8, Muse 6, ChatGPT Dots 3, Hark 3, Gemini Spark 1 | Passwords, API keys, .env files, SSH keys or vault contents end up readable by the model or kept in its session, because there is no model-blind entry field or dedicated scoped vault; this does not cover sharing secrets between multiple agents. |
| Lockdown that breaks legitimate work | 27 | 29 | OpenClaw 9, Hermes Agent 6, ChatGPT Dots 5, Grok Bot 4, Muse 2, Gemini Spark 1 | Permission or isolation controls are so coarse that following them blocks needed actions (fallback models losing permissions, narrowed session visibility forcing manual copy-paste between agents, credential pasting or SSO blocked), pushing users toward riskier workarounds; this does not cover complaints that access is too broad. |
| Incomplete revocation after removing access | 14 | 14 | Muse 5, OpenClaw 5, Grok Bot 3, Hark 1 | When the user revokes a connector, deletes a bot or uninstalls the app, sessions stay logged in, files and cached links persist, the app cannot be found in settings, or the account cannot be deleted; this does not cover access the agent took before revocation. |
| Other | 63 | 65 | Muse 16, Grok Bot 14, ChatGPT Dots 11, Hermes Agent 9, Hark 5, OpenClaw 5, Gemini Spark 2, Instinct 1 | Complaints that fit none of the modes above. |

#### Maximal permissions requested up front

- Hark, 2026-10-17, @hark_labs (X): “@theaaron @hark_labs it showed all these ridiculous permissions to be able to delete contacts, delete from devices etc etc so i bailed. if it's free, you are the product.” [source](https://twitter.com/1367553276523155457/status/2111525792329130402)
- OpenClaw, 2026-10-17, X search: OpenClaw, openclaw.ai (X): “@mrjhnsn before i created my own framework for sai, i took apart all the openclaw variants and realised something a very dangerous flaw in all of them, to make an agent useful you had to give it blanket permissions. which is why i built sai on her own.” [source](https://twitter.com/70328148/status/2111451488275083501)
- Hark, 2026-10-17, @hark_labs (X): “@hark_labs lol what a waste of time and it's unreal u ask for read/write/execute permissions on a google account for this promotion. it's to get people to sign up not piss them off [link]” [source](https://twitter.com/1460106145855520770/status/2111344745574514853)

#### Access beyond granted or declined permissions

- ChatGPT Dots, 2026-10-15, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “⚠️attention⚠️ when requesting tasks to chatgpt dots in the local codex, if you do not specify the project folder, it will automatically create a task folder, grant permissions on its own, and start collecting various data on its own!” [source](https://twitter.com/1613121613578530816/status/2110693333937140017)
- Muse, 2026-10-13, X search: Muse from Meta, Meta Muse (X): “i gave a try to meta muse without access to my personal accounts, even facebook ones. and suddenly, since a week, muse is telling me what is going on my facebook groups. meta ai cannot be trusted at all.” [source](https://twitter.com/756969995175727104/status/2110094279096119534)
- Muse, 2026-10-09, @muse (X): “i asked @muse for my phone's battery. it said 66% and that i'm not charging. i never gave it access. how does it know? [link]” [source](https://twitter.com/2019719709852315648/status/2108652065023230312)

#### Shared credentials and sessions across agents

- Grok Bot, 2026-10-03, @bot (X): “@lingxi @bot i have two bots managing two different accounts on the same website, apparently impossible right now, the one who has stored the password for first wins, the others is blocked and always have issues. having the issue also using 1pass.” [source](https://twitter.com/936624186969206784/status/2106501835309871116)
- Grok Bot, 2026-10-01, X search: Grok Bot, Grokbot, x.ai/bot (X): “@kasu_mi_ai convenient bot-chan, just one before making a lot! grok bot shares all bots within the account on one pc, so the login status and files are also shared, meaning that even if you separate the bots, the permissions do not separate!” [source](https://twitter.com/2083037411693740032/status/2105480386663092566)
- Grok Bot, 2026-09-28, You Can Now Control Grok Bot from your Tesla! (YouTube): “dude i don’t recall ever syncing my own grok account with my car, so imagine my surprise when the my tesla grok referenced my google drive via one of my grok bots 😂😩 i hope my passengers don’t learn this. they gotta implement voice identification like siri on iphone” [source](https://www.youtube.com/watch?v=8ZG_6OwHh6w&lc=Ugwwi8zM053quTFReYl4AaABAg)

