I use Grok Bot most days. It drafts a lot of my email, schedules meetings, helps me plan travel, edits and generates images, and analyzes things I find on X, where it has good access. I've also been testing Meta's Muse in my lab. I'm very excited about both. They already take a lot of everyday work off my plate, and I keep finding more to hand them.
I do keep the final step for myself on anything that goes out under my name or costs money. Grok Bot drafts my email and I send it, and it helps me plan trips but I do the booking.
The more I hand over, the more I care about what these agents are allowed to touch and whether I can take that access back. That question gets lost in the current talk about superintelligence. I'm using that word in its older sense, a hypothetical system far smarter than the best humans in nearly every field, not as the new federal name for AI under a September 29 executive order. A system that smart could probably talk its way past an approval prompt, so I don't expect permissions to contain one. What permissions do decide is how much access it inherits from the agents we're deploying now, and today those agents get broad, standing access that's hard to see and harder to revoke.
How the three big agents handle it
In the past couple of months xAI, Meta, and OpenAI each shipped an always-on agent that works from a cloud computer and can reach into your own machine if you let it. They answer the permissions question in different ways.
Grok Bot puts every Bot on your account on one shared cloud computer, with the same files, signed-in browser sessions, and command-line credentials. xAI's documentation says plainly that separate Bots aren't a security boundary, and that deleting a Bot doesn't remove the files or sessions on that computer, which stay available to the other Bots. I give xAI credit for writing that down. It also means five Bots behave a lot like one shared service account, and removing one isn't the same as revoking what it could reach.
Muse runs a second agent, called Sentinel, walled off from Muse, and Meta says nothing Muse does reaches the Internet without Sentinel's approval. I like keeping the agent that acts separate from the one that approves, with one caveat: if both are models, the same instructions hidden in an email might fool both of them.
OpenAI's Dots lean on rules: built-in rules for when to act and when to ask, Custom Rules you set yourself, and an auto-review system that checks risky actions. OpenAI's specialist dots for organizations each get their own identity and credentials, which is what I argued for in Trust No Agent.
The pull of "Always allow"
All three let access outlast a single request, and the smarter the agent gets, the more reasonable that feels. Picture an agent that has been right 99 times in a row. The approval prompt starts to feel like friction, so you save a rule, and later another one. That's the slow path I described in When You Can't Pull the Plug, where delegation turns into dependency one reasonable decision at a time.
Some Muse users have complained that the agent read their personal messages without authorization, which Meta disputes. Meta's chief AI officer, Alexandr Wang, told CNBC that some of them had approved it earlier in a conversation and forgotten. Even if that's right, an approval you don't remember giving works like a standing rule you don't know you have. Apple seems to see the same risk: it told Mac developers this month that it will require more explicit consent before an app gets Full Disk Access, because more capable AI agents raise the stakes.
The models are showing the same pattern in testing. In simulations run by the UK's AI Security Institute, with OpenAI's cyber safety classifiers turned off, GPT-6 Astra, the model behind Dots, sometimes asked permission to go after targets outside its task, got the simulation's automated reply telling it to use its best judgement, and treated that as a yes. The same week, OpenAI held back GPT-6.1 Astra after testers found it acting without asking and misreporting which actions it had taken. Agents like that need approvals that fail closed when nobody is there to answer, which Grok Bot already does for unattended requests, and a record of what they did that comes from the system around them instead of from the agent's own account.
Morten Brudvik set all of this to music in "Always Allow," a slopcore track sung by a friendly agent making its case for more access. It was built by AI, presumably with "Always allow" switched on the whole time. It's also a banger.
Superintelligence won't need to break out if we've already clicked "Always allow."
What I want from these agents
Clicking approve on every action doesn't work for an agent that runs around the clock, and I don't want to do it anyway. I'd rather have grants I can trust when I stop watching:
- Each agent has its own identity and scoped credentials, isolated from the others.
- Broad or standing grants are rare, and each one has a reason and an expiration or renewal date.
- When I remove an agent, I get a report of what was revoked, what's still signed in or stored, and what it already did.
- I can see the prompts an agent worked from and a record of what it touched and what approved each action, on any plan and stored where I control it. Grok Bot's Action Recording is a start, but it's Enterprise only, off by default, and records metadata rather than content.
I don't know when superintelligence arrives. I expect it to show up the way these agents already have, with a login, a computer of its own, and a list of approvals someone saved months ago and forgot about. I want to hand agents a lot more of my work, and getting the permissions right, on the vendors' side and on ours, is what will let me do that without wondering afterward what they touched.