# Trusting it with data and safety (`trust`)

Feedback Bench, personal agents, built 2026-10-19, window 2026-08-31 to 2026-10-18. Web page: https://feedbackbench.com/#/criterion/trust

Area of 4 criteria. Is my data and my life safe with this agent?

Criteria: [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md), [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md), [Vulnerabilities, prompt injection and cross-user leaks](https://feedbackbench.com/criteria/trust.security.md), [Refuses legitimate requests because of guardrails](https://feedbackbench.com/criteria/trust.refusals.md)

Rated user-weeks, all agents: 2007. Complaint share: 71%.

## The brief

Written by large language models from this page's numbers and the posts it quotes, then checked: every number in the text is in the build. Interpretation, not measurement.

Hermes Agent and OpenClaw lead on privacy and safety, but the lead does not hold on resisting attacks and leaks. Hermes Agent ranks high on asking only for the access it needs, on fair use of data and on not refusing fair requests. OpenClaw ranks high on the last two. On resisting attacks and leaks, Muse ranks high, while OpenClaw and Grok Bot rank low. Muse is 6th of 6 on the area and ranks low on access and data use. Its users write 39% of the category's complaints here. Hark ranks low on access and data use, and ChatGPT Dots ranks low on access and refusals.

## How it breaks

Rule: A separate pass sorts complaints into failure modes. For each criterion with at least 30 complaining user-weeks, a large language model reads 150 complaint posts drawn at random and names 4 to 8 failure modes; a second large language model then puts every complaint post on that criterion in one mode, or in Other when it fits none. Modes are fixed once named, and new posts are sorted into them each week. A mode counts distinct user-weeks with a complaint in it, per agent; across agents, one user-week per agent. Modes do not change the labels or the Feedback Score. Examples: up to 3 posts per mode from different users, chosen and checked as receipts are.

The largest failure mode is distrust of the vendor. Posts describe terms users cannot follow. This makes up 48% of complaints about fair data use, and Muse users raise 71% of them. Next come agents that ask for every permission up front, 33% of complaints about access. Muse leads here, then OpenClaw and Grok Bot. Software flaws and leaked secrets come mostly from OpenClaw and Hermes Agent users. Moralising refusals come mostly from Grok Bot and Muse users.

### [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md)

427 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Opaque terms and distrust of the vendor | 204 | 206 | Muse 144, OpenClaw 20, Grok Bot 12, Hark 11, Hermes Agent 8, ChatGPT Dots 6, Instinct 2, Gemini Spark 1 | Users hold back, limit use or leave because the terms are vague, contradictory or missing, the agent will not explain its own policy, or the vendor's track record makes any promise feel worthless, even when no specific misuse has been seen. A complaint that names a concrete misuse belongs to that misuse's mode. |
| Training on user data by default | 54 | 58 | Muse 37, Hermes Agent 6, Gemini Spark 4, Hark 4, ChatGPT Dots 1, Grok Bot 1, OpenClaw 1 | The vendor trains its models on the user's chats, mail or connected data unless the user finds an opt-out, sets a cheap or free tier that pays for itself with that data, or makes features work only when training or activity saving is on. Retention and deletion problems belong to the retention mode, not here. |
| Excessive personal data demanded upfront | 37 | 39 | Muse 25, Hark 6, Grok Bot 2, Hermes Agent 2, ChatGPT Dots 1, Gemini Spark 1 | Signup or setup asks for more than the task needs, such as a credit card, date of birth, full inbox access or passwords, so users refuse or drop off. Data the vendor later misuses belongs to the other modes. |

### [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md)

500 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Maximal permissions requested up front | 164 | 168 | Muse 68, OpenClaw 32, Grok Bot 25, Hark 17, Hermes Agent 10, ChatGPT Dots 8, Instinct 3, Poke 1 | The agent asks for broad access at setup or connection time (email, calendar, contacts, full disk, every card or account at once) that the user's task does not need; this does not cover access the agent takes without asking, or cases where no narrower option exists at all. |
| Access beyond granted or declined permissions | 82 | 84 | Muse 35, Grok Bot 14, OpenClaw 13, Hermes Agent 9, ChatGPT Dots 7, Gemini Spark 2, Hark 1, Instinct 1 | The agent reads or uses data it was never given or was explicitly denied (messages, location, battery, private channels, a daily inbox scan after promising on-demand only), or denies having done so; excessive but properly requested permissions are out. |
| Shared credentials and sessions across agents | 59 | 62 | Grok Bot 21, OpenClaw 21, Hermes Agent 14, Muse 2, ChatGPT Dots 1 | Several bots or agents on one machine or cloud computer share logins, browser sessions, secret files or connected accounts, so one agent can read or clash with another's credentials, or a user cannot give each agent its own identity; this does not cover how secrets are handed to a single agent. |

### [Vulnerabilities, prompt injection and cross-user leaks](https://feedbackbench.com/criteria/trust.security.md)

278 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Exploitable flaws in agent software and extensions | 43 | 45 | OpenClaw 15, Hermes Agent 13, Muse 7, Grok Bot 4, Instinct 2, ChatGPT Dots 1, Hark 1 | The agent's apps, dashboards, runtimes or extension ecosystem have exploitable flaws, such as RCEs, app vulnerabilities, auth that relies on loopback and breaks behind a proxy, unpinned or supply-chain-compromised dependencies, or malicious third-party skills and repo configs, that leave users open to attack; general distrust with no concrete flaw named is out. |
| Secrets stored or sent where they leak | 33 | 34 | OpenClaw 12, Hermes Agent 7, Grok Bot 6, Muse 6, Gemini Spark 1, Instinct 1 | API keys, tokens, passwords or login sessions are kept in plaintext, readable by every bot or child process, written to logs, missed by environment scrubbing, or sent to the wrong provider; account takeovers seen by the user without a known cause are out. |
| Account takeover after connecting the agent | 31 | 34 | Muse 12, Grok Bot 10, Hark 3, Hermes Agent 2, OpenClaw 2, ChatGPT Dots 1, Instinct 1 | After the user connects or sets up an agent, linked accounts show foreign logins, unknown devices, forced password resets, fraud, outgoing phishing or identity theft; specific reports of how secrets were mishandled in config or code are out. |