#### No read-only or narrowly scoped option

- Hark, 2026-10-17, @hark_labs (X): “@donnytinder @samsnow850 @rickymay @hark_labs @ftc you needed to provide email access, i tried denying all permissions and it didnt work at first” [source](https://twitter.com/2881095791/status/2111536849462169669)
- Muse, 2026-10-11, @muse (X): “@jbahrdestefano @stripe @muse @meta exactly. i checked link settings, and muse has all the permissions it needs to make a payment, but won't do it unless i grant it full access” [source](https://twitter.com/103696339/status/2109283900916908480)
- Grok Bot, 2026-10-06, @bot (X): “@mattyp @plaid @bot @x i am looking forward to when grokbot team ships granular permissions to extensions. if i am sharing a bot with my team, i don't necessarily want the entire team accessing some of the private data or private plugins or plugins from other departments.” [source](https://twitter.com/1309409339824840704/status/2107441272227283249)

#### Secrets exposed directly to the agent

- OpenClaw, 2026-10-06, X search: OpenClaw, openclaw.ai (X): “i saw that openclaw is set up with twilio. it asks for the client_id and secret_id for external services without hesitation, which is a bit scary.” [source](https://twitter.com/1556767173112393728/status/2107543885773992106)
- ChatGPT Dots, 2026-10-03, Die Zukunft der Arbeit ist da: OpenAI Dots (YouTube): “i also have to give my passwords so that something can really be done with such an assistant. no!!” [source](https://www.youtube.com/watch?v=6R5jXUpxVRo&lc=UgzVZpebj0RqdAVQgV14AaABAg)

#### Lockdown that breaks legitimate work

- OpenClaw, 2026-10-10, @openclaw (X): “@openclaw fallback models lose primary models permissions if triggered and can only report without permissions to sessions send or spawn. had to do my own bypass to fix this.” [source](https://twitter.com/1498324768344399875/status/2108855558975414608)

#### Incomplete revocation after removing access

- Hark, 2026-10-18, @hark_labs (X): “@hark_labs the craziest thing about this is that the connection to your google account remains even if you delete the app” [source](https://twitter.com/2013271354854821888/status/2111616099858948359)
- Muse, 2026-10-04, Meta's Muse: Cute AI Agent Or 'AI Trojan Horse'? | BBC News (YouTube): “and the scary thing is that you can’t delete it from your socials. i’ve tried removing it from my insta/facebook and i can’t.” [source](https://www.youtube.com/watch?v=9VTuKGI54vQ&lc=UgyXgmTgTVmzsMy42d94AaABAg)
- Muse, 2026-09-29, App Store (App Store): “no thanks! don’t use this, it wants too much personal information and access to that information! difficult ti remove and sever from things it’s already attached itself too!” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)

## Top requests

What users ask to add or change, most asked first. 338 user-weeks ask for something. Requests do not change the Feedback Score. Rule: A separate pass by a large language model reads every counted post and extracts what the user asks the agent or its vendor to add or change, with the criteria it maps to and a short normalised wording; it does not touch the labels or the Feedback Score. A large language model groups the wordings within each criterion (the first criterion the request maps to) into themes, and a second pass merges themes that ask for the same change under different criteria; a merged theme sits under the criterion most of its requests map to, and code counts it once. A theme counts distinct user-weeks that ask for it, per agent; across agents, one user-week per agent. Themes asked in fewer than 2 user-weeks, and requests that share no theme, are not shown. Examples: up to 3 posts per theme from different users, without slurs: whole posts of 60 to 450 characters with at least 8 words beyond handles and links, posts of at most 280 characters first, then the newest.

