Personal AI agents stopped being a demo this month. Meta shipped Muse on September 8, in its own app and inside WhatsApp. Instinct, the assistant you text or call, has raised $350 million, is in talks for a billion more at a $10 billion valuation, and added phone calls this week. Both will plan your trip, chase a refund, and book the table.
I've been running my own for six months. Three of them, on a Mac mini in the basement, built on nights and weekends. BCOS is a chief of staff for work: I forward it a data room and it runs the diligence modules I've built, then drills into whatever I ask next. Noble runs the rest of my life: it's planning my wife's 50th right now, and it makes the phone calls I don't want to make. Froggy keeps the books for the club where I'm treasurer. I reach all three by email or text. They carry projects across weeks. None of them lives in an app I have to open.
I built them because I wanted a view on this category worth more than a market map. This morning I gave Muse the same three jobs Noble is carrying. Here's how the launches read from six months inside one.
1. The Assistant Has to Come to Where the Messages Are
The problem with ChatGPT and Claude as assistants was never the models. It's that every use required leaving. I live in email and text. To get help, I had to copy the email, open the app, paste it, import the attachment, explain what it was, and pick the right conversation, because the vacation thread isn't the camp thread, and the camp thread isn't the hockey thread. Then carry the answer back. Each step is small. Together they're a tax on every interaction, and they're why most people's AI use stays at "ask a question" instead of "hand something off."
A human assistant doesn't work that way. You forward something, and it gets handled. You can be terse, because they have the context; forward an old thread with nothing but "status?" and they know what you mean. That's the bar. BCOS started as a shortcut, forwarding a deal email so I wouldn't have to paste it into Rudie, my custom sourcing system, and then realizing that once it had the email, it could run the diligence too. The rule became: forward everything, and it handles whatever it has the context for. It runs on a machine that's always on. It works over text when United's wifi can't load a chat app. Forwarding is the entire user interface.
Everyone serious has converged on this. Instinct is a phone number, and as of last week, an email address. Muse is a text thread that lives in WhatsApp, which is the same move I made when I put Noble on Telegram, except Meta owns the app with three billion people already in it - a frictionless change in user behavior. The companies that don't fit this shape are the labs. Their product is an app you come to, and their scoreboard is time spent in it. An assistant that works is one you open less. A good week with Noble is a week I barely thought about it. Nobody inside a company valued on engagement ships the product that shrinks it.
2. The Unit of Value Is a Loop, Not an Action
A reservation is one action. It's also the demo everyone leads with, and I understand why: it's legible, it's universal, and it's hard. I tried to wire OpenTable and Resy into Noble, and both were dead ends, because bot detection treats an agent booking a table as an attack, which, from the platform's side, it is. Noble makes phone calls instead. Now so do Muse and Instinct.
But an assistant's value isn't in the action. It's in the loop. My wife's 50th is this week. I wanted quotes from a taco truck, a caterer, and the grocery store that does good platters: three calls and web forms that sat on my list for a week. Noble sent all three. One came back as a PDF; Noble pulled the terms out, filed them against the party, and compared them with the grocery store's public pricing so I could see the tradeoff. The date and every vendor's order cutoff are in front of it. Having AI write the emails was solved a year ago. Having something hold the project for three weeks so I don't have to is the product, and it's harder, because the hard part is state, not action.
Some loops have no end date. Froggy watches the club's books. The monthly financials get pushed to it, it updates the cash forecast when they land, and it flags a balance heading somewhere I won't like. When the finance committee asks how current assets compare with the last two years, I text Froggy and have the answer during the meeting. That was never a task I handed off. It's a job I no longer have to pick up.
The three jobs I gave Muse this morning- a vacation, the birthday, a car purchase- are all loops. It started each the way I would have: a plan, then outreach, then waiting on the world. Whether it still knows where everything stands in October, without me re-explaining, is the test that matters. Booking gets people in the door. Loops are why they stay.
3. The Agent Has Your Name on It
Here's the thing six months taught me that no demo will. BCOS has been easy to build because nothing it does leaves the building. I can break it, fix it, and nobody knows. Noble is different. When it emails a caterer or calls a dealership, it's me. If it fails, my name is on it. At Canaan we weigh every hire on more than ability and curiosity; we weigh how they'll carry the firm, because whoever talks to a founder on our behalf is Canaan in that moment. An agent acting in the world is the same thing.
The public version of this happened last month, when a VC's Instinct agent spent days hitting Resy's API 200 times an hour trying to land a table at 4 Charles, and Resy deactivated his account and canceled every reservation on it. Notice whose account was banned. Not the Instinct agent’s account. His.
So the path to letting software act for you is a ramp, and it runs in four steps: read this, draft that for me to send, send it, call them. Six months in, I'm still at "draft that for me to send" with my own assistant, and I've decided BCOS never goes past it. Then this morning, within the first half hour, I let Muse contact vendors for the party in my name. While I was writing this, one of them called me back. It went fine.
That taught me something about the ramp. It isn't graded by task type. It's graded by whose opinion of you is on the line. I'll let an agent talk to a taco truck the day I meet it. I'll never let one talk to a founder. Good product design compresses the low-stakes end of that ramp far faster than I expected, and Muse's design is good: it asked for what it needed when it needed it, and did the work with what I gave it. The high-stakes end is where the real business is, and nobody has built it yet.
4. Trust Is Two Things, and the Two Big Bets Split Them
Every serious pitch in this category eventually wants your email, your messages, your calendar, your cards. That's where the context is. It's also the most sensitive thing a person owns. Whether people will hand it over is the wrong question, because trust here has two parts: whether you'd give it to a company at all, and whether the company can keep it safe once you have. The first is a brand problem. The second is an engineering problem.
I know the second one is solvable because I solved it by hand. BCOS can't send or receive mail from anyone but me, enforced by our email provider; changing it would take Canaan's IT team, not a settings screen. Noble and Froggy have their own addresses (and guardrails at the Gmail account level) and act only on what I send them. I gave each one a role. I didn't give it my life. Some work email should never touch an AI, and a separate address makes that trivial. I don't trust a permissions dialog. I just don't forward the message.
Meta's bet is that engineering can carry the brand. Each Muse runs on its own isolated machine in the cloud. A separate agent Meta calls the Sentinel has to approve anything before it reaches the internet. The agent can't see your passwords or payment methods. Conversations are walled off from the ad systems, and a version even Meta can't read is promised for later this year. And it didn't ask me to connect anything. I still haven't. Every one of those is a boundary I'd put in my own build list, and they're being built by a security organization rather than a weekend. The liability is the record: the 2011 FTC settlement, the $5 billion penalty in 2019, the 2023 charge that it violated the order, passwords found in plain text. The question for Meta isn't whether people will give it their data. It's whether the wall holds once the business wants what's behind it.
Instinct's bet is the opposite: a startup with no legacy to distrust, reached through a phone number, moving fast. The liability is that a startup starts with neither half of trust. There's no brand to lean on, no security org, and the pressure to ship connectors runs directly against building walls. Early users found terms asking for a perpetual, irrevocable license to their materials for training, and the backlash was immediate. But starting from a fresh brand on trust may very well be a huge advantage - it will be fun to see this play out.
The interface question is settled. The trust question is just starting, and what a person will let software do in their name is the axis this category now competes on.
I'll keep running mine, because it's useful, because it's fun, and because it's the only way I know to have a view on this market worth more than a market map. And I'll keep pushing theirs. Muse has the party this week and the car after that. Instinct gets the same jobs the day my invite arrives. The point of building your own isn't that it's better. It's that you know exactly where to push.