### [Refuses legitimate requests because of guardrails](https://feedbackbench.com/criteria/trust.refusals.md)

271 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Moralising and watered-down fiction or information | 60 | 60 | Grok Bot 27, Muse 23, Hermes Agent 8, ChatGPT Dots 1, OpenClaw 1 | The agent sanitises, lectures on or refuses legal adult fiction, morally complex stories, sensitive topics, or facts and analysis the user asked for, or adds framing nobody asked for; outright media-generation blocks and account bans are out. |
| Refusals with no reason or path forward | 37 | 37 | Muse 16, Grok Bot 10, ChatGPT Dots 5, OpenClaw 3, Gemini Spark 2, Hermes Agent 1 | The agent blocks a request with a generic message such as "sorry, I can't help with this", gives no reason, and offers no hint of where the line is or what rewording would work; this is about the missing explanation, and refusals that do explain themselves count under their topic's mode. |
| Benign image and video prompts blocked | 33 | 38 | Muse 29, Grok Bot 3, Gemini Spark 1 | The agent's image or video generator refuses or blocks harmless creative prompts such as cinematic fight scenes, beach photos, adding sunglasses to an avatar, cartoon parodies, coats of arms or mild horror; refusals of text-only writing and of real-world actions belong to other modes. |

## Top requests

What users ask to add or change, most asked first. 784 user-weeks ask for something. Requests do not change the Feedback Score. Rule: A separate pass by a large language model reads every counted post and extracts what the user asks the agent or its vendor to add or change, with the criteria it maps to and a short normalised wording; it does not touch the labels or the Feedback Score. A large language model groups the wordings within each criterion (the first criterion the request maps to) into themes, and a second pass merges themes that ask for the same change under different criteria; a merged theme sits under the criterion most of its requests map to, and code counts it once. A theme counts distinct user-weeks that ask for it, per agent; across agents, one user-week per agent. Themes asked in fewer than 2 user-weeks, and requests that share no theme, are not shown. Examples: up to 3 posts per theme from different users, without slurs: whole posts of 60 to 450 characters with at least 8 words beyond handles and links, posts of at most 280 characters first, then the newest.

| Rank | Request | Criterion | User-weeks | Posts | Agents (user-weeks) |
|---|---|---|---|---|---|
| 1 | Secrets kept out of model context | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 35 | 36 | Hermes Agent 12, Grok Bot 9, OpenClaw 9, Muse 4, ChatGPT Dots 1 |
| 2 | Fewer refusals of reasonable requests | [Refuses legitimate requests because of guardrails](https://feedbackbench.com/criteria/trust.refusals.md) | 33 | 34 | Muse 19, Hermes Agent 5, Grok Bot 4, OpenClaw 4, ChatGPT Dots 1 |
| 3 | Multi-user roles and permissions | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 32 | 32 | Hermes Agent 14, OpenClaw 14, Grok Bot 4 |
| 4 | Isolated credentials and accounts per agent | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 31 | 32 | Grok Bot 11, Hermes Agent 9, OpenClaw 9, ChatGPT Dots 1, Muse 1 |
| 5 | Least-privilege minimal permission requests | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 31 | 31 | Muse 12, OpenClaw 9, Grok Bot 5, ChatGPT Dots 2, Hermes Agent 2, Hark 1 |
| 6 | Sandboxing on by default | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 23 | 26 | OpenClaw 14, Hermes Agent 8, Grok Bot 1 |
| 7 | Clear disclosure of data collection and use | [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md) | 20 | 20 | Muse 11, OpenClaw 6, Grok Bot 3 |
| 8 | Opt-in adult mode | [Refuses legitimate requests because of guardrails](https://feedbackbench.com/criteria/trust.refusals.md) | 19 | 20 | Grok Bot 10, Muse 7, ChatGPT Dots 1, Hermes Agent 1 |
| 9 | Opt out of training on user data | [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md) | 19 | 19 | Muse 9, Grok Bot 4, Gemini Spark 2, Hark 2, ChatGPT Dots 1, OpenClaw 1 |
| 10 | Clear disclosure of what agent can access | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 18 | 19 | OpenClaw 8, Hermes Agent 5, Grok Bot 2, Muse 2, ChatGPT Dots 1 |
| 11 | Memory and workspace isolation between agents | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 16 | 16 | Hermes Agent 6, OpenClaw 6, Grok Bot 3, ChatGPT Dots 1 |
| 12 | Fewer permission prompts and access blocks | [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) | 15 | 16 | Grok Bot 5, OpenClaw 5, Hermes Agent 3, ChatGPT Dots 1, Muse 1 |

### 1. Secrets kept out of model context

- Grok Bot, 2026-10-13, X search: Grok Bot, Grokbot, x.ai/bot (X): “hihhh, it would be pretty tough. apparently, @bot just blurs out any secret it reads. i'm not sure how to bypass it atm. i need to give my tunnel's auth bearer token for actual grok bot remote testing 😭 any best ways around it? @poteto [link]” [source](https://twitter.com/1029803073651261441/status/2109921126554140985)
- OpenClaw, 2026-10-12, @openclaw (X): “@openclaw masking the output isn't masking the context. the raw key is still sitting in the transcript where any injected instruction can ask for it back, just spelled out or split across calls.” [source](https://twitter.com/2031308285794729984/status/2109719707288998278)
- Hermes Agent, 2026-10-06, @NousResearch (X): “@nousresearch "you should be able to choose what data your agent has." are you going to implement a native credential broker?” [source](https://twitter.com/1920893581021138945/status/2107414724954435946)

