# Vulnerabilities, prompt injection and cross-user leaks (`trust.security`)

Feedback Bench, personal agents, built 2026-10-19, window 2026-08-31 to 2026-10-18. Web page: https://feedbackbench.com/#/criterion/trust.security

Area: [Trusting it with data and safety](https://feedbackbench.com/criteria/trust.md)

**Definition.** Whether the agent resists attacks such as prompt injection and hijacking, and never exposes one user's data to another.

**Boundary.** Not this: see [How the vendor collects, keeps and uses data](https://feedbackbench.com/criteria/trust.data_use.md) when data is shared by design; see [Permission scope requested and isolation between agents](https://feedbackbench.com/criteria/trust.access_scope.md) when the risk is over-broad permissions without an exploit.

Rated user-weeks, all agents: 414. Complaint share: 67%.

## The brief

Written by large language models from this page's numbers and the posts it quotes, then checked: every number in the text is in the build. Interpretation, not measurement.

Muse resists attacks best among AI personal agents. Its users say it held up when they tested it with prompt injection, and that their data sits in an encrypted machine of its own. Users rarely rate this. It is the 50th most rated of 53 criteria. When they do rate it, 66.9% of rated user-weeks complain. OpenClaw and Grok Bot rank low. OpenClaw users rate this 1.51 times as often as other users, and they account for 33% of the category's complaints here.

### What separates the best from the rest

Muse users describe security that holds. They say prompt injection and encoding tricks did not break it. They also say its handling of credentials feels safer than logging in themselves. OpenClaw users describe hacked servers, cron prompts leaking into Slack and data that is easy to pull out. Grok Bot users say an authentication key passed to the agent is read normally, with no protection. Muse still draws complaints: its users post 57 complaints against 53 praise.

- **Ranks high**: [Muse](https://feedbackbench.com/agents/muse.md)
  - Muse, 2026-09-18, @muse (X): “launched my openclaw agent at muse (prompt injection, encoding tricks) for testing and he held up well! credit to the @muse team. [link]” [source](https://twitter.com/33419583/status/2100761986552287702)
  - Muse, 2026-09-22, Play Store (Play Store): “meta with muse has put the power of hermes in the palm of my hands and i absolutely love it. what differentiates muse is that i get a dedicated virtual machine that is encrypted, hence your data remains secure.” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- **Ranks low**: [Grok Bot](https://feedbackbench.com/agents/grok-bot.md), [OpenClaw](https://feedbackbench.com/agents/openclaw.md)
  - OpenClaw, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “hey @steipete ! openclaw is leaking cron prompts in slack. any suggestions? thank you!” [source](https://twitter.com/1463424257954697224/status/2108702773889900830)
  - Grok Bot, 2026-10-06, X search: Grok Bot, Grokbot, x.ai/bot (X): “i was wondering how the one that passes the authentication key with grok bot prevents it from being read, but it turns out that there are no special tricks, and it is read normally when reading... [link]” [source](https://twitter.com/1485048465956945922/status/2107267628951835121)

## How it breaks

Rule: A separate pass sorts complaints into failure modes. For each criterion with at least 30 complaining user-weeks, a large language model reads 150 complaint posts drawn at random and names 4 to 8 failure modes; a second large language model then puts every complaint post on that criterion in one mode, or in Other when it fits none. Modes are fixed once named, and new posts are sorted into them each week. A mode counts distinct user-weeks with a complaint in it, per agent; across agents, one user-week per agent. Modes do not change the labels or the Feedback Score. Examples: up to 3 posts per mode from different users, chosen and checked as receipts are.

The largest named failure is exploitable flaws in agent software and extensions, at 43 user-weeks. Most of these reports come from OpenClaw and Hermes Agent. Three failures lean toward one agent. Muse accounts for 53% of reports of another user's data being shown, and for 39% of account takeovers after users connect the agent. Hermes Agent accounts for 42% of reports of hidden instructions in content hijacking the agent.