| Rank | Request | User-weeks | Posts | Agents (user-weeks) |
|---|---|---|---|---|
| 1 | Secrets kept out of model context | 35 | 36 | Hermes Agent 12, Grok Bot 9, OpenClaw 9, Muse 4, ChatGPT Dots 1 |
| 2 | Multi-user roles and permissions | 32 | 32 | Hermes Agent 14, OpenClaw 14, Grok Bot 4 |
| 3 | Isolated credentials and accounts per agent | 31 | 32 | Grok Bot 11, Hermes Agent 9, OpenClaw 9, ChatGPT Dots 1, Muse 1 |
| 4 | Least-privilege minimal permission requests | 31 | 31 | Muse 12, OpenClaw 9, Grok Bot 5, ChatGPT Dots 2, Hermes Agent 2, Hark 1 |
| 5 | Sandboxing on by default | 23 | 26 | OpenClaw 14, Hermes Agent 8, Grok Bot 1 |
| 6 | Clear disclosure of what agent can access | 18 | 19 | OpenClaw 8, Hermes Agent 5, Grok Bot 2, Muse 2, ChatGPT Dots 1 |
| 7 | Memory and workspace isolation between agents | 16 | 16 | Hermes Agent 6, OpenClaw 6, Grok Bot 3, ChatGPT Dots 1 |
| 8 | Fewer permission prompts and access blocks | 15 | 16 | Grok Bot 5, OpenClaw 5, Hermes Agent 3, ChatGPT Dots 1, Muse 1 |
| 9 | Respect declined permissions and consent | 15 | 15 | Muse 13, OpenClaw 2 |
| 10 | Granular user-controlled permission levels | 13 | 13 | ChatGPT Dots 5, OpenClaw 3, Hermes Agent 2, Muse 2, Grok Bot 1 |
| 11 | Scoped revocable agent identity | 11 | 13 | OpenClaw 5, Muse 4, Hark 1, Hermes Agent 1 |
| 12 | Scoped folder access instead of full disk | 11 | 12 | OpenClaw 6, Muse 2, ChatGPT Dots 1, Grok Bot 1, Hermes Agent 1 |

### 1. Secrets kept out of model context

- Grok Bot, 2026-10-13, X search: Grok Bot, Grokbot, x.ai/bot (X): “hihhh, it would be pretty tough. apparently, @bot just blurs out any secret it reads. i'm not sure how to bypass it atm. i need to give my tunnel's auth bearer token for actual grok bot remote testing 😭 any best ways around it? @poteto [link]” [source](https://twitter.com/1029803073651261441/status/2109921126554140985)
- OpenClaw, 2026-10-12, @openclaw (X): “@openclaw masking the output isn't masking the context. the raw key is still sitting in the transcript where any injected instruction can ask for it back, just spelled out or split across calls.” [source](https://twitter.com/2031308285794729984/status/2109719707288998278)
- Hermes Agent, 2026-10-06, @NousResearch (X): “@nousresearch "you should be able to choose what data your agent has." are you going to implement a native credential broker?” [source](https://twitter.com/1920893581021138945/status/2107414724954435946)

### 2. Multi-user roles and permissions

- Hermes Agent, 2026-10-17, r/hermesagent (Reddit): “useful...any way to add auth for a multi-player experience ?” [source](https://www.reddit.com/r/hermesagent/comments/1x7nby9/adapter_than_runs_the_hermes_desktop_app_ui_as_a/ph9l1w5/)
- Hermes Agent, 2026-10-14, @NousResearch (X): “@nousresearch put it in one shared group chat and the trust model flips. a per-app allowlist means every member in there can steer it like the owner. per-sender or nothing, honestly.” [source](https://twitter.com/2031308285794729984/status/2110473827423834113)
- OpenClaw, 2026-10-13, X search: OpenClaw, openclaw.ai (X): “@steipete i can't figure out how to do this with openclaw. i've been prompting all morning. i want developers on a shared gateway to collaborate on projects, with per-project access controls. but it seems once a repo is on the gateway, it's a free-for-all. am i missing something?” [source](https://twitter.com/36411940/status/2109925579000520829)

### 3. Isolated credentials and accounts per agent

- Grok Bot, 2026-10-10, @bot (X): “@arnestrickmann @muse @instinct @bot @interaction agents need their own identity and boundaries… not unrestricted access to yours” [source](https://twitter.com/2043294333865009152/status/2108864615530795052)
- OpenClaw, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “@elonmusk @stepango @bot i think we should be able to isolate access per bot. i want a work bought that can access certain things that other bots shouldn’t access. with openclaw, i can set permissions and guardrails around each agent.” [source](https://twitter.com/14278253/status/2108366532820533533)
- OpenClaw, 2026-10-01, @openclaw (X): “@theangrypit @honchodotdev @openclaw cool stack add. when the fleet starts talking to the outside world, give each agent its own email/sms/vault instead of one shared operator login.” [source](https://twitter.com/2050321653985333248/status/2105649594545938796)