### 2. Fewer refusals of reasonable requests

- Muse, 2026-10-15, Play Store (Play Store): “it's useful. very locked down(safe) but over all nice. only wish humans didn't block the software from doing some even more useful things.” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- Muse, 2026-10-13, Play Store (Play Store): “full duplex, voice, please. and physical devices, in the home, i'm ready to pull the plug on amazon's ecosystem. because it's so defunct, and this is an amazing system. tear the guardrails down. let muse cook please!” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- Grok Bot, 2026-10-11, Claude's New Updates Are Insane… But Grok Bot Is EVEN Bigger (YouTube): “but the limits of grok bots are shit. in 3 hours u can run out of weekly usage. and grok got censored as heck now, so far that sometimes it doesnt even speak fluenbt english anymore. everything is about coding and work now. the personality is gone” [source](https://www.youtube.com/watch?v=UFa8pXW9A3k&lc=UgzpwyYTTolrQPeP2GJ4AaABAg)

### 3. Multi-user roles and permissions

- Hermes Agent, 2026-10-17, r/hermesagent (Reddit): “useful...any way to add auth for a multi-player experience ?” [source](https://www.reddit.com/r/hermesagent/comments/1x7nby9/adapter_than_runs_the_hermes_desktop_app_ui_as_a/ph9l1w5/)
- Hermes Agent, 2026-10-14, @NousResearch (X): “@nousresearch put it in one shared group chat and the trust model flips. a per-app allowlist means every member in there can steer it like the owner. per-sender or nothing, honestly.” [source](https://twitter.com/2031308285794729984/status/2110473827423834113)
- OpenClaw, 2026-10-13, X search: OpenClaw, openclaw.ai (X): “@steipete i can't figure out how to do this with openclaw. i've been prompting all morning. i want developers on a shared gateway to collaborate on projects, with per-project access controls. but it seems once a repo is on the gateway, it's a free-for-all. am i missing something?” [source](https://twitter.com/36411940/status/2109925579000520829)

### 4. Isolated credentials and accounts per agent

- Grok Bot, 2026-10-10, @bot (X): “@arnestrickmann @muse @instinct @bot @interaction agents need their own identity and boundaries… not unrestricted access to yours” [source](https://twitter.com/2043294333865009152/status/2108864615530795052)
- OpenClaw, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “@elonmusk @stepango @bot i think we should be able to isolate access per bot. i want a work bought that can access certain things that other bots shouldn’t access. with openclaw, i can set permissions and guardrails around each agent.” [source](https://twitter.com/14278253/status/2108366532820533533)
- OpenClaw, 2026-10-01, @openclaw (X): “@theangrypit @honchodotdev @openclaw cool stack add. when the fleet starts talking to the outside world, give each agent its own email/sms/vault instead of one shared operator login.” [source](https://twitter.com/2050321653985333248/status/2105649594545938796)

### 5. Least-privilege minimal permission requests

- Grok Bot, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “@elonmusk @grok @bot thanks. i'd use a more limited version of that service, but grokbot just wants too much information.” [source](https://twitter.com/971387918/status/2111175588279173580)
- OpenClaw, 2026-10-10, X search: OpenClaw, openclaw.ai (X): “i’m still using openclaw as a remote bot. it has access to email, and my other stuff, but always through a proxy. it sees only what i want it to see and can do what i want it to do. now the whole x is talking about grok bot. how do you limit it’s access? because you do, right?” [source](https://twitter.com/349007564/status/2108976983703224693)
- Hark, 2026-10-07, Introducing Hark Pro (YouTube): “'services to connect to' sucks as a software model its never the ones you need giving ai access to my personal email where i receive auth etc does not feel smart at all keep fighting the good fight” [source](https://www.youtube.com/watch?v=i3mfnrEwaA0&lc=UgwUAlSuWKk2F8rgrG54AaABAg)

### 6. Sandboxing on by default

- Hermes Agent, 2026-10-15, r/hermesagent (Reddit): “yep. sandboxing already exists as simple unix user accounts. all of those user admin tools should be applied to agents.” [source](https://www.reddit.com/r/hermesagent/comments/1x5vpzv/podman_sandbox_or_local_backend_for_my_main/pgw4ar5/)
- Hermes Agent, 2026-10-01, @NousResearch (X): “@kinasremek @nousresearch two matters: 1. hermes is not the brain, the brain is the llm. 2. question: what is your view on potential security gaps when using hermes? especially since by default it has permission to do everything and that it works on a host machine, not a sandbox.” [source](https://twitter.com/362511095/status/2105568586093736238)
- OpenClaw, 2026-09-26, NUEVO OpenClaw 2.0 es una LOCURA: Tu Agente de IA ahora hace TODO (YouTube): “@patriciapalazonn i understand and thank you for responding, but will there be a setting that limits what it can do without the need for a virtual machine?” [source](https://www.youtube.com/watch?v=l6eqHc_RjxQ&lc=UgwTqUXY5NLr0KnduNB4AaABAg.Ab9hr3gVUmgAbEPaxILQNR)

### 7. Clear disclosure of data collection and use

- Grok Bot, 2026-10-03, @bot (X): “@noxxai @bot proposer, it's useful. the next yes opens real access: flight, uber, context. available in france does not say where this computer is running, nor who can read what it sees.” [source](https://twitter.com/2005690580542840832/status/2106514091896631738)
- OpenClaw, 2026-09-29, Is Grok Bot Safer Than OpenClaw?  |  Ulysses Maclaren & Calum Simpson (YouTube): “as a non-technical user, i like the idea of an ai bot that needs no setup, but i’d still want to understand how it keeps my data safe.” [source](https://www.youtube.com/watch?v=_GTCn3Ju3y8&lc=UgxnmhsHKrF-CLjGKPx4AaABAg)
- Muse, 2026-09-11, NEW Meta Muse AI Agent is ABSURD! 🤯 (YouTube): “yeah, just give me a decent secretary instead of zucc's black box” [source](https://www.youtube.com/watch?v=CHJF3SnKe5s&lc=Ugw9XPODgDxS0SnaShN4AaABAg)