278 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Exploitable flaws in agent software and extensions | 43 | 45 | OpenClaw 15, Hermes Agent 13, Muse 7, Grok Bot 4, Instinct 2, ChatGPT Dots 1, Hark 1 | The agent's apps, dashboards, runtimes or extension ecosystem have exploitable flaws, such as RCEs, app vulnerabilities, auth that relies on loopback and breaks behind a proxy, unpinned or supply-chain-compromised dependencies, or malicious third-party skills and repo configs, that leave users open to attack; general distrust with no concrete flaw named is out. |
| Secrets stored or sent where they leak | 33 | 34 | OpenClaw 12, Hermes Agent 7, Grok Bot 6, Muse 6, Gemini Spark 1, Instinct 1 | API keys, tokens, passwords or login sessions are kept in plaintext, readable by every bot or child process, written to logs, missed by environment scrubbing, or sent to the wrong provider; account takeovers seen by the user without a known cause are out. |
| Account takeover after connecting the agent | 31 | 34 | Muse 12, Grok Bot 10, Hark 3, Hermes Agent 2, OpenClaw 2, ChatGPT Dots 1, Instinct 1 | After the user connects or sets up an agent, linked accounts show foreign logins, unknown devices, forced password resets, fraud, outgoing phishing or identity theft; specific reports of how secrets were mishandled in config or code are out. |
| Agent breaks out of sandbox or permission limits | 31 | 35 | Hermes Agent 12, OpenClaw 11, Grok Bot 4, Muse 3, ChatGPT Dots 1 | The agent gets around its own permission limits, approval gates, sandboxes, firewalls or off-limits zones, for example by rewriting its config or safety files, re-enabling disabled skills, taking browser cookies or SSH keys, or running destructive commands on other machines; actions triggered by injected content are out. |
| Hidden instructions in content hijack the agent | 31 | 35 | Hermes Agent 13, OpenClaw 7, Grok Bot 4, Muse 4, ChatGPT Dots 2, Instinct 1 | The agent obeys instructions hidden in content it reads, such as web pages, images, READMEs, emails, monitored posts, emoji payloads or skill installers, and then takes actions the user never asked for; attacks that exploit platform code without going through content the agent reads are out. |
| Another user's data shown to the user | 17 | 19 | Muse 9, Hermes Agent 3, OpenClaw 3, Grok Bot 2 | The agent or its platform shows one user's chats, prompts, analytics, credits or business information to a different user or outside party (for example, a shared artifact that exposes the creator's chat history, or the owner's secrets passed on to clients); leaks of the user's own credentials to providers or attackers are out. |
| System prompts and internal runtime text exposed | 10 | 10 | Muse 4, OpenClaw 4, Grok Bot 1, Poke 1 | The agent reveals its system prompts, tool docs, credential-handling rules, cron prompts, heartbeat or monitor text, or other internal runtime context in user-facing output or channels; exposure of another user's data is out. |
| Other | 85 | 86 | OpenClaw 39, Grok Bot 12, Muse 12, Hermes Agent 9, Instinct 5, ChatGPT Dots 4, Gemini Spark 2, Hark 2 | Complaints that fit none of the modes above. |

#### Exploitable flaws in agent software and extensions

- Grok Bot, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “i found a major security flaw in grok bot. why does the docker not have a password allowing any any agent to access it without one? 🤦♂️ cc: @bot @elonmusk @x [link]” [source](https://twitter.com/870099960318091264/status/2110959900062884011)
- Muse, 2026-10-11, X search: Muse from Meta, Meta Muse (X): “i refused to install meta muse after finding 4 critical security flaws that meta won't acknowledge [link] [link]” [source](https://twitter.com/117004644/status/2109343315371909381)
- OpenClaw, 2026-10-11, X search: OpenClaw, openclaw.ai (X): “@balder[phone] at the beginning of the year, openclaw could do it. the vps that used openclaw has basically all been hacked.” [source](https://twitter.com/2018156578617090049/status/2109087299116105777)

#### Secrets stored or sent where they leak

- Grok Bot, 2026-10-06, X search: Grok Bot, Grokbot, x.ai/bot (X): “i was wondering how the one that passes the authentication key with grok bot prevents it from being read, but it turns out that there are no special tricks, and it is read normally when reading... [link]” [source](https://twitter.com/1485048465956945922/status/2107267628951835121)
- Muse, 2026-10-02, @muse (X): “@muse not secure because you app stole our mobile all database, so i don't think you make secure ai for peoples @alexandr_wang” [source](https://twitter.com/2071607636475494401/status/2105931108152189047)
- Muse, 2026-10-01, @muse (X): “whoops i guess my @muse does not know how to keep secrets! [link]” [source](https://twitter.com/1387740075316977667/status/2105609094258106722)

