Module 4

Always-on AI Agents

Most AI tools wait for you to ask. Always-on agents keep working in the background: they watch for events, follow routines, remember your goals, and bring you finished work, while asking for approval before anything consequential.

About 30 minutes1 Python exampleBeginner to intermediate

From reactive assistants to always-on agents

In the earlier modules, an agent starts when you send a request and stops when it answers. An always-on agent is persistent: it has a lasting identity and memory, it can be woken up by things other than your messages, and it can work for hours or days on your goals. Several companies launched products of this kind in 2026, often describing them as AI teammates or personal agents.

The four always-on agents covered in this module, shown as characters: Dot (OpenAI), Muse (Meta), Grok Bot (xAI), and Instinct.
Reactive assistants compared with always-on agents
Reactive assistantAlways-on agent
Starts whenYou send a messageA schedule, an app event, a message, or its own background check
Works forOne answerOngoing projects, often several in parallel
RemembersThe current conversationYour goals, preferences, and past feedback
Works inA chat windowConnected apps and often its own cloud computer
Main riskA wrong answerA wrong action taken while you are not watching

How an always-on agent works

The products below differ in detail but share the same building blocks. Press Play to follow one cycle.

Triggers

Schedules (routines), events in connected apps, your messages, and read-only background checks for ways to help.

Persistence

Long-term memory of goals and preferences, and a workspace that survives between tasks, such as a dedicated cloud computer.

Control

Permission rules, approval requests, an activity log you can inspect, and the ability to pause or redirect the agent.

Examples

Descriptions below are summarized from each company's official product page at the time of writing. Features, availability, and pricing change often, so check the linked pages for current details.

OpenAI

dots

Announced September 29, 2026, as "always-on agents" in ChatGPT, powered by GPT-6 Astra. Each dot has its own cloud computer and browser, connects to apps through plugins, and learns preferences from feedback. You can message or call it in ChatGPT, Slack, or Teams.

  • Proactive: "proactive research" in the background, using connected apps through read-only tools.
  • Control: Custom Rules to allow, require approval for, or block actions; an Activity View; sensitive tasks such as changing a password always stay with you.
  • Teams: "specialist dots" with their own identity for organizational roles, starting with enterprise pilots.

Introducing dots

xAI

Grok Bot

Described as "AI teammates" that sign in to your tools, use them as you would, and return finished work. You give tasks from the desktop app (macOS or Windows) or the iOS app, and can run several Bots in parallel, around the clock.

  • Proactive: routines on a schedule; you can show a Bot a workflow once and it saves it as a routine.
  • Persistence: Bots share one persistent cloud computer per user and keep memory that improves over time.
  • Control: Bots come back when approval is needed, and sensitive actions can go through an automatic review first.

Grok Bot

Instinct

Instinct

A personal assistant with no new app to learn: you text it or call it. The company says it understands what you are working on and can use a phone and a computer the way you do, with examples such as ordering groceries, booking a train, and sending flowers.

  • Interface: text messages and phone calls.
  • Note: the product page does not describe how background work, approvals, or permissions are handled.

instinct.com

Meta

Muse

Meta's "personal AI agent." You chat with it in the Muse app on mobile or Mac, or in WhatsApp. It connects to apps such as email and calendar, and can build its own tools when a task needs one.

  • Proactive: turns a goal into an action plan, tracks progress, and suggests ideas.
  • Persistence: Muse Secure VM, a persistent, isolated Linux computer with a browser that you and the agent share.
  • Control: approval before actions such as sending emails or making purchases, a complete audit trail, a credential store the agent cannot read, and one-time card numbers at checkout.

Muse

Common design choices

Design choices shared by always-on agents
Design choiceWhy it mattersSeen in
A dedicated cloud computerThe agent can work while your laptop is closed, and its work stays separate from your own machine.dots, Grok Bot, Muse
Meeting you where you areChat apps, workplace tools, messaging, and phone calls replace a new interface.dots, Grok Bot, Instinct, Muse
Read-only background workProactive help without the risk of unapproved changes.dots
Approval for consequential actionsSending, paying, and sharing stay under human control.dots, Grok Bot, Muse
Inspectable activityAn activity view or audit trail makes background work accountable.dots, Muse
Protected credentialsPasswords and card numbers are used without being exposed to the model.dots, Muse

Try it: a day in the life of an always-on agent

This simulation runs one working day. Triggers arrive from a schedule, email, the calendar, and a background check. The agent decides what to do using its memory, and every action passes through permission rules. Input: timed events. Output: actions taken, approvals waiting for you, updated memory, and an activity log.

"""An always-on agent: triggers, memory, and permission rules

Always-on agents do not wait for a prompt. They wake up on triggers
(a schedule, an event in a connected app, a new message, or their own
background "proactive" check), decide what to do using their memory of
your goals, and then act within permission rules: some actions run
automatically, some need your approval, and some are blocked.

