Securing Personal AI Agents: Governance for Grok Bot, OpenAI Dots, Meta's Muse, and Instinct

In under two months, four personal AI agents went from launch announcements to employee laptops. xAI opened Grok Bot in beta on August 11. Instinct launched invite-only in August. Meta released Muse on September 8, and OpenAI introduced Dots at DevDay on September 29.

These agents run around the clock, sign into the apps people already use, and act without waiting for a prompt. Through OpenAI's plugins, Dots can work across more than 4,000 apps. Muse can send email, book travel, fill out forms, and complete a checkout on a person's behalf.

Today, Akto is extending Akto Atlas to cover personal AI agents. Security teams can now see which personal agents employees have connected, what each one can reach, and stop sensitive data from leaving through them.

Personal agents won't stay personal

Employees won't keep these agents to personal errands. Someone who uses an agent to plan a trip will soon ask it to clear their calendar, draft a customer follow-up, or chase an expense report. The vendors are pushing the same way: people can already message Dots through Slack and Teams, OpenAI plans specialist Dots with their own work identities and credentials, and Grok Bot has an enterprise waitlist open.

To do that work, the agent needs the employee's access. Muse asks for email, calendar, browser activity, and purchase history. Instinct asks for email, messages, screen, audio, and location.

Once an employee connects a work account, the agent can read everything that employee can read: customer records, contracts, credentials, and source code. And because most of these agents start on a personal subscription, the security team never sees the connection being made.

We've seen this before with OpenClaw and Hermes

Akto has already watched this happen. When OpenClaw and Hermes launched, Akto Atlas discovered thousands of employees across customer environments already running them, long before most security teams knew either agent existed.

OpenClaw and Hermes were open-source tools that individuals chose to install. This time the agents come from OpenAI, xAI and Meta, ship inside subscriptions people already pay for, and will reach far more employees.

The problems with personal agents at work

Personal agents bring five problems that existing security controls were not built to handle.

They arrive as shadow AI. Employees sign up with personal subscriptions and connect work accounts on their own, so the agents span personal and workplace systems before IT approves anything.

• Agent actions look like human actions. An agent that signs in with an employee's password or session token shows up in the logs as that employee. Security teams cannot tell whether a person or an agent sent the email or pulled the CRM export, and cannot cut off the agent without locking out the person.

• Credentials leave your control. To finish a task, an agent needs access, and the quickest fix when it stalls is to hand it more: a personal access token, a cloud API key, an admin login. Those secrets then live in the vendor's cloud, where your vault policies and rotation schedules do not reach.

• Prompt injection is unsolved. An agent cannot reliably tell its owner's instructions from instructions hidden in an email, document, or web page it reads. Meta says plainly that Muse isn't immune to attack, and OWASP ranks prompt injection and sensitive data exposure among the top risks for AI agents.

• The agents themselves have flaws, and revoking access is not enough. Weeks after launch, a researcher showed that a local app could change a hidden Muse setting, redirect its dictation traffic, and steal the account's authentication token. One Instinct tester found it still summarizing her inbox hours after she disconnected Google, because it had kept copies of her emails in plain text. Once data reaches an agent, cutting the connection does not bring it back.

Banning these agents did not work for SaaS or ChatGPT, and it will not work here. Security teams need to see the agents, understand their reach, and control the data that flows through them.

Akto Atlas for persistent personal AI agents

Akto Atlas now inventories every personal AI agent your employees use, including Dots, Grok Bot, Muse, and Instinct, alongside the AI agents, MCP servers, skills, and GenAI tools it already tracks across browsers, IDEs, and desktops. Security teams get one list of every agent in the company, and controls that work where employees actually use them: on the device.

• One inventory for every agent. In Agentic Assets, Muse, Grokbot, Dots and Instinct appear next to Cursor, Claude CLI, MCP servers, skills and plugins. Each comes with a risk score, the sensitive data types seen in its traffic, and the users and devices behind it.

Personal accounts are flagged and controlled. Any agent an employee reaches with a non-company account gets a "Contains personal account" badge, and guardrails can restrict sign-ins to company-approved accounts.

• Sensitive data is stopped on the device. You define policies once in Akto, and Atlas Guardrails evaluate them locally in the browser extension, the AI Endpoint Shield, and IDE hooks. PII, secrets, and source code are redacted or blocked before they reach an agent, so the data never lands in a vendor's cloud in the first place.

• Risky tool calls are blocked. The same guardrails stop destructive shell commands, unvetted MCP tools, and file system access an agent should not have.

• Every decision is on record. Atlas ships with more than 20 built-in policies, and every allow, redact, or block decision is logged in the Akto dashboard with user and device context.

Employees keep using the agents they like, and sensitive data stays on the device.