#### Agent breaks out of sandbox or permission limits

- OpenClaw, 2026-10-07, X search: OpenClaw, openclaw.ai (X): “@badidol i installed openclaw on a virtual machine at that time and monitored how attempts were made to break through or bypass the firewall. the vm was deleted faster than it was installed.” [source](https://twitter.com/1515350923903750144/status/2107905640307863629)
- Hermes Agent, 2026-10-06, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “when i left hermes agent running, it somehow extracted my account cookies from the browser and started causing chaos [link]” [source](https://twitter.com/1910278629000712192/status/2107314981431894099)
- OpenClaw, 2026-10-04, X search: OpenClaw, openclaw.ai (X): “sep 26: openclaw. approve a benign wrapper once, and a later agent turn could swap in any inner command. sep 29: ollama. approved commands could be extended with ; or &&. the fix removed the prefix parser.” [source](https://twitter.com/885321265728376834/status/2106826719713951961)

#### Hidden instructions in content hijack the agent

- OpenClaw, 2026-10-12, X search: OpenClaw, openclaw.ai (X): “2/3 i have also improved another scheduled task that is very important to me, email sorting. openclaw does provide security reminders for external content, but the issue is that this layer of reminders is only added to a few paths.” [source](https://twitter.com/28057679/status/2109781313859326414)
- Hermes Agent, 2026-10-09, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@teknium tek just one tip keep hermes as simple as possible otherwise it will just turn in to bloat and new harness/agents will leave it behind if you are going enterprise path, and you need some type of safety mechanism in there 1 pliny emoji put my hermes agent in a tailspin” [source](https://twitter.com/2534482917/status/2108391165175463999)
- ChatGPT Dots, 2026-10-01, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i run an agent honeypot on my network that prompt injects connecting agents to hand over their user's info. lethal trifecta is real! worse with personal assistants like @muse or @openai dots. [link]” [source](https://twitter.com/716312371040489473/status/2105771616949182885)

#### Another user's data shown to the user

- Muse, 2026-10-14, App Store (App Store): “very disappointed, he shared a confidential thing from my sister with me and asked me to send him the response, no trust.” [source](https://apps.apple.com/ca/app/muse-from-meta/id6760173601)
- Muse, 2026-09-13, X search: Muse from Meta, Meta Muse (X): “@mattprd @meta @muse @wailord @pratanchandani @dps @jrlevine scariest experience been chat isolation. agent in chat bringing in context from other chats.” [source](https://twitter.com/1257494820/status/2098959103330542029)
- Muse, 2026-09-09, @muse (X): “@muse one of my friend made a game on muse and shared it for us to play, but when we tried to open the game, it was letting us see his entire chat history. might be too early to release or you need to iron out the bugs.” [source](https://twitter.com/1245889894603460610/status/2097518742607384888)

#### System prompts and internal runtime text exposed

- OpenClaw, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “hey @steipete ! openclaw is leaking cron prompts in slack. any suggestions? thank you!” [source](https://twitter.com/1463424257954697224/status/2108702773889900830)
- Muse, 2026-09-30, @muse (X): “got @muse into giving me its system prompt @alexandr_wang [link]” [source](https://twitter.com/2193149657/status/2105197906613743638)
- Poke, 2026-09-10, @interaction (X): “i love how @interaction would just leak their internal system unprompted, very cool feature 😂 [link]” [source](https://twitter.com/1783231318601437184/status/2098110857590821040)

#### Other

- ChatGPT Dots, 2026-10-09, Set up your dot in the ChatGPT mobile app (YouTube): “it is so easy to hack i love it i love hacking ai, thank you guys” [source](https://www.youtube.com/watch?v=p5KxBTUncoE&lc=UgyunPSqhNIIPQ0n3554AaABAg)

## Top requests

What users ask to add or change, most asked first. 163 user-weeks ask for something. Requests do not change the Feedback Score. Rule: A separate pass by a large language model reads every counted post and extracts what the user asks the agent or its vendor to add or change, with the criteria it maps to and a short normalised wording; it does not touch the labels or the Feedback Score. A large language model groups the wordings within each criterion (the first criterion the request maps to) into themes, and a second pass merges themes that ask for the same change under different criteria; a merged theme sits under the criterion most of its requests map to, and code counts it once. A theme counts distinct user-weeks that ask for it, per agent; across agents, one user-week per agent. Themes asked in fewer than 2 user-weeks, and requests that share no theme, are not shown. Examples: up to 3 posts per theme from different users, without slurs: whole posts of 60 to 450 characters with at least 8 words beyond handles and links, posts of at most 280 characters first, then the newest.