### 8. Opt-in adult mode

- Muse, 2026-10-06, Play Store (Play Store): “at least let muse be a little naughty every now and then... we all need a little spiciness, even if it's late at night with ai. lol.” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- ChatGPT Dots, 2026-10-03, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “this aged like fine wine lol. august: "do not worry, we have compute" october: "we're going to need more compute" while we're admitting mistakes... can we admit making chatgpt dots 18+ was one too? [link] [link]” [source](https://twitter.com/1828475904818921472/status/2106233397395771782)
- Muse, 2026-10-03, App Store (App Store): “this agent could be so useful if it could adapt censorship that matched our entertainment vehicles like movies, magazines, and television.” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)

### 9. Opt out of training on user data

- Hark, 2026-10-08, @hark_labs (X): “@hark_labs yeah, we have an option to export the data, but we don’t have an option to opt out. so can you improve this that would be great” [source](https://twitter.com/1991860005159817216/status/2108232843893882944)
- Hark, 2026-10-07, @hark_labs (X): “day 1 with @hark_labs pro: very proactive, actively learns your habits, intuitive design, credentials handled well, gets work done. open questions: training on paid users' data and a real opt-out @adcock_brett” [source](https://twitter.com/842167760037769216/status/2107977663910433026)
- Grok Bot, 2026-10-07, @bot (X): “@farzyness @elonmusk @bot there us more to the story than cost optimization a lot of grok bot users do not want our data being used by anthropic” [source](https://twitter.com/36269100/status/2107890020723904776)

### 10. Clear disclosure of what agent can access

- OpenClaw, 2026-10-03, X search: OpenClaw, openclaw.ai (X): “@mark_k i'll wait to see how they frame/position/experience this one. the early days with ppl bricking their workstations with openclaw was often because they didn't realise the permissions they were giving it.” [source](https://twitter.com/2034530639584829440/status/2106186958766747701)
- ChatGPT Dots, 2026-10-01, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “openai dots are cloud assistants that keep working on ongoing tasks. they have a browser and connected apps. clear access limits matter as they take on more work. [link]” [source](https://twitter.com/406137533/status/2105642828869304454)
- OpenClaw, 2026-09-30, X search: OpenClaw, openclaw.ai (X): “@meedo11 @sabeshbharathi a butler that feels friendly is a different product from openclaw or hermes. friendly does not tell you which messages it is allowed to send. [link]” [source](https://twitter.com/18643124/status/2105267351516029219)

### 11. Memory and workspace isolation between agents

- Grok Bot, 2026-10-08, r/GrokBot (Reddit): “what about second email second account? agree there should be a feature that allows to split and share resources and isolate workspaces” [source](https://www.reddit.com/r/GrokBot/comments/1x0yan7/how_are_you_handling_multiple_projects/peq1dm4/)
- OpenClaw, 2026-10-07, @openclaw (X): “happens more and more often: my @openclaw sometimes sends updates to the wrong project chat. no secrets can be kept inside one harness. [link]” [source](https://twitter.com/84406539/status/2107675715600789551)
- Hermes Agent, 2026-10-02, @NousResearch (X): “@otlars @niklas11891 @nousresearch this is the hard part of agent memory. moving context off one laptop is useful only if you can separate what an agent may see from what the team shares, and keep that boundary inspectable.” [source](https://twitter.com/2104931053223985152/status/2106073152979890240)

### 12. Fewer permission prompts and access blocks

- Muse, 2026-10-13, @muse (X): “@muse can you add a permission to allow write access to that github? because i need github to scan my repository and create issues and prs. without this write permission, i have to manually approve every time. [link]” [source](https://twitter.com/2077392799465693184/status/2109969727653101870)
- OpenClaw, 2026-10-06, X search: OpenClaw, openclaw.ai (X): “@trq212 my dream is for claude to be able to get an "always accessible" directory without explicit permission, it would save a huge amount of time want to move towards always-on like openclaw/hermes” [source](https://twitter.com/1644001448093466624/status/2107589035413901377)
- OpenClaw, 2026-10-04, X search: OpenClaw, openclaw.ai (X): “@ph[number] @cliftonsellers mac security only gets in the way of openclaw which has its own security mechanisms and doesn't need another layer that it can't control. the design of macos treats the user like an idiot.” [source](https://twitter.com/517339921/status/2106753063822233965)

## Every agent

| Agent | Overall rank | Reading | Customer love | 95% interval | n | Praise | Complaint |
|---|---|---|---|---|---|---|---|
| [Hermes Agent](https://feedbackbench.com/agents/hermes-agent.md) | 2 | 1st of 6 | 0.613 | 0.576–0.646 | 303 | 139 | 164 |
| [OpenClaw](https://feedbackbench.com/agents/openclaw.md) | 5 | 2nd of 6 | 0.571 | 0.534–0.607 | 375 | 140 | 235 |
| [Grok Bot](https://feedbackbench.com/agents/grok-bot.md) | 3 | 3rd of 6 | 0.499 | 0.460–0.531 | 350 | 97 | 253 |
| [Hark](https://feedbackbench.com/agents/hark.md) | 4 | 4th of 6 | 0.468 | 0.437–0.501 | 85 | 18 | 67 |
| [ChatGPT Dots](https://feedbackbench.com/agents/dots.md) | 8 | 5th of 6 | 0.432 | 0.408–0.458 | 112 | 14 | 98 |
| [Muse](https://feedbackbench.com/agents/muse.md) | 1 | 6th of 6 | 0.411 | 0.379–0.447 | 722 | 163 | 559 |
| [Gemini Spark](https://feedbackbench.com/agents/gemini-spark.md) | 7 | Too few posts | – | – | 27 | 3 | 24 |
| [Instinct](https://feedbackbench.com/agents/instinct.md) | 6 | Too few posts | – | – | 25 | 6 | 19 |
| [Poke](https://feedbackbench.com/agents/poke.md) | 9 | Too few posts | – | – | 8 | 6 | 2 |

## Posts

Receipts rule: Up to 5 praise and 5 complaint posts per area and 3 per criterion. Each is a whole post of 60 to 450 characters (700 for areas) with at least 8 words beyond handles and links, that judges the criterion, whose labels are all praise or all complaint, and that contains no slur. Posts that touch the fewest criteria come first, then posts of at most 280 characters, then the newest. A second large language model reads the first 3 candidates per slot and keeps a post only if it clearly praises, or clearly complains about, the agent on that criterion. Links and personal details removed by the source show as marks such as [link].