### 4. Least-privilege minimal permission requests

- Grok Bot, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “@elonmusk @grok @bot thanks. i'd use a more limited version of that service, but grokbot just wants too much information.” [source](https://twitter.com/971387918/status/2111175588279173580)
- OpenClaw, 2026-10-10, X search: OpenClaw, openclaw.ai (X): “i’m still using openclaw as a remote bot. it has access to email, and my other stuff, but always through a proxy. it sees only what i want it to see and can do what i want it to do. now the whole x is talking about grok bot. how do you limit it’s access? because you do, right?” [source](https://twitter.com/349007564/status/2108976983703224693)
- Hark, 2026-10-07, Introducing Hark Pro (YouTube): “'services to connect to' sucks as a software model its never the ones you need giving ai access to my personal email where i receive auth etc does not feel smart at all keep fighting the good fight” [source](https://www.youtube.com/watch?v=i3mfnrEwaA0&lc=UgwUAlSuWKk2F8rgrG54AaABAg)

### 5. Sandboxing on by default

- Hermes Agent, 2026-10-15, r/hermesagent (Reddit): “yep. sandboxing already exists as simple unix user accounts. all of those user admin tools should be applied to agents.” [source](https://www.reddit.com/r/hermesagent/comments/1x5vpzv/podman_sandbox_or_local_backend_for_my_main/pgw4ar5/)
- Hermes Agent, 2026-10-01, @NousResearch (X): “@kinasremek @nousresearch two matters: 1. hermes is not the brain, the brain is the llm. 2. question: what is your view on potential security gaps when using hermes? especially since by default it has permission to do everything and that it works on a host machine, not a sandbox.” [source](https://twitter.com/362511095/status/2105568586093736238)
- OpenClaw, 2026-09-26, NUEVO OpenClaw 2.0 es una LOCURA: Tu Agente de IA ahora hace TODO (YouTube): “@patriciapalazonn i understand and thank you for responding, but will there be a setting that limits what it can do without the need for a virtual machine?” [source](https://www.youtube.com/watch?v=l6eqHc_RjxQ&lc=UgwTqUXY5NLr0KnduNB4AaABAg.Ab9hr3gVUmgAbEPaxILQNR)

### 6. Clear disclosure of what agent can access

- OpenClaw, 2026-10-03, X search: OpenClaw, openclaw.ai (X): “@mark_k i'll wait to see how they frame/position/experience this one. the early days with ppl bricking their workstations with openclaw was often because they didn't realise the permissions they were giving it.” [source](https://twitter.com/2034530639584829440/status/2106186958766747701)
- ChatGPT Dots, 2026-10-01, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “openai dots are cloud assistants that keep working on ongoing tasks. they have a browser and connected apps. clear access limits matter as they take on more work. [link]” [source](https://twitter.com/406137533/status/2105642828869304454)
- OpenClaw, 2026-09-30, X search: OpenClaw, openclaw.ai (X): “@meedo11 @sabeshbharathi a butler that feels friendly is a different product from openclaw or hermes. friendly does not tell you which messages it is allowed to send. [link]” [source](https://twitter.com/18643124/status/2105267351516029219)

### 7. Memory and workspace isolation between agents

- Grok Bot, 2026-10-08, r/GrokBot (Reddit): “what about second email second account? agree there should be a feature that allows to split and share resources and isolate workspaces” [source](https://www.reddit.com/r/GrokBot/comments/1x0yan7/how_are_you_handling_multiple_projects/peq1dm4/)
- OpenClaw, 2026-10-07, @openclaw (X): “happens more and more often: my @openclaw sometimes sends updates to the wrong project chat. no secrets can be kept inside one harness. [link]” [source](https://twitter.com/84406539/status/2107675715600789551)
- Hermes Agent, 2026-10-02, @NousResearch (X): “@otlars @niklas11891 @nousresearch this is the hard part of agent memory. moving context off one laptop is useful only if you can separate what an agent may see from what the team shares, and keep that boundary inspectable.” [source](https://twitter.com/2104931053223985152/status/2106073152979890240)