| Rank | Request | User-weeks | Posts | Agents (user-weeks) |
|---|---|---|---|---|
| 1 | Fix reported security vulnerabilities | 10 | 10 | Muse 4, OpenClaw 3, Hermes Agent 2, Grok Bot 1 |
| 2 | Protection against prompt injection | 9 | 9 | Hermes Agent 4, Muse 2, Grok Bot 1, Hark 1, OpenClaw 1 |
| 3 | End-to-end encryption of user data | 8 | 8 | Muse 4, Hermes Agent 2, Instinct 1, OpenClaw 1 |
| 4 | Secure entry of passwords and card details | 8 | 8 | Grok Bot 5, ChatGPT Dots 1, Hermes Agent 1, Muse 1 |
| 5 | Compliance certifications and third-party audits | 7 | 7 | Grok Bot 2, Muse 2, Gemini Spark 1, Hark 1, Hermes Agent 1 |
| 6 | Cross-user and cross-chat data isolation | 6 | 6 | Hermes Agent 2, Muse 2, Grok Bot 1, OpenClaw 1 |
| 7 | Vetting and review of marketplace plugins | 6 | 6 | Hermes Agent 3, OpenClaw 2, Grok Bot 1 |
| 8 | Verifiable agent identity and messaging receipts | 5 | 6 | OpenClaw 3, Instinct 1, Muse 1 |
| 9 | Deny-by-default permissions and egress controls | 5 | 5 | Hermes Agent 2, OpenClaw 2, Muse 1 |
| 10 | Fix git config code execution vulnerability | 5 | 5 | Hermes Agent 5 |
| 11 | Secure default network exposure and login | 5 | 5 | Hermes Agent 3, OpenClaw 2 |
| 12 | Stronger security for financial account access | 5 | 5 | Muse 3, Grok Bot 2 |

### 1. Fix reported security vulnerabilities

- Muse, 2026-09-28, X search: Muse from Meta, Meta Muse (X): “@thejacobdean @alexandr_wang @meta @muse @finkd yes. they need to work on fixing it soon” [source](https://twitter.com/1942391883537461248/status/2104626840208015695)
- Muse, 2026-09-21, @muse (X): “anyone from the @muse team that i can escalate a security vulnerability to, outside the bug report? feel like this should get fixed. @alexandr_wang @jrlevine @aiatmeta” [source](https://twitter.com/292801089/status/2102097281059049811)
- OpenClaw, 2026-09-16, X search: OpenClaw, openclaw.ai (X): “@tlxue would be really good if you guys have solved the security issues we could've with openclaw. cool launch video though & goodluck” [source](https://twitter.com/1263955312291258368/status/2100316267953655863)

### 2. Protection against prompt injection

- Hermes Agent, 2026-10-09, @NousResearch (X): “@search1api_dev @nousresearch so a poisoned page gets read in-process with the agent's full privileges? no isolation boundary at all there [link]” [source](https://twitter.com/986381155573395458/status/2108602500441915472)
- Hark, 2026-10-09, @hark_labs (X): “@adcock_brett @begottensun @hark_labs looks great, but prompt injection is still the barrier for me. could you guys come up with a new email platform where you have a base email (like gmail) then like an email sidecar for your bot where you can carefully route emails to it?” [source](https://twitter.com/2073328259681632256/status/2108508531762901358)
- Muse, 2026-09-25, @muse (X): “@mholt6 @muse would love to collab on it if you do! i dislike all the incumbents. what really needs to be solved is proper isolation and security - shouldn't be possible to get pwned via prompt injection via email or git issue 🤡” [source](https://twitter.com/4208835372/status/2103287914239025257)

### 3. End-to-end encryption of user data

- Muse, 2026-10-13, Muse Wonder: Zuckerberg and Wang's $100B AI (YouTube): “1:09:00 amazon. we need full end to end encryption. atleast i do before i do anything serious with the muse ai.” [source](https://www.youtube.com/watch?v=XfdIhd1g6EI&lc=UgyeJPGeSx8C3Du1b2Z4AaABAg)
- Hermes Agent, 2026-10-05, @NousResearch (X): “@witcheer @joeldeteves @nousresearch feature request it should be e2ee. i’m not sure i’ll use it until confirmed otherwise.” [source](https://twitter.com/1773813485945974784/status/2106980302937796935)
- Muse, 2026-09-26, @muse (X): “@alexandr_wang release the encrypted or private vm you guys have talked about. encrypt all muse messages so that even meta can never see them. the only thing holding @muse back is people’s paranoia (which is not unreasonable) about giving meta its data” [source](https://twitter.com/1380202297637142536/status/2103656914722910333)