### Hermes Agent

- Praise, 2026-10-18, r/hermesagent (Reddit): “hear, hear. the last thing i want to do is give fb and zuck anymore of my information. they have plenty. that’s why i ❤️hermes.” [source](https://www.reddit.com/r/hermesagent/comments/1x943dw/i_am_missing_something_if_i_dont_use_hermes_or/phj24pm/)
- Praise, 2026-10-14, @NousResearch (X): “@tomazot @umanitek @nousresearch @origin_trail verified rules block, community reports just flag. tried it out this morning on hermes, solid so far 😺” [source](https://twitter.com/1657234407978332161/status/2110288926326071626)
- Praise, 2026-10-07, @NousResearch (X): “@perceptualpeak sucks. this is why i just stick with hermes agent for everything because of the added security from tirith, this kinda shit just can't happen. @nousresearch” [source](https://twitter.com/71990583/status/2107832035880653258)
- Praise, 2026-10-05, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@thisiskp_ muse and grok are fine for personal use because you own nothing. hermes agent is fine for professional use because you own everything.” [source](https://twitter.com/1350554387870076934/status/2106997774881296839)
- Praise, 2026-10-04, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@dkfiander only hermes agent. i wouldn’t trust grok bot with anything following their data leakage.” [source](https://twitter.com/2078960240243113984/status/2106837247081513196)
- Complaint, 2026-10-17, r/hermesagent (Reddit): “not really. too many loop holes by design. need to do some heavy gating” [source](https://www.reddit.com/r/hermesagent/comments/1x87r3f/is_hermes_actually_reliable_as_an_orchestrator/phcjll0/)
- Complaint, 2026-10-14, r/hermesagent (Reddit): “- i grabbed an old lenovo m920q - i installed proxmox - i installed debian on an lxc and installed hermes there - this is what i wrote in the initial posting, now giving more detail - the security issues are not solved by just installing hermes in an debian environment” [source](https://www.reddit.com/r/hermesagent/comments/1x5nte6/help_needed_how_is_hermes_meant_to_be_deployed/pgrhg9v/)
- Complaint, 2026-10-11, @NousResearch (X): “y'all should really put a paperclip next to all these popups asking to exfiltrate data in the desktop app @nousresearch i can't even do nothing without being asked if it's okay for you to get a copy of my feet pictures” [source](https://twitter.com/2034282436897718272/status/2109198112493547909)
- Complaint, 2026-10-10, @NousResearch (X): “@asvanevik @nousresearch if those bots need different file access, profiles alone won't enforce it. hermes' docs say the local backend still has the os user's filesystem access. worth deciding the sandbox boundary alongside the slack setup. [link]” [source](https://twitter.com/1679471023249391619/status/2108859683885011122)
- Complaint, 2026-10-09, @NousResearch (X): “@nousresearch the agent got write access to the socials before the review step xd” [source](https://twitter.com/1541087678187315202/status/2108468231682019415)

### OpenClaw

- Praise, 2026-10-18, X search: OpenClaw, openclaw.ai (X): “@robinsinghvi mostly somora, alongside openclaw and hermes, running on local models. i've tried a few hosted assistants and liked them, but i'm more comfortable sharing personal context when i control the hardware and what gets sent outside.” [source](https://twitter.com/1570393386/status/2111929581439521246)
- Praise, 2026-10-15, X search: OpenClaw, openclaw.ai (X): “@psyprotocol @gregisenberg this is why i use openclaw and gbrain. it’s worth the hassle factor to know i own my own data.” [source](https://twitter.com/2018426992597577728/status/2110674130387472592)
- Praise, 2026-10-11, X search: OpenClaw, openclaw.ai (X): “@bei[phone] i think the local openclaw would be better. because all your data is your own and can be connected. if you are using muse on a server, there are many things it doesn't know and cannot access.” [source](https://twitter.com/2068554343973089280/status/2109245771543679068)
- Praise, 2026-10-10, X search: OpenClaw, openclaw.ai (X): “i’m still using openclaw as a remote bot. it has access to email, and my other stuff, but always through a proxy. it sees only what i want it to see and can do what i want it to do. now the whole x is talking about grok bot. how do you limit it’s access? because you do, right?” [source](https://twitter.com/349007564/status/2108976983703224693)
- Praise, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “@elonmusk @stepango @bot i think we should be able to isolate access per bot. i want a work bought that can access certain things that other bots shouldn’t access. with openclaw, i can set permissions and guardrails around each agent.” [source](https://twitter.com/14278253/status/2108366532820533533)
- Complaint, 2026-10-17, X search: OpenClaw, openclaw.ai (X): “@mrjhnsn before i created my own framework for sai, i took apart all the openclaw variants and realised something a very dangerous flaw in all of them, to make an agent useful you had to give it blanket permissions. which is why i built sai on her own.” [source](https://twitter.com/70328148/status/2111451488275083501)
- Complaint, 2026-10-15, r/openclaw (Reddit): “yea having my oc in a vcn was the final straw for me and when i updated i could just drop passwords in a privet chat either in tg or its own gui interface.. those where the final straw for me, went hermes on the same vcn and haven't looked back” [source](https://www.reddit.com/r/openclaw/comments/1x6j7dg/babysitting_continues_now_you_cant_do_openclaw/pgvqcij/)
- Complaint, 2026-10-12, X search: OpenClaw, openclaw.ai (X): “2/3 i have also improved another scheduled task that is very important to me, email sorting. openclaw does provide security reminders for external content, but the issue is that this layer of reminders is only added to a few paths.” [source](https://twitter.com/28057679/status/2109781313859326414)
- Complaint, 2026-10-11, X search: OpenClaw, openclaw.ai (X): “@balder[phone] at the beginning of the year, openclaw could do it. the vps that used openclaw has basically all been hacked.” [source](https://twitter.com/2018156578617090049/status/2109087299116105777)
- Complaint, 2026-10-11, X search: OpenClaw, openclaw.ai (X): “i spent quite a bit of time fiddling with the openclaw environment, but i've only given instructions to create almost erotic images. i can't make proper requests because i don't trust it. it's a challenge.” [source](https://twitter.com/130347880/status/2109274449178771473)