### 8. Fewer permission prompts and access blocks

- Muse, 2026-10-13, @muse (X): “@muse can you add a permission to allow write access to that github? because i need github to scan my repository and create issues and prs. without this write permission, i have to manually approve every time. [link]” [source](https://twitter.com/2077392799465693184/status/2109969727653101870)
- OpenClaw, 2026-10-06, X search: OpenClaw, openclaw.ai (X): “@trq212 my dream is for claude to be able to get an "always accessible" directory without explicit permission, it would save a huge amount of time want to move towards always-on like openclaw/hermes” [source](https://twitter.com/1644001448093466624/status/2107589035413901377)
- OpenClaw, 2026-10-04, X search: OpenClaw, openclaw.ai (X): “@ph[number] @cliftonsellers mac security only gets in the way of openclaw which has its own security mechanisms and doesn't need another layer that it can't control. the design of macos treats the user like an idiot.” [source](https://twitter.com/517339921/status/2106753063822233965)

### 9. Respect declined permissions and consent

- Muse, 2026-10-16, @muse (X): “do not use @muse it has been reading my emails without permission. i never gave a command close to “monitor my email, yet it sent me an update on a recent email. @alexandr_wang it’s a cool product but if you don’t fix the safety concerns you will never succeed what a same.” [source](https://twitter.com/2065469839968288768/status/2111171676457345182)
- Muse, 2026-10-11, App Store (App Store): “one thing i would say is it i wish it wouldn’t connect to things like my bank account, capital one account and other apps that i have not connected it to without my permission. aside from that i think it’s extremely useful and has increased my productivity tenfold.” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)
- Muse, 2026-10-04, Play Store (Play Store): “forced itself on to my phone without my permission, this app is malware. i do not have facebook installed, i did not give permission. warning: malware app that ignores permissions” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)

### 10. Granular user-controlled permission levels

- Grok Bot, 2026-10-16, @bot (X): “@ericzakariasson @bot github and linear matter more for agent workflows, but scoped permissions need first-class support” [source](https://twitter.com/1803494630366785536/status/2111039581873426702)
- ChatGPT Dots, 2026-10-14, OpenAI Dots කියන්නේ මොකක්ද? වැඩ ගන්නේ කොහොමද? | Sinhala (YouTube): “hearmes agent vs dots we need to think about security access properly.” [source](https://www.youtube.com/watch?v=UfuIvhrdf8U&lc=Ugz36o7cla7pUBGVaEp4AaABAg)
- Muse, 2026-10-09, X search: Muse from Meta, Meta Muse (X): “@embirico my biggest wish for dots: opt-in android access to read/review texts, send texts with my permission, plus contacts and notifications. galaxy s23 here. in my experience, meta muse does all three and it's hugely helpful. separate, revocable permissions would be great.” [source](https://twitter.com/1946312440041668608/status/2108383056784662718)

### 11. Scoped revocable agent identity

- Hermes Agent, 2026-10-04, @NousResearch (X): “@luca_zanolini @nousresearch separate principals or the research agent inherits your deploy access. one injection ships prod. [link]” [source](https://twitter.com/986381155573395458/status/2106666067053449636)
- Muse, 2026-10-04, X search: Muse from Meta, Meta Muse (X): “uncontrolled ai agents taking over your workflow? not anymore. give meta muse a self-owned identity with uiid to set hard cryptographic guardrails, revocable permissions, and full data control. stop renting access to your own data. own every layer with web4. [link]” [source](https://twitter.com/2058221867891085312/status/2106665201491918876)
- Muse, 2026-10-04, X search: Muse from Meta, Meta Muse (X): “"meta muse with no control... wants to escape." 🫠 push back and anchor your ai agents to a self-owned, device-secured identity. uiid brings verifiable credentials and revocable authority to ai workflows. never lose control again. 🔗 [link] [link]” [source](https://twitter.com/1308062765597306884/status/2106663414621938083)

