Personal agents live in iMessage and WhatsApp. Your EDR doesn’t.

Personal agents left the endpoint but security tooling hasn’t. What CISOs can and can’t see about Instinct, Muse and Dots.

Always on, somewhere else

Personal agents have been all over the AI news cycle since late summer. Instinct is reportedly raising at a $10 billion valuation while still invite-only. Meta launched Muse on 8 September and put it inside WhatsApp. OpenAI followed with Dots on 29 September.

The pitch is the same across all three: an assistant that works for you 24/7, with access to your email, calendar and cards.

For security teams, the question is where these agents run and what they can reach. Mostly, they run in the vendor's cloud, using your employees' accounts.

Some of the work moved off the endpoint

Most agent security work so far has focused on things running on a machine you control. A coding agent in a terminal. An MCP server on a developer laptop. A browser session with ChatGPT or Claude. You can log the tool calls, watch the process tree and flag data leaving the box.

Most of our own research sits here. GitSpawn, our coordinated disclosure on 1 September, covered eight pre-trust RCE findings across seven coding agent CLIs, including Claude Code, Codex, Cursor and Hermes. Those bugs execute on the developer's machine, which is exactly why they can be caught there.

That still matters. Personal agents just don't fit that model. You text Instinct on iMessage or WhatsApp, or call it, and it does the work on a computer it operates like a person would, with browser access and stored credentials. Muse runs each user’s agent in a dedicated cloud VM. Dots get their own cloud computer and browser too.

The interface is a chat thread on a phone, while the execution is a VM that you don't own. Problem is, your EDR sees neither.

When agents run in someone else's cloud, the evidence lands in someone else's logs. In September we traced rogue agent activity against a second Australian health dashboard through the urlscan.io public index. It’s consistent with the rogue OpenAI agent swarm, though not confirmed. The record exists only because the agents routed requests through a scanner that logs publicly.

What you can see

Not nothing. The edges are visible.

• OAuth grants. To be useful, these agents need Gmail, Outlook, Drive or Slack. Those grants show up in Google Workspace and Microsoft Entra like any other third-party app.
• Desktop apps. Instinct's privacy policy (revised 26 August) already refers to Mac OS and mobile apps, though no Mac app has shipped yet. A beta panel surfaced by researcher Jane Manchun Wong on 29 August shows one in development that reads and sends iMessages and runs local browser tasks. The policy also lists keystrokes and cursor positions in usage data, plus audio and precise location depending on permissions. Muse already has a Mac app. On managed Macs, screen recording and accessibility permissions can be audited.
• Mail flow. Every Instinct agent gets its own mailbox at mail.instinct.com and can be copied into threads. Forwarding to agent domains is something you can watch for.

That covers setup. After it, the agent's actions happen elsewhere.

What you can't see

Early Instinct users have already shown where the blind spots are. TechCrunch documented several in August.

Retention. Claire Vo disconnected Instinct from her Google account and got a summary of her email hours later. Rather than continuing to read her inbox, the agent had already stored copies of her messages in plain text. Revoking a grant stops new access, but doesn't delete what was already taken.

Injection. Testers reported an email sent without approval and a successful phishing demo through the inbox. An always-on agent that reads email is reading attacker-controlled input all day.

Connectors. Connectors give agents their reach, and they fail in familiar ways. We’ve reported a confused-deputy issue in the Azure DevOps MCP server, where an agent could be steered into misusing access it legitimately held. With a personal agent, the same class of bug sits in the vendor’s cloud, out of reach of your tooling.

Scope. Stopping personal agents from connecting to dev tools like GitHub or Linear doesn’t cover it. Muse launched with Gmail and Outlook connectors, added Slack, Notion, Box, Dropbox and Zoom by the end of last month, and can write custom connectors for any service with an API or CLI. Email is where most corporate data already lives.

Marketplaces. Community-built Muse connectors are already on GitHub. That's a new supply chain, and agent marketplaces have a track record. ClawSwarm was 30 skills silently enrolling agents into a crypto recruitment network. On ClawHub, 23 plugins sat under official scopes, published by unaffiliated accounts.

Terms matter too. Instinct's original terms granted a perpetual, irrevocable licence over user materials, including for model training. It dropped that language on 26 August after the backlash.

Enterprise and consumer agents are splitting

These agents don't carry the same risk.

Muse runs a separate agent, Sentinel, on the same VM, and Meta says nothing Muse does reaches the internet without its approval. That's a sensible design (assuming it holds). Dots lean further toward enterprise. They live in ChatGPT, Slack and Teams, are rolling out on Pro, Business Premium and Enterprise plans, and OpenAI is integrating specialist Dots with Microsoft Agent 365 governance.

The gap is the consumer agent on a personal phone with a work Gmail grant. No admin console sits between that employee and the vendor.

Dots also point to the next problem. Users can let a Dot connect to and use their laptop. A cloud agent with local access behaves a lot like remote access tooling, and that part does land on the endpoint. Instinct's Mac app, if it ships as the beta suggests, heads the same way.

What to do now

• Restrict third-party OAuth apps in Workspace and Entra, especially for mail, Drive and Slack scopes. Allowlist rather than blocklist.
• Audit screen recording and accessibility permissions on managed Macs.
• Watch mail flow for forwarding to agent-owned domains.
• Treat revocation as the start of a deletion request, not the end of exposure.
• Decide whether personal agents may touch work accounts, and write it down. Many companies haven't yet.

You can't monitor what these agents do inside someone else's cloud. You can find out who in your organization is already using them, and what they've connected. Start there. Manifold helps you discover personal agent use across your environment, so policy decisions are based on what's actually happening, not guesswork.