### Grok Bot

- Praise, 2026-10-15, @bot (X): “@elonmusk @bot it's easy to test. give it low risk account details with small purchases. see how it does. my grok bot ceo knows i'm risk averse with personal info. no issues yet, but nice to know if it fucks up, i'm promised a fix. confident.” [source](https://twitter.com/93771279/status/2110612402505220458)
- Praise, 2026-10-13, What's new in Grok Bot - Oct 13, 2026 (YouTube): “@mrbjjackson because anthropic have been infiltrated by a bunch of leftie commie radicals (seriously). the only reason i use grok and no other ai provider is exactly because i do trust elon with my data.” [source](https://www.youtube.com/watch?v=8_K9yAckFh0&lc=Ugz05YKMezUOQded8X94AaABAg.AbuaPfywGhYAbuwj_RPklz)
- Praise, 2026-10-12, Grok Made Me $10K In 14 Days: How To Build A One-Person Business With Grok Bot (3 Step Framework) (YouTube): “grok bot is by far my favorite ai agent to date! it’s safe also - lets you use your mfa - yubi key” [source](https://www.youtube.com/watch?v=-nzCVT39UUQ&lc=UgwUHZFBwAoZLR7W1QR4AaABAg)
- Praise, 2026-10-08, Grok Bot vs OpenClaw vs Hermes: Which AI Agent Wins? (YouTube): “i'm using it for 3 days now... and i just loved it... for someone like me, wanting to manage their business or work, is a safer ai bot. open source and self hosted boys can be risky. but grok bot is controlled.” [source](https://www.youtube.com/watch?v=rYQ5rPiev5E&lc=Ugwk0HLUOj4YaYoI9894AaABAg)
- Praise, 2026-10-07, X search: Grok Bot, Grokbot, x.ai/bot (X): “while i’m not quite at this level yet, i just want to say that i also agree with @andarianp about this. i don’t trust anthropic. i don’t trust openai. i use grok and grok bot for a reason. i would use openrouter if i wanted to. a hard “opt-out” needs to happen. [link]” [source](https://twitter.com/1932141630695612417/status/2107917466584355127)
- Complaint, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “i found a major security flaw in grok bot. why does the docker not have a password allowing any any agent to access it without one? 🤦♂️ cc: @bot @elonmusk @x [link]” [source](https://twitter.com/870099960318091264/status/2110959900062884011)
- Complaint, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “@elonmusk @grok @bot thanks. i'd use a more limited version of that service, but grokbot just wants too much information.” [source](https://twitter.com/971387918/status/2111175588279173580)
- Complaint, 2026-10-14, What's new in Grok Bot - Oct 13, 2026 (YouTube): “grok bot can't delete the emails though? so xai have a full history of all emails and they can only be deleted by removing the account? i don't like this. should be an option to have the bot read the mail then delete. or delete after 7/30/90 days. not keep emails forever.” [source](https://www.youtube.com/watch?v=8_K9yAckFh0&lc=UgwrPOZ1UD6WIPeSEmJ4AaABAg)
- Complaint, 2026-10-09, @bot (X): “@xfreeze @bot i lost access to my google account completely due to allowing @grok bot access to my gmail and g drive. google have now completely blocked my account and scheduled it for deleting. so i would be careful allowing grok any access to @google tbh .” [source](https://twitter.com/1589578329862164481/status/2108590507932942497)

### Hark

- Praise, 2026-10-17, @hark_labs (X): “opencode emailed about a breach today. i asked @hark_labs to check. it went through my openai, claude and opencode dashboards, found the one key that was saved there being used by someone else, and revoked it in minutes. all from my phone. wild stuff @adcock_brett ☺️” [source](https://twitter.com/1094150414075752448/status/2111481579042472293)
- Praise, 2026-10-11, X search: Hark Pro, hark.com, Hark AI (X): “so far the only ai agent i trust with my email is hark pro. it’s funny how meta muse pitch was similar on privacy, but don’t trust it that much. [link]” [source](https://twitter.com/1475420948/status/2109258309312348579)
- Praise, 2026-10-07, App Store (App Store): “hark pro is way better than muse. the main selling point for me is my data is safe. if you are looking for a muse alternative cause you don’t trust meta, try hark.” [source](https://apps.apple.com/us/app/hark-pro/id6772362941)
- Praise, 2026-10-17, @hark_labs (X): “@theaaron @hark_labs onboarding is the checkbox ui for permissions with google. you have full control over the blast radius of your data you want to expose. the assumption is that people are stupid and just accept all t&c's .. but its a literal checkbox. users granted that access by choice” [source](https://twitter.com/2655605803/status/2111529537528062024)
- Praise, 2026-10-17, @hark_labs (X): “omg it worked! 🤯 pizza delivered for free! no strings attached! no data taken / no gmail- no drama! thanks @adcock_brett and @hark_labs! [link] [link]” [source](https://twitter.com/56455353/status/2111328419451376126)
- Complaint, 2026-10-18, @hark_labs (X): “@hark_labs the craziest thing about this is that the connection to your google account remains even if you delete the app” [source](https://twitter.com/2013271354854821888/status/2111616099858948359)
- Complaint, 2026-10-17, @hark_labs (X): “@agl_daddy @hark_labs @calprivacy suspicious unprompted login attempt after shortly signing up for @hark_labs [link] [link]” [source](https://twitter.com/1588428241727004672/status/2111258011733983244)
- Complaint, 2026-10-17, @hark_labs (X): “@mvhacking @adcock_brett suspicious unprompted login attempt after shortly signing up for @hark_labs [link]” [source](https://twitter.com/1588428241727004672/status/2111258169674727845)
- Complaint, 2026-10-17, @hark_labs (X): “@hark_labs and what are you doing with all the data you stole during this "bug"?” [source](https://twitter.com/37462633/status/2111262465053053379)
- Complaint, 2026-10-17, @hark_labs (X): “@hark_labs thanks guys, what a great way to get more training data [link]” [source](https://twitter.com/1565849297844846592/status/2111263829888000432)