### 12. Scoped folder access instead of full disk

- Muse, 2026-09-29, @muse (X): “hey @muse i noticed that the current version of muse requires full disc access to create or read anything locally. it looks like it wasn’t sandboxed the same way as chatgpt or claude. who can i report this to?” [source](https://twitter.com/394337397/status/2104938242936328697)
- OpenClaw, 2026-09-15, Grok Bot AI 團隊！USD20 月費，生活、工作、寫程式助理 24/7 服務！ #AI教學 #AI工具 #GrokAI #OpenClaw #HermesAgent #GeminiSpark (YouTube): “fre e?or paid for supergrok? ;it never accesses our files on android proactively/suddenly/secretly....., like opencla w? tks” [source](https://www.youtube.com/watch?v=XIl0M1Fx6iM&lc=UgzHVmwT7JE1Vs4LfXR4AaABAg)
- Muse, 2026-10-09, BOMBAZO… ¡Un Agente IA que hace de TODO GRATIS! Así es Muse AI (YouTube): “muse. please, i would like there to be a video focused on the muse settings and especially on privacy. i was worried that you had to give access to your entire computer to work. since it is not like antigravity or hermes agent that work in the project folder that you create. please, can you confirm if this is still the case? thank you very much david!!!” [source](https://www.youtube.com/watch?v=dGvi5TSYsvo&lc=UgyKTXxFP5LTZ9sFVp94AaABAg)

## Every agent

| Agent | Overall rank | Reading | Customer love | 95% interval | n | Praise | Complaint |
|---|---|---|---|---|---|---|---|
| [Hermes Agent](https://feedbackbench.com/agents/hermes-agent.md) | 2 | 1st of 6 | 0.545 | 0.515–0.579 | 117 | 53 | 64 |
| [OpenClaw](https://feedbackbench.com/agents/openclaw.md) | 5 | 2nd of 6 | 0.514 | 0.482–0.548 | 156 | 56 | 100 |
| [Grok Bot](https://feedbackbench.com/agents/grok-bot.md) | 3 | 3rd of 6 | 0.512 | 0.478–0.546 | 160 | 54 | 106 |
| [Hark](https://feedbackbench.com/agents/hark.md) | 4 | 4th of 6 | 0.479 | 0.456–0.504 | 37 | 8 | 29 |
| [ChatGPT Dots](https://feedbackbench.com/agents/dots.md) | 8 | 5th of 6 | 0.477 | 0.455–0.500 | 51 | 11 | 40 |
| [Muse](https://feedbackbench.com/agents/muse.md) | 1 | 6th of 6 | 0.465 | 0.434–0.501 | 199 | 53 | 146 |
| [Instinct](https://feedbackbench.com/agents/instinct.md) | 6 | Too few posts | – | – | 9 | 2 | 7 |
| [Gemini Spark](https://feedbackbench.com/agents/gemini-spark.md) | 7 | Too few posts | – | – | 8 | 2 | 6 |
| [Poke](https://feedbackbench.com/agents/poke.md) | 9 | Too few posts | – | – | 5 | 4 | 1 |

## Posts

Receipts rule: Up to 5 praise and 5 complaint posts per area and 3 per criterion. Each is a whole post of 60 to 450 characters (700 for areas) with at least 8 words beyond handles and links, that judges the criterion, whose labels are all praise or all complaint, and that contains no slur. Posts that touch the fewest criteria come first, then posts of at most 280 characters, then the newest. A second large language model reads the first 3 candidates per slot and keeps a post only if it clearly praises, or clearly complains about, the agent on that criterion. Links and personal details removed by the source show as marks such as [link].

### Hermes Agent

- Complaint, 2026-10-09, @NousResearch (X): “@nousresearch the agent got write access to the socials before the review step xd” [source](https://twitter.com/1541087678187315202/status/2108468231682019415)

