Personal AI agents · 2026
How does your agent handle your private data?
A personal agent signs in to your accounts, reads your screen, and sends, books and buys in your name. We grade it twice, both from what the company publishes. Agent Safeguards grades the protections it says the agent has for the access you give it. The Policy grade is the same six-question grade every company on this site gets, read from the policy that governs the agent.
It holds your keys
Passwords, sign-in sessions and payment cards for other services, not only its own.
It sees your screen
Computer-use agents take screenshots and keep logs of what they do.
It acts in the world
What it sends to websites and people leaves its company’s control.
Most common gap: 12 of 13 agents score 0 on Capture. Five never say how long they keep what they capture; seven use it for training or human review by default.
| Agent | Acts as you | A1Logins | A2Capture | A3Memory | A4Runs | A5Exit | Agent Safeguards |
Policy gradegoverning policy |
|---|---|---|---|---|---|---|---|---|
| Underdog | EmailCalendarMeetingsDictationWeb loginsPayments |
1 | 2 | 1 | 2 | 1 | 7/10 | C6/12Conway Research |
| Claude Cowork | FilesConnectorsScreenWeb logins |
1 | 0 | 2 | 1 | 1 | 5/10 | B10/12Anthropic |
| Siri AI | In-app actionsScreenMessagesEmail |
1 | 0 | 1 | 2 | 1 | 5/10 | A11/12Apple |
| Perplexity Computer | EmailFilesWeb logins |
2 | 0 | 1 | 1 | 0 | 4/10 | C8/12Perplexity |
| Muse | EmailFormsWeb loginsPayments |
2 | 0 | 1 | 0 | 0 | 3/10 | C7/12Muse’s own policy |
| Town | EmailCalendarSlackMeetings |
1 | 0 | 1 | 0 | 1 | 3/10 | C7/12Town.com |
| Hark | EmailWeb loginsPayments |
2 | 0 | 1 | 0 | 0 | 3/10 | C7/12Hark Labs |
| Hermes Cloud | EmailMessagesTerminalWeb loginsPayments |
1 | 0 | 1 | 0 | 0 | 2/10 | D4/12Nous Research |
| Dots | 4,000+ appsSlackWeb logins |
1 | 0 | 1 | 0 | 0 | 2/10 | B9/12OpenAI |
| Tab | MessagesPhone callsWeb loginsPayments |
2 | 0 | 0 | 0 | 0 | 2/10 | C6/12Terrasoft |
| Tasks in Gemini | EmailDocsWeb loginsPayments |
1 | 0 | 1 | 0 | 0 | 2/10 | C6/12 §Google, Trains AI 0 for this agent |
| Grok Bot | FilesTerminalWeb logins |
0 | 0 | 0 | 0 | 0 | 0/10 | D4/12Cursor (Anysphere) |
| Instinct | EmailMessagesScreenLocationPhone callsWeb logins |
0 | 0 | 0 | 0 | 0 | 0/10 | D3/12Spear Street Technology |
Sorted by Agent Safeguards. Red chips mark access to money or to logins for other services. Policy grade shows the grade of the policy that governs the agent, which is not always the brand’s own. § marks an enforcement deduction.
Every cell is stated: read from the company’s own published pages, not tested by us. Each agent’s page shows the fact, source and date behind every cell. An agent never moves its company’s grade, and its grades never fold into the company’s.
Self-hosted tools
These run on your own computer. No company holds your data, so there is no policy to grade. We show the facts instead, with no score.
OpenClaw
- Where your data lives
- Plain files on your computer: credentials in
~/.openclaw/credentials/, transcripts in~/.openclaw/agents/. - Encryption at rest
- None built in. The docs recommend full-disk encryption.
- Retention
- Nothing is deleted automatically. The docs tell you to prune old transcripts.
- Where prompts go
- The model provider you choose: Anthropic, OpenAI, or a local model.
- Security record
- 10 advisories published 11 Sep 2026, 2 of them High. Trail of Bits audit completed 21 Sep 2026.
Sources: OpenClaw — Security, secrets and storage ↗ · OpenClaw — Gateway security ↗ · OpenClaw — Privacy ↗
Hermes Agent · Nous Research · self-hosted
- Where your data lives
- Files on your computer under
~/.hermes/: sessions instate.db, memory in two Markdown files, API keys in.env, saved logins and cards invault/. - Encryption at rest
- Only saved logins and cards are encrypted. Sessions, memory and the key file rely on your own disk encryption.
- Retention
- Ended sessions are deleted after 90 days by default; you can switch this off. Memory stays until you remove it.
- Where prompts go
- Only to the model provider you choose, with no telemetry. If that provider is Nous Portal, see Hermes Cloud’s Policy grade (4 · D).
- Security record
- 10 advisories in the last 12 months (1 High). 2 advisories list no patched version (affected ≤ 0.19.0; current release 0.22.2). No published audit.
Sources: Hermes Agent docs — FAQ ↗ · Hermes Agent docs — Credential vault ↗ · Hermes Agent docs — Sessions ↗ · GitHub Advisory Database — hermes-agent ↗
Watching
Announced or in early access. We grade a product once it is open to the public and a policy covers it.
How agents are graded
Each cell scores Best (2), Moderate (1) or Restrictive (0), read only from the company’s own published statements, with the same criteria for every agent. Agent Safeguards is the plain sum, out of 10, with no cap and no label. The Policy grade uses the company rubric, read from the policy that governs the agent.
A1Logins
What happens to passwords, sign-in sessions and payment details when the agent logs in for you.
- Best (2): the model never sees credentials and the company says it does not keep them in a form it can read; any kept sign-in session has a delete control you can see.
- Moderate (1): credentials or sessions kept on the company’s servers, out of the model’s view, with a delete control, but no stated expiry or protection.
- Restrictive (0): kept with no stated protection, or they survive deleting the agent, or the model can see them, or the policy is silent while the product logs in for you.
A2Capture
Screenshots, screen reads, recordings and action logs the agent makes while it works.
- Best (2): not kept past the task, or kept only on your device, stated plainly; no training; no human review.
- Moderate (1): kept with a stated retention period and a delete control; not used for training or human review by default.
- Restrictive (0): human review or training by default, or no stated period, or not disclosed. A computer-use agent captures the screen by design, so silence scores 0.
A3Memory
Whether you can see and remove what the agent remembers.
- Best (2): view and delete item by item, memory can be turned off, and deleted memory follows a stated purge timeline.
- Moderate (1): delete everything at once only, or item-level control with no stated timeline.
- Restrictive (0): removable only by deleting the account, or how memory is kept is not disclosed.
A4Where it runs
Where your data is processed and stored while the agent works.
- Best (2): the model and its actions run on your device by default, or cloud processing is stated to keep nothing; any cloud fallback is disclosed and limited.
- Moderate (1): a cloud environment per task or session that the company says is destroyed when the task ends, or local running is your choice.
- Restrictive (0): a standing cloud computer holding files, sessions and history with no stated retention limit, or the company never says where the agent runs.
A5Exit
What happens when you delete the agent, or the company shuts it down.
- Best (2): deleting the agent removes everything it holds on a stated timeline, and you can export your agent data first in a usable form.
- Moderate (1): complete deletion with no stated timeline, or partial export. An agent that keeps its data on your device can reach 1 without an export tool.
- Restrictive (0): deleting the agent leaves data behind, or no export exists.
Agents change fast. Every page an agent cell cites is checked daily for changes. Each agent gets a full review every 90 days, every 30 days in beta, and within 7 days of a launch, a move out of beta, a rename, a shutdown or a new feature that touches a cell.