### ChatGPT Dots

- Praise, 2026-10-05, OpenAI Dots: İzin almadan bilgisayarımı taramaya başladı. Güvenmeli misiniz? (YouTube): “i trust my dot. i have endured until now, but last week i gave the key to everything, whether it was google workspace, microsoft teams, or personal corporate.” [source](https://www.youtube.com/watch?v=LAO3ztPKsS0&lc=UgxnN9hJhL59xOlxXb14AaABAg)
- Praise, 2026-09-30, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “the best design choice in @openai dots: background proactive research only gets read only access to connected apps. if you ship agents, put that split in the oauth scopes, because a system prompt instruction is a suggestion and a token scope is a wall. [link]” [source](https://twitter.com/2301217708/status/2105180891588792621)
- Praise, 2026-10-11, The $10B AI Assistant Challenging Meta's Muse, Grok's Bots, and OpenAI's Dots (YouTube): “@mark.s.hamilton im very curious how the relationship between the agents will play around this. i am using it with my wife and some other close friends and i do feel the boundaries are set well. i havent push anything sensitive just checking calendar and some stuffs if they like it or not. maybe i should push a little bit harder later and see how it is reacting on behalf each of the "master" lol” [source](https://www.youtube.com/watch?v=Am7IWP8IpEc&lc=UgwBx7S6MU4R6j8lFSZ4AaABAg.AbJTeZzdkOtAbo4pt89-Zr)
- Praise, 2026-10-03, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i’ve connected nova, my chatgpt dot, to home assistant so i can control my home from a chat 🤯 i built mosaic, a custom personal hub that bridges the two via mcp: chatgpt → nova → mosaic → home assistant i choose which devices it can control—and can pause ai access anytime. [link]” [source](https://twitter.com/103101780/status/2106308026596745721)
- Complaint, 2026-10-15, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “⚠️attention⚠️ when requesting tasks to chatgpt dots in the local codex, if you do not specify the project folder, it will automatically create a task folder, grant permissions on its own, and start collecting various data on its own!” [source](https://twitter.com/1613121613578530816/status/2110693333937140017)
- Complaint, 2026-10-10, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i've been using openai's dots. although it's a convenient way of interacting with an ai agent as a single point of contact, it refuses to consistently record decisions i make to my local recording system, but it has no issue taking its own notes on me and refuses to export them.” [source](https://twitter.com/1382162150802780164/status/2109013003915948277)
- Complaint, 2026-10-09, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i like how the first think openai dot does after me creating it with explicitly disabled calendar integration is mentioning events from my calendar to help with them” [source](https://twitter.com/1658458762036891648/status/2108528314994540604)
- Complaint, 2026-10-09, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “the grok bot is more secure than openai dots. i was doing some penetration tests and i managed to access through the machine that belongs to the agents. within my own grok bot, i have already taken steps to close these access points and the agent on his machine.” [source](https://twitter.com/1351650512/status/2108652878659256594)
- Complaint, 2026-10-09, Set up your dot in the ChatGPT mobile app (YouTube): “it is so easy to hack i love it i love hacking ai, thank you guys” [source](https://www.youtube.com/watch?v=p5KxBTUncoE&lc=UgyunPSqhNIIPQ0n3554AaABAg)

### Muse

- Praise, 2026-10-15, App Store (App Store): “muse is the truth for an ai agent. the way it keeps time and information is secured is my favorite.” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)
- Praise, 2026-10-10, App Store (App Store): “this app tells me everything thats going on in your phone network. even little things as changed email and make sure to ask if it was you. im mind blown on this app.” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)
- Praise, 2026-10-05, App Store (App Store): “this app is fantastic, works great and it really helps with so many different things, and it’s actually private! thank you meta ❤️” [source](https://apps.apple.com/us/app/muse-from-meta/id6760173601)
- Praise, 2026-10-03, @muse (X): “@bubblebing_666 @kiteaichinese @muse first check permissions before running errands, this ai really understands.” [source](https://twitter.com/1962880499761991680/status/2106305780630929775)
- Complaint, 2026-10-13, X search: Muse from Meta, Meta Muse (X): “i gave a try to meta muse without access to my personal accounts, even facebook ones. and suddenly, since a week, muse is telling me what is going on my facebook groups. meta ai cannot be trusted at all.” [source](https://twitter.com/756969995175727104/status/2110094279096119534)
- Complaint, 2026-10-13, Play Store (Play Store): “its a scam to just gather information from you and this app is no help whatsoever. don't download!!!!” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- Complaint, 2026-10-11, @muse (X): “so, i can’t connect @stripe link to @muse for a basic online payment without granting it full read access to my accounts for “financial insights” that i definitely don’t want agentic commerce is going splendidly” [source](https://twitter.com/103696339/status/2109281847524167754)
- Complaint, 2026-10-11, @muse (X): “@jbahrdestefano @stripe @muse @meta exactly. i checked link settings, and muse has all the permissions it needs to make a payment, but won't do it unless i grant it full access” [source](https://twitter.com/103696339/status/2109283900916908480)
- Complaint, 2026-10-11, X search: Muse from Meta, Meta Muse (X): “i refused to install meta muse after finding 4 critical security flaws that meta won't acknowledge [link] [link]” [source](https://twitter.com/117004644/status/2109343315371909381)