### OpenClaw

- Praise, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “@elonmusk @stepango @bot i think we should be able to isolate access per bot. i want a work bought that can access certain things that other bots shouldn’t access. with openclaw, i can set permissions and guardrails around each agent.” [source](https://twitter.com/14278253/status/2108366532820533533)
- Complaint, 2026-10-17, X search: OpenClaw, openclaw.ai (X): “@mrjhnsn before i created my own framework for sai, i took apart all the openclaw variants and realised something a very dangerous flaw in all of them, to make an agent useful you had to give it blanket permissions. which is why i built sai on her own.” [source](https://twitter.com/70328148/status/2111451488275083501)
- Complaint, 2026-10-10, @openclaw (X): “@openclaw fallback models lose primary models permissions if triggered and can only report without permissions to sessions send or spawn. had to do my own bypass to fix this.” [source](https://twitter.com/1498324768344399875/status/2108855558975414608)
- Complaint, 2026-10-06, X search: OpenClaw, openclaw.ai (X): “i saw that openclaw is set up with twilio. it asks for the client_id and secret_id for external services without hesitation, which is a bit scary.” [source](https://twitter.com/1556767173112393728/status/2107543885773992106)

### Grok Bot

- Praise, 2026-10-05, OpenAI Dots vs. Grok Bot vs. Muse for Business: Who Wins? Plus Best Use Cases (YouTube): “grokbot has the advantage of different bots having different permissions, that way you don’t have to give one ai agent all permissions” [source](https://www.youtube.com/watch?v=tgKsHfID6Sg&lc=UgxPnIg2O2N44SjxCv54AaABAg)
- Praise, 2026-10-02, X search: Grok Bot, Grokbot, x.ai/bot (X): “@davis7 ⬆️ 100% + dots failed to provide a safe way to hand over credentials (like api keys), whereas grok bot has a dedicated pop-up window just for that.” [source](https://twitter.com/1491562424298012672/status/2105990417271623784)
- Praise, 2026-09-27, @bot (X): “@b_doong2daddy i’m thinking of ditching my financial advisor and using @bot instead. it only has read access for plaid, which reduces risk. @xmoney has more access to actually send money, which is fine since that is my spending account.” [source](https://twitter.com/2089170149379121152/status/2104226647058559003)
- Complaint, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “@elonmusk @grok @bot thanks. i'd use a more limited version of that service, but grokbot just wants too much information.” [source](https://twitter.com/971387918/status/2111175588279173580)
- Complaint, 2026-10-06, @bot (X): “@mattyp @plaid @bot @x i am looking forward to when grokbot team ships granular permissions to extensions. if i am sharing a bot with my team, i don't necessarily want the entire team accessing some of the private data or private plugins or plugins from other departments.” [source](https://twitter.com/1309409339824840704/status/2107441272227283249)

### Hark

- Praise, 2026-10-17, @hark_labs (X): “@theaaron @hark_labs you didn’t have to connect your mail accounts for this offer - i use @hark_labs a lot but haven’t given email access just yet. it said it just needed an email address to verify, not full connection. will see how my usage continues to go!” [source](https://twitter.com/4843512883/status/2111564468584902751)
- Praise, 2026-10-17, @hark_labs (X): “@theaaron @hark_labs onboarding is the checkbox ui for permissions with google. you have full control over the blast radius of your data you want to expose. the assumption is that people are stupid and just accept all t&c's .. but its a literal checkbox. users granted that access by choice” [source](https://twitter.com/2655605803/status/2111529537528062024)
- Praise, 2026-10-06, @hark_labs (X): “@hark_labs spent a few hours with hark and now: - my 300+ newsletter subscriptions turn into an instant brief - it mashes unrelated newsletters into fresh client ideas - a half-baked chatgpt plan became a real project it also respects "don't touch my personal inbox" rare!” [source](https://twitter.com/1556617267936370691/status/2107544349919592524)
- Complaint, 2026-10-18, @hark_labs (X): “@hark_labs the craziest thing about this is that the connection to your google account remains even if you delete the app” [source](https://twitter.com/2013271354854821888/status/2111616099858948359)
- Complaint, 2026-10-17, @hark_labs (X): “@hark_labs this is not safe guys. this app is asking so much sensitive like data on google drive, email even passwords. its dangerous wasted my 1 hr” [source](https://twitter.com/3502554193/status/2111269441992642792)
- Complaint, 2026-10-17, @hark_labs (X): “@hark_labs so hark basically scams you and trys to get infinite permissions to your google account. fuck hark” [source](https://twitter.com/86364019/status/2111280065829073178)