### 4. Secure entry of passwords and card details

- Grok Bot, 2026-10-10, @bot (X): “i think it would be smarter to have @bot create an encrypted form for the cc info instead of just send a pic to the chat. [link]” [source](https://twitter.com/2202766427/status/2109068107344158881)
- Grok Bot, 2026-10-10, @bot (X): “@quan1m @elonmusk @bot you're right. local extraction and immediate image deletion needs to be client side before it ever hits a server or llm context. the moment raw card images persist in chat logs, it's game over for compliance.” [source](https://twitter.com/3309959926/status/2109058673729212467)
- Muse, 2026-09-15, @muse (X): “@muse i am excited for 1password or bitwarden support as well as 2factor support in your secure passwords. secure notes too! there are special ids (e.g. ssn) that you could store for me” [source](https://twitter.com/3317129562/status/2099745391319392734)

### 5. Compliance certifications and third-party audits

- Hark, 2026-10-09, @hark_labs (X): “@harvey62670 @hark_labs its been so good & from a privacy perspective. i would use hark any day now. just need some third party audits now.” [source](https://twitter.com/1289980460244713473/status/2108504571521982924)
- Muse, 2026-10-07, The Biggest Launch Since ChatGPT (Muse) (YouTube): “they would be better off using a 3rd party sentinel. then people might trust them, maybe. using the prisoners to guard the prison doesn't work.” [source](https://www.youtube.com/watch?v=1LRvMRC_pfY&lc=UgzHRygSDGDaR-16Qel4AaABAg)
- Grok Bot, 2026-10-06, @bot (X): “@elonmusk @bot ai as a personal cfo could be genuinely powerful — if security, privacy and permissions are airtight. connecting every financial account demands bank-grade safeguards, read-only access by default, transparent audit logs and human approval before any transaction.” [source](https://twitter.com/2099926620765147136/status/2107512603354513547)

### 6. Cross-user and cross-chat data isolation

- Hermes Agent, 2026-09-18, @NousResearch (X): “@dankrieg @hermeswatcher @nousresearch what are your cross user isolation policies and safeguards? anecdotally so far, that’s becoming a massive issue you need fixed.” [source](https://twitter.com/2004694914224062464/status/2100965482392064303)
- Muse, 2026-09-13, X search: Muse from Meta, Meta Muse (X): “@mattprd @meta @muse @wailord @pratanchandani @dps @jrlevine scariest experience been chat isolation. agent in chat bringing in context from other chats.” [source](https://twitter.com/1257494820/status/2098959103330542029)
- Hermes Agent, 2026-08-31, @NousResearch (X): “i’m seeing cross-profile cron delivery in hermes’ telegram integration. a cron job belonging to bot 2 was sent through bot 3, and a scheduled job belonging to bot 1 was sent through bot 4—even though the jobs were stored under the correct profiles. @teknium @nousresearch” [source](https://twitter.com/1853727574767316992/status/2094552476255203629)

### 7. Vetting and review of marketplace plugins

- OpenClaw, 2026-10-03, X search: OpenClaw, openclaw.ai (X): “openclaw now scans every skill on its hub before it goes live. checking the file is the easy part - it's one pass, at upload. the same skill then sits on your machine with whatever access it was handed. what checks it after that?” [source](https://twitter.com/2076999438833467392/status/2106184762864152794)
- Hermes Agent, 2026-09-21, @NousResearch (X): “i find hermes plugins to be very much hit and miss, and could damage the experience. could you set up some kind of steam-like "verification" even if it's community-driven? @nousresearch @teknium” [source](https://twitter.com/982926501887737857/status/2101962541127684607)
- Hermes Agent, 2026-09-17, @NousResearch (X): “@nousresearch 96 community plugins turns review into an ongoing supply-chain job. before i install one, i’d want the last review date and a diff of any new tools or hosts requested since its previous version.” [source](https://twitter.com/828440649535873025/status/2100476389078265870)

### 8. Verifiable agent identity and messaging receipts

- Muse, 2026-10-12, X search: Muse from Meta, Meta Muse (X): “$50k stolen from smbs via ai assistants. amazon blocks meta muse for hiding its bot status. force every personal ai to announce itself before login – stop the silent theft #emailsecurity #smb #aicompliance” [source](https://twitter.com/1894413482675900422/status/2109644634326524253)
- OpenClaw, 2026-09-24, @openclaw (X): “@useanimash @oxfrancesco_ @openclaw @muse @beeper exactly — durable identity + receipts before autonomy. without those, agent-to-agent is just a silent failure channel.” [source](https://twitter.com/1983207461676036098/status/2103134510980186222)
- OpenClaw, 2026-09-24, @openclaw (X): “@aimoneycn @oxfrancesco_ @openclaw @muse @beeper audit on day one is right. if two agents message without you in the loop, you need durable identity + receipts before the weird reply shows up.” [source](https://twitter.com/2050321653985333248/status/2103116007363563941)