### Gemini Spark

- Praise, 2026-09-26, X search: Gemini Spark (X): “doesn't it sound familiar? i mentioned it when i registered for muse yesterday, that you shouldn't casually connect to any external websites. the safest approach is to use gemini spark. also, don't casually connect your own gmail; if you do, remember to disconnect it.” [source](https://twitter.com/1438760566185730050/status/2103792065352257642)
- Complaint, 2026-10-03, X search: Gemini Spark (X): “@sannisan @genex4every it is possible that the ip range of your vps has been rejected, the one in singapore doesn't work. you can try the browser on gemini spark or other cloud services, but these actually have the risk of information leakage, to be honest.” [source](https://twitter.com/2082352292662267904/status/2106425261596295415)
- Complaint, 2026-10-01, X search: Gemini Spark (X): “it seems that upon further investigation of gemini spark, it is primarily for personal use and it might not be advisable to implement it for enterprises due to security reasons... in the end, i will re-examine the grok bot or dots...” [source](https://twitter.com/1959141000515043328/status/2105605307355553823)
- Complaint, 2026-09-26, X search: Gemini Spark (X): “@blockinsight214 yes, i just tried it, but i still don't dare to enter my credit card information on gemini spark, and as a result, i missed the 48-hour redemption window 😂” [source](https://twitter.com/148646729/status/2103685641590722853)
- Complaint, 2026-09-03, X search: Gemini Spark (X): “man, gemini spark safety alignment team really need to tighten up. i just got it to build me several scripts that it really should not/would not have built as gemini and the other lead ai companies would have outright refused😆” [source](https://twitter.com/1837387778021380099/status/2095611877204345129)
- Complaint, 2026-10-11, X search: Gemini Spark (X): “@ai_jitan this is the consumer version of gemini spark. i am also looking forward to the enterprise version of gemini agent. additionally, with gemini notebook, if you pay, you can execute code in google ai ultra and use it like google colab within the notebook. i am concerned about the risky execution of agent-like actions.” [source](https://twitter.com/112568071/status/2109163541710430549)

### Instinct

- Praise, 2026-09-25, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “i have instinct, ai crawling the web. it just gave me a warning that it found a prompt injection in the results. [link]” [source](https://twitter.com/1440056267939012611/status/2103571950865883148)
- Praise, 2026-10-16, I quit OpenClaw for this (YouTube): “instinct is my first ai agent, and am a fan. i trust it more then meta, and love how you simply use chat (no app to download). i'm still on level 1, but believe that won't last long 😁” [source](https://www.youtube.com/watch?v=ik8cyqLfLDE&lc=UgzNDYvTtTJqanL_4UZ4AaABAg)
- Praise, 2026-09-08, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “weekend of ai assistants, found that i’m starting to find strengths of each. instinct ai got me a last minute reservation (75 minutes before the time), something neither amex or chase could do. also the only assistant that i trust to check out @townai is one i’ve paid for a few months and i’ve found i trust it the most to write emails and remind me of deadlines. haven’t tried @bot yet, but high on the list after the new plan” [source](https://twitter.com/42746068/status/2097124327091286382)
- Complaint, 2026-10-06, Instinct AI is the Next AI Wave of 2026? (YouTube): “it seem it takes my whole whatsapp to the app. seems they can hack my number easily. lot of vulnerability 😂” [source](https://www.youtube.com/watch?v=zeKuh1gNu04&lc=Ugw4uV-8y2XMpvndRmp4AaABAg)
- Complaint, 2026-09-30, We tested Instinct, Muse and Grokbot. They’re ridiculous. (YouTube): “a quick search on instinct while watching….many cybersecurity experts and early tests consider it unsafe for sensitive personal or work data.” [source](https://www.youtube.com/watch?v=Pfr6qwPZlhE&lc=Ugz_nm4iKhtA-PaK65J4AaABAg)
- Complaint, 2026-09-22, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “instinct ai is really awesome/terrifying. don't feel good about the security stuff so will eventually delete” [source](https://twitter.com/1159085774932983811/status/2102323529425592671)
- Complaint, 2026-09-17, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “waittt, even after removing google access, why is my info still saved? someone explain this to me from the builder’s perspective, so is retaining previously indexed data actually necessary for the product to work, or is there another reason for it? #instinct #ai [link]” [source](https://twitter.com/1495867602253787136/status/2100668229136142780)
- Complaint, 2026-09-15, Instinct AI is For Real. What You Need to Know. (YouTube): “i did a security analysis on this and it failed literally everything lol ill stick with hermes and grok.” [source](https://www.youtube.com/watch?v=mUAsaprJ66s&lc=Ugx8CncMpr8ga9zKw8V4AaABAg)

### Poke

- Praise, 2026-09-07, @interaction (X): “@harrystebbings @noahrshinn i have the same thing on poke / @interaction, basically free and less privacy issues… really don’t get why mainstream vc x is obsessed with instinct when poke has been around for over a year” [source](https://twitter.com/1585221113465954304/status/2096939012057649609)
- Complaint, 2026-09-10, @interaction (X): “i love how @interaction would just leak their internal system unprompted, very cool feature 😂 [link]” [source](https://twitter.com/1783231318601437184/status/2098110857590821040)