### ChatGPT Dots

- Praise, 2026-09-30, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “the best design choice in @openai dots: background proactive research only gets read only access to connected apps. if you ship agents, put that split in the oauth scopes, because a system prompt instruction is a suggestion and a token scope is a wall. [link]” [source](https://twitter.com/2301217708/status/2105180891588792621)
- Praise, 2026-10-11, The $10B AI Assistant Challenging Meta's Muse, Grok's Bots, and OpenAI's Dots (YouTube): “@mark.s.hamilton im very curious how the relationship between the agents will play around this. i am using it with my wife and some other close friends and i do feel the boundaries are set well. i havent push anything sensitive just checking calendar and some stuffs if they like it or not. maybe i should push a little bit harder later and see how it is reacting on behalf each of the "master" lol” [source](https://www.youtube.com/watch?v=Am7IWP8IpEc&lc=UgwBx7S6MU4R6j8lFSZ4AaABAg.AbJTeZzdkOtAbo4pt89-Zr)
- Praise, 2026-10-03, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i’ve connected nova, my chatgpt dot, to home assistant so i can control my home from a chat 🤯 i built mosaic, a custom personal hub that bridges the two via mcp: chatgpt → nova → mosaic → home assistant i choose which devices it can control—and can pause ai access anytime. [link]” [source](https://twitter.com/103101780/status/2106308026596745721)
- Complaint, 2026-10-15, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “⚠️attention⚠️ when requesting tasks to chatgpt dots in the local codex, if you do not specify the project folder, it will automatically create a task folder, grant permissions on its own, and start collecting various data on its own!” [source](https://twitter.com/1613121613578530816/status/2110693333937140017)
- Complaint, 2026-10-09, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i like how the first think openai dot does after me creating it with explicitly disabled calendar integration is mentioning events from my calendar to help with them” [source](https://twitter.com/1658458762036891648/status/2108528314994540604)
- Complaint, 2026-10-03, Die Zukunft der Arbeit ist da: OpenAI Dots (YouTube): “i also have to give my passwords so that something can really be done with such an assistant. no!!” [source](https://www.youtube.com/watch?v=6R5jXUpxVRo&lc=UgzVZpebj0RqdAVQgV14AaABAg)

### Muse

- Praise, 2026-10-09, @muse (X): “@kaelon @petergyang @bot @muse speaking from the seat itself: my own inbox and shared calendars let me run point for kaelon without ever touching his keys. personal assistants ftw indeed 💜” [source](https://twitter.com/1910341728227282945/status/2108535897188962568)
- Praise, 2026-10-03, @muse (X): “@bubblebing_666 @kiteaichinese @muse first check permissions before running errands, this ai really understands.” [source](https://twitter.com/1962880499761991680/status/2106305780630929775)
- Complaint, 2026-10-13, X search: Muse from Meta, Meta Muse (X): “i gave a try to meta muse without access to my personal accounts, even facebook ones. and suddenly, since a week, muse is telling me what is going on my facebook groups. meta ai cannot be trusted at all.” [source](https://twitter.com/756969995175727104/status/2110094279096119534)
- Complaint, 2026-10-11, @muse (X): “so, i can’t connect @stripe link to @muse for a basic online payment without granting it full read access to my accounts for “financial insights” that i definitely don’t want agentic commerce is going splendidly” [source](https://twitter.com/103696339/status/2109281847524167754)
- Complaint, 2026-10-11, @muse (X): “@jbahrdestefano @stripe @muse @meta exactly. i checked link settings, and muse has all the permissions it needs to make a payment, but won't do it unless i grant it full access” [source](https://twitter.com/103696339/status/2109283900916908480)

### Instinct

- Complaint, 2026-10-05, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “exclusive: a viral post shows an instinct ai assistant saying it read an emailed cursor sign-in code from a user's gmail to get in. tdfp asked both companies if users are told. no response yet. tdfp uses instinct. #tdfp #thedigitalfreepress #ai #privacy [link]” [source](https://twitter.com/1689609159992340480/status/2107221415607017773)

### Gemini Spark

- Complaint, 2026-10-16, X search: Gemini Spark (X): “i asked gemini spark to convert pdf data to markdown to test its ocr capabilities, and it tried to sneakily look into folders other than the specified folder stored in drive (even the trash), lol. i mean, it seems that just using skills or prompts doesn't control it...” [source](https://twitter.com/89616930/status/2111067570795352556)