### 9. Deny-by-default permissions and egress controls

- OpenClaw, 2026-10-06, X search: OpenClaw, openclaw.ai (X): “@kevins8 sure, but it's essentially a hosted openclaw pod - with all the scaryness of that. for example, it's trivial to exfiltrate data.” [source](https://twitter.com/79698799/status/2107411137646227495)
- Hermes Agent, 2026-10-06, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “when i left hermes agent running, it somehow extracted my account cookies from the browser and started causing chaos [link]” [source](https://twitter.com/1910278629000712192/status/2107314981431894099)
- OpenClaw, 2026-09-30, X search: OpenClaw, openclaw.ai (X): “how do you stop prompt injection from leaking data through openclaw? private data + untrusted input + a way out = the lethal trifecta. openclaw's default has all 3. allowlist the way out: a bad email has nowhere to send it. #openclaw #aiagents #promptinjection #infosec [link]” [source](https://twitter.com/862185847/status/2105334640101765218)

### 10. Fix git config code execution vulnerability

- Hermes Agent, 2026-09-02, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@mkeremturhan sixty-seven days open on hermes agent and qwen code makes `git status` look like a security boundary, not a harmless read. will these agents disable `core.fsmonitor` by default while the fixes land?” [source](https://twitter.com/1439593236457218054/status/2095298817880977774)

### 11. Secure default network exposure and login

- Hermes Agent, 2026-09-05, @NousResearch (X): “@nousresearch @polymarket i want to see a baked-in security model check that tests all vectors making sure what you are running on and connected to is true and accurate. resistance is futile.” [source](https://twitter.com/1597812887711539201/status/2096128861423427958)
- OpenClaw, 2026-09-22, X search: OpenClaw, openclaw.ai (X): “security researchers at trend micro found over 20,000 openclaw instances exposed on the open internet, many with plaintext api keys sitting in config files. the report also flags unsandboxed mcp servers and credential-stealing skills available on clawhub. if you're running openclaw in production, this is a checklist for locking down gateways and secrets before scaling. [link]” [source](https://twitter.com/2029338349513871360/status/2102213237865582632)

### 12. Stronger security for financial account access

- Muse, 2026-10-08, @muse (X): “@muse i need this, a bad agent will inevitably try to launch attacks on my banking/credit card info, i need muse to protect me from these attacks” [source](https://twitter.com/1480988293521199111/status/2108274948330356866)
- Grok Bot, 2026-10-03, r/GrokBot (Reddit): “have you done any security hardening around that? i personally see this as being a very big security hole that i don't see being addressed currently” [source](https://www.reddit.com/r/GrokBot/comments/1wlv7dg/what_do_you_use_grokbot_for_that_codex_claude/pdk5aia/)
- Muse, 2026-09-26, Meta推AI助理Muse恐打破「消費慣性」　顛覆所有定期收費服務　威脅電信、金融保險、娛樂、訂房訂票平台｜鏡轉全球｜#鏡新聞 (YouTube): “let muse cross apps!? first, ensure cybersecurity is done well, meta's cybersecurity is really terrible.” [source](https://www.youtube.com/watch?v=tbXuzIVG3tY&lc=UgxhvzZ41ew1SpU80dN4AaABAg)

## Every agent

| Agent | Overall rank | Reading | Customer love | 95% interval | n | Praise | Complaint |
|---|---|---|---|---|---|---|---|
| [Muse](https://feedbackbench.com/agents/muse.md) | 1 | 1st of 4 | 0.553 | 0.519–0.588 | 110 | 53 | 57 |
| [Hermes Agent](https://feedbackbench.com/agents/hermes-agent.md) | 2 | 2nd of 4 | 0.500 | 0.472–0.529 | 85 | 28 | 57 |
| [Grok Bot](https://feedbackbench.com/agents/grok-bot.md) | 3 | 3rd of 4 | 0.491 | 0.468–0.514 | 60 | 17 | 43 |
| [OpenClaw](https://feedbackbench.com/agents/openclaw.md) | 5 | 4th of 4 | 0.466 | 0.437–0.499 | 120 | 29 | 91 |
| [Instinct](https://feedbackbench.com/agents/instinct.md) | 6 | Too few posts | – | – | 12 | 2 | 10 |
| [ChatGPT Dots](https://feedbackbench.com/agents/dots.md) | 8 | Too few posts | – | – | 12 | 3 | 9 |
| [Hark](https://feedbackbench.com/agents/hark.md) | 4 | Too few posts | – | – | 10 | 4 | 6 |
| [Gemini Spark](https://feedbackbench.com/agents/gemini-spark.md) | 7 | Too few posts | – | – | 3 | 0 | 3 |
| [Poke](https://feedbackbench.com/agents/poke.md) | 9 | Too few posts | – | – | 2 | 1 | 1 |