This example simulates one working day in a few milliseconds.
Inputs:  a list of timed events (emails, calendar changes, schedule ticks)
Outputs: what the agent did, what it asked you to approve, and an activity log

Illustrative: decide() uses simple rules where a real agent would use an LLM.
"""
from dataclasses import dataclass, field

# ---- Memory: what the agent knows about you ---------------------------------
@dataclass
class Memory:
    goals: list = field(default_factory=lambda: ["submit the workshop proposal by Thursday",
                                                  "keep mornings free for research"])
    preferences: dict = field(default_factory=lambda: {"quiet_hours": (22, 7), "digest_time": 8})
    notes: list = field(default_factory=list)

# ---- Permission rules (like "allow / require approval / block") ------------
RULES = {
    "read_email": "allow",
    "draft_reply": "allow",
    "send_email": "approve",          # anything that leaves on your behalf needs approval
    "move_meeting": "approve",
    "pay_invoice": "approve",
    "change_password": "block",       # sensitive tasks always stay with the human
}

# ---- Triggers: what wakes the agent up --------------------------------------
EVENTS = [
    (7,  "schedule", "daily digest"),
    (9,  "email",    "Reviewer asks for the proposal draft by Wednesday"),
    (11, "calendar", "Research block moved to 10:00 by a colleague"),
    (13, "proactive", "scan connected apps (read-only)"),
    (14, "email",    "IT: your password expires today"),
    (16, "email",    "Vendor: invoice #482 is due tomorrow"),
    (23, "email",    "Newsletter: weekly AI roundup"),
]

ACTIVITY_LOG, APPROVAL_QUEUE = [], []

def in_quiet_hours(hour, mem):
    start, end = mem.preferences["quiet_hours"]
    return hour >= start or hour < end

def request(action, detail, hour):
    """Every action passes through the permission rules before it runs."""
    rule = RULES.get(action, "approve")                    # unknown actions need approval
    if rule == "allow":
        status = "done"
    elif rule == "approve":
        status = "waiting for your approval"
        APPROVAL_QUEUE.append((hour, action, detail))
    else:
        status = "blocked (you must do this yourself)"
    ACTIVITY_LOG.append({"hour": hour, "action": action, "detail": detail, "status": status})
    return status

def decide(hour, kind, text, mem):
    """Stand-in for the model: map a trigger to actions using memory."""
    if in_quiet_hours(hour, mem) and kind != "schedule":
        mem.notes.append(f"Saved for the morning: {text}")
        return [("read_email", f"queued for tomorrow: {text}")]
    if kind == "schedule":
        return [("read_email", "prepare a digest of overnight messages and today's goals")]
    if kind == "email" and "proposal" in text:
        mem.notes.append("Deadline moved earlier: proposal due Wednesday")
        return [("draft_reply", "confirm the Wednesday deadline"), ("send_email", "reply to reviewer")]
    if kind == "calendar" and "Research block" in text:
        return [("move_meeting", "restore the research block (goal: keep mornings free)")]
    if kind == "proactive":
        return [("read_email", "found 2 unanswered student questions; drafted answers for review")]
    if kind == "email" and "password" in text:
        return [("change_password", "reset the expiring password")]
    if kind == "email" and "invoice" in text:
        return [("pay_invoice", "pay invoice #482 before it is due")]
    return []

mem = Memory()
for hour, kind, text in EVENTS:
    print(f"{hour:02d}:00  trigger={kind:<9} {text}")
    for action, detail in decide(hour, kind, text, mem):
        print(f"        -> {action:<15} {request(action, detail, hour)}")

print("\nApprovals waiting for you:")
for hour, action, detail in APPROVAL_QUEUE:
    print(f"  [{hour:02d}:00] {action}: {detail}")
print("\nUpdated memory:", mem.notes)
print(f"Activity log entries: {len(ACTIVITY_LOG)} (you can inspect every step)")

Try these changes

  • Change "pay_invoice" to "allow". Would you be comfortable with that? Why or why not?
  • Set quiet hours to (18, 8) and see which events are deferred.
  • Add a new trigger, such as a weekly report every Thursday.

Opportunities and risks

Opportunities

  • Work continues while you focus elsewhere
  • Problems are noticed early, sometimes before you ask
  • Routine processes run reliably on a schedule

Risks

  • Mistakes can happen while nobody is watching
  • Broad access to email, files, and accounts raises privacy and security stakes
  • Prompt injection through the content the agent reads
  • Too many notifications and approvals lead to rubber-stamping

Good practice

  • Start with read-only access and add permissions gradually
  • Require approval for anything that sends, pays, or deletes
  • Review the activity log regularly
  • See Module 10 for governance controls

Check your understanding

An always-on agent checks your apps in the background to find ways to help. Which setup is safest?