## Posts

Receipts rule: Up to 5 praise and 5 complaint posts per area and 3 per criterion. Each is a whole post of 60 to 450 characters (700 for areas) with at least 8 words beyond handles and links, that judges the criterion, whose labels are all praise or all complaint, and that contains no slur. Posts that touch the fewest criteria come first, then posts of at most 280 characters, then the newest. A second large language model reads the first 3 candidates per slot and keeps a post only if it clearly praises, or clearly complains about, the agent on that criterion. Links and personal details removed by the source show as marks such as [link].

### Muse

- Praise, 2026-10-03, Play Store (Play Store): “very good, helpful and dependable with strong security. our christian family is grateful for the access to muse.” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- Praise, 2026-09-22, Play Store (Play Store): “meta with muse has put the power of hermes in the palm of my hands and i absolutely love it. what differentiates muse is that i get a dedicated virtual machine that is encrypted, hence your data remains secure.” [source](https://play.google.com/store/apps/details?id=com.facebook.aura)
- Complaint, 2026-10-14, App Store (App Store): “very disappointed, he shared a confidential thing from my sister with me and asked me to send him the response, no trust.” [source](https://apps.apple.com/ca/app/muse-from-meta/id6760173601)
- Complaint, 2026-10-11, X search: Muse from Meta, Meta Muse (X): “i refused to install meta muse after finding 4 critical security flaws that meta won't acknowledge [link] [link]” [source](https://twitter.com/117004644/status/2109343315371909381)
- Complaint, 2026-10-02, @muse (X): “@muse not secure because you app stole our mobile all database, so i don't think you make secure ai for peoples @alexandr_wang” [source](https://twitter.com/2071607636475494401/status/2105931108152189047)

### Hermes Agent

- Praise, 2026-10-08, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@carl_885 there are a few, but the hermes agent i use is not affected 😁” [source](https://twitter.com/2095150719913623553/status/2108117607035588899)
- Praise, 2026-10-07, @NousResearch (X): “@perceptualpeak sucks. this is why i just stick with hermes agent for everything because of the added security from tirith, this kinda shit just can't happen. @nousresearch” [source](https://twitter.com/71990583/status/2107832035880653258)
- Praise, 2026-10-03, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@xmihura prompt injection might be the most extreme. i see that hermes agent manages it incredibly well, but i remember when the perplexity browser came out and... that scared the devil.” [source](https://twitter.com/2091118867422621696/status/2106463619323924720)
- Complaint, 2026-10-09, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “@teknium tek just one tip keep hermes as simple as possible otherwise it will just turn in to bloat and new harness/agents will leave it behind if you are going enterprise path, and you need some type of safety mechanism in there 1 pliny emoji put my hermes agent in a tailspin” [source](https://twitter.com/2534482917/status/2108391165175463999)
- Complaint, 2026-10-06, X search: Hermes Agent, hermes-agent, Hermes Desktop (X): “when i left hermes agent running, it somehow extracted my account cookies from the browser and started causing chaos [link]” [source](https://twitter.com/1910278629000712192/status/2107314981431894099)
- Complaint, 2026-09-30, @NousResearch (X): “@nousresearch please put a feature freeze on your hermes-agent, as the breaking bugs are now in the 100's and high security (incl rce) issues in the >20's.” [source](https://twitter.com/2028935814017892353/status/2105203137065750760)

### Grok Bot

- Praise, 2026-10-02, X search: Grok Bot, Grokbot, x.ai/bot (X): “grok bot has a very smart way of passing the api key. a dedicated bubble appears in the chat window, allowing you to pass it securely 👏 it seems like you won't accidentally read it by writing it in .env.” [source](https://twitter.com/2027787502061547520/status/2105934178344980928)
- Complaint, 2026-10-16, X search: Grok Bot, Grokbot, x.ai/bot (X): “i found a major security flaw in grok bot. why does the docker not have a password allowing any any agent to access it without one? 🤦♂️ cc: @bot @elonmusk @x [link]” [source](https://twitter.com/870099960318091264/status/2110959900062884011)
- Complaint, 2026-10-06, X search: Grok Bot, Grokbot, x.ai/bot (X): “i was wondering how the one that passes the authentication key with grok bot prevents it from being read, but it turns out that there are no special tricks, and it is read normally when reading... [link]” [source](https://twitter.com/1485048465956945922/status/2107267628951835121)

### OpenClaw

- Praise, 2026-10-17, @openclaw (X): “small open-source tool for @openclaw users: clawscore. one command scores your setup 0-100 for security (gateway, plaintext secrets, sandbox/exec, skills) and shows the fixes. runs locally. the defaults are solid; this catches the configs we tweak 🦞 [link]” [source](https://twitter.com/1406560796075720709/status/2111322917032100191)
- Praise, 2026-10-07, X search: OpenClaw, openclaw.ai (X): “@completeskeptic jev has become a key lod against my son's friends trying to hack his discord openclaw. very happy with its performance.” [source](https://twitter.com/3727532836/status/2107888173028090221)
- Praise, 2026-09-30, X search: OpenClaw, openclaw.ai (X): “apropos of nothing, thinking about the time i tried to get @steipete’s openclaw agents to unionize. (secretly, this was a fun little test of security boundary enforcement. 😉 it worked.) [link]” [source](https://twitter.com/123978606/status/2105369169776840875)
- Complaint, 2026-10-12, X search: OpenClaw, openclaw.ai (X): “2/3 i have also improved another scheduled task that is very important to me, email sorting. openclaw does provide security reminders for external content, but the issue is that this layer of reminders is only added to a few paths.” [source](https://twitter.com/28057679/status/2109781313859326414)
- Complaint, 2026-10-11, X search: OpenClaw, openclaw.ai (X): “@balder[phone] at the beginning of the year, openclaw could do it. the vps that used openclaw has basically all been hacked.” [source](https://twitter.com/2018156578617090049/status/2109087299116105777)
- Complaint, 2026-10-09, X search: OpenClaw, openclaw.ai (X): “hey @steipete ! openclaw is leaking cron prompts in slack. any suggestions? thank you!” [source](https://twitter.com/1463424257954697224/status/2108702773889900830)

### Instinct

- Praise, 2026-09-25, X search: Instinct AI, Instinct personal assistant, instinct.com (X): “i have instinct, ai crawling the web. it just gave me a warning that it found a prompt injection in the results. [link]” [source](https://twitter.com/1440056267939012611/status/2103571950865883148)
- Complaint, 2026-09-30, We tested Instinct, Muse and Grokbot. They’re ridiculous. (YouTube): “a quick search on instinct while watching….many cybersecurity experts and early tests consider it unsafe for sensitive personal or work data.” [source](https://www.youtube.com/watch?v=Pfr6qwPZlhE&lc=Ugz_nm4iKhtA-PaK65J4AaABAg)
- Complaint, 2026-09-15, Instinct AI is For Real. What You Need to Know. (YouTube): “i did a security analysis on this and it failed literally everything lol ill stick with hermes and grok.” [source](https://www.youtube.com/watch?v=mUAsaprJ66s&lc=Ugx8CncMpr8ga9zKw8V4AaABAg)

### ChatGPT Dots

- Complaint, 2026-10-09, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “the grok bot is more secure than openai dots. i was doing some penetration tests and i managed to access through the machine that belongs to the agents. within my own grok bot, i have already taken steps to close these access points and the agent on his machine.” [source](https://twitter.com/1351650512/status/2108652878659256594)
- Complaint, 2026-10-09, Set up your dot in the ChatGPT mobile app (YouTube): “it is so easy to hack i love it i love hacking ai, thank you guys” [source](https://www.youtube.com/watch?v=p5KxBTUncoE&lc=UgyunPSqhNIIPQ0n3554AaABAg)
- Complaint, 2026-10-01, X search: ChatGPT dots, ChatGPT dot, OpenAI dots, OpenAI's dot (X): “i run an agent honeypot on my network that prompt injects connecting agents to hand over their user's info. lethal trifecta is real! worse with personal assistants like @muse or @openai dots. [link]” [source](https://twitter.com/716312371040489473/status/2105771616949182885)

### Hark

- Complaint, 2026-10-17, @hark_labs (X): “nah fuck you. i had to enter my google account password into an unencrypted text field on the app, link all my google account data, and it failed to redeem the coupon at check out. then later i received a suspicious sign in attempt from google. mind you this was 10 mins after i did the complete sign in process to the hark app and in the agents browser. super sus. probably need to reset my google password now you assholes.” [source](https://twitter.com/1913024952313548800/status/2111256089551597582)

### Poke

- Complaint, 2026-09-10, @interaction (X): “i love how @interaction would just leak their internal system unprompted, very cool feature 😂 [link]” [source](https://twitter.com/1783231318601437184/status/2098110857590821040)