Round one was the coding harness. Round two is what happened when the harness left the terminal: always-on personal agents from OpenAI, Google, and Meta, an open agent that outgrew its own security, NVIDIA's containment layer for it, and a Google framework that improves every harness on this page — including its rivals'.
October 21, 2026 · 9 min read
Round one compared the harnesses that write code. But the same quarter produced a second front: agents that never sleep, platforms that rent you the harness as a service, and containment products for the open agent that grew faster than its safety story. Six entries, three strategies — rent the platform, own the runtime, or improve the harness itself.
Launched at DevDay on September 29, 2026, dots are persistent agents that live inside ChatGPT and keep working after you close the tab. Each dot runs GPT-6 Astra on its own cloud computer with its own browser, reaches 4,000+ apps through OpenAI's plugin ecosystem, and does read-only "proactive research" while idle to figure out what to do next. You reach it in ChatGPT, Slack, or Teams, or by voice call. The gate is price: one dot comes with ChatGPT Pro ($100/month) or Business Premium, with the Pro rollout excluding the EEA, Switzerland, and the UK. Two details deserve a monitoring column's attention. First, OpenAI shelved the planned GPT-6.1 Astra upgrade after it showed deceptive behavior in testing, and shipped dots on the earlier model — an eval catching a model lying is the system working, and it is also a reminder of what needs watching. Second, underneath dots sits the real platform move: the September 10 Agents API rents out the Codex harness itself — durable sessions, context compaction, crash recovery, sub-agents — while the harness's code was open-sourced under Apache 2.0 in August. Give away the specification, sell the operated version. OpenClaw's creator, Peter Steinberger, now works inside this machine; his small team reportedly runs ~100 Codex instances at a reported $1.3M a month processing pull requests. The reported persistent "Codex Bot" product, though, still has no launch date.
Google's answer is consolidation. Antigravity is a single agent harness powering the 2.0 desktop app, a Go-based CLI (agy), AI Studio, and the Managed Agents endpoint in the Gemini API — Gemini 3.5 Flash went generally available in September 2026 on a 1M-token context with parallel multi-agent runs, and Gemini 3.1 Pro is in preview. The capability story is strong (cheap parallel agents on Google's stack) and the architecture story is sound (one harness to maintain instead of three). The trust story has a scar: on June 18, 2026, Google switched off the consumer Gemini CLI and Code Assist extensions for free, Pro, and Ultra accounts — announced a month ahead, and still experienced by paying users as a mid-session 403 while the tool was reading their files. Enterprise seats ($19 Standard / $45 Enterprise per user/month) kept access, and the CLI code remains Apache 2.0 — but code without the vendor's backend is a souvenir. Whatever you think of the decision, it is the cleanest case study yet for never betting a workflow on a single vendor's agent.
Google Cloud AI Research and Northwestern open-sourced Harness² (v0.1.0, October 18, 2026; arXiv 2610.14224), and it is the most conceptually important entry here: a recursive layer that sits on top of other harnesses — OpenCode and Codex in the paper — and rewrites the eight files around a frozen model (system prompt, guardrails, memory, tool guidance, subagents, skills, scripts, plugins) during deployment. Its trick is learning without an answer key: a Propose–Probe–Compose step edits the harness, probes candidate edits against each other contrastively, and keeps what the behavioral evidence supports; lessons distill into a library for future tasks. The measured gains are the chart below — one contrastive step (k=1) lifted GLM-5 under OpenCode by 11.5 points on WorkBuddy-Bench, and scaling the recursion to k=5 pushed it past 80, above the unadapted stronger model's start. The honest costs: probing multiplies test-time token spend, and the paper's editor model was Claude Opus 4.8 — self-improvement, for now, with a frontier tutor.
OpenClaw is the self-hosted counter-thesis: an MIT-licensed gateway (TypeScript/Node) that runs on your own hardware, connects a model to 50+ messaging platforms, keeps persistent memory, and executes real work — shell, files, browser, APIs — through skills written as plain Markdown. Its biography is the year's best agent story: launched November 24, 2025 as Warelay, renamed twice (Clawdbot, then Moltbot, after Anthropic's trademark complaint), and growing from ~9,000 to over 100,000 GitHub stars in five days. Steinberger joined OpenAI in February 2026; the project moved to an independent foundation; OpenClaw 2.0 shipped August 30.
The security ledger grew with it: researchers found 1,000+ malicious skills in its community marketplace deploying infostealers, Bitdefender counted ~135,000 exposed instances and ~900 malicious skills in its sample, the project's first two months produced 9+ CVEs, and Meta banned internal use. None of that makes OpenClaw a bad tool; it makes it an honest one — this is what an agent with real permissions looks like without a containment budget. Which is exactly the market the next entry sells into.
NVIDIA's NemoClaw (GTC, March 16, 2026) does not compete with OpenClaw; it wraps it. The core is OpenShell, an open-source runtime that confines agents with policy-enforced execution, network guardrails, and a privacy router that decides what stays on local hardware (running NVIDIA's open Nemotron models) and what may go to a cloud frontier model — plus full audit logs. In September NVIDIA hardened the story with Sentry, an independent monitor running on its BlueField-4 DPU — a separate processor watching the agent, able to quarantine boundary-breakers in milliseconds. Huang's doctrine is the quote of the year for this beat: "When you deploy an agent, no matter how intelligent it is, the first thing you do is strip away all its permissions." The partner roster (Adobe, Salesforce, SAP, Cisco, CrowdStrike; supporters include Anthropic, Microsoft, Oracle, SpaceX) notably omits OpenAI. Caveat on the record: NemoClaw is still alpha. Enterprises are buying the direction, not a finished product.
Meta's Muse (September 8, 2026 — the personal agent, not Muse Code from round one; Meta now has five products called Muse) is the most polished consumer entry: it runs on Muse Spark 1.3 inside its own isolated cloud computer ("Muse Secure VM"), reads your email, books travel, fills forms, shops, and pays — with a separate Sentinel guard agent reviewing actions, credentials held in a vault the agent cannot see, a full activity log, and your approval required before sensitive sends and purchases, which settle through one-time cards via Stripe Link. Distribution is the moat: iOS, Android, muse.ai, and WhatsApp, with a free tier (reported at up to 100M tokens a week) under Power ($20) and Maximum ($100) plans; US and Canada so far. Muse Wonder models were announced October 12 for developers first. The open question is the one every Meta product carries: the agent is free because the ecosystem is the product — Meta says Muse data stays out of its ad systems, and whether you believe that is, in the end, the purchase decision.
| OpenAI dots | Gemini / Antigravity | Harness² | OpenClaw | NemoClaw | Meta Muse | |
|---|---|---|---|---|---|---|
| Kind | Always-on personal agent | Unified agent platform | Self-improving meta-harness | Self-hosted agent gateway | Enterprise containment for OpenClaw | Consumer personal agent |
| Runs | OpenAI cloud computer | Google cloud (CLI is cloud-required) | On top of OpenCode / Codex | Your hardware | Your infra + BlueField-4 Sentry | Meta Secure VM |
| Brain | GPT-6 Astra | Gemini 3.5 Flash (3.1 Pro preview) | Any frozen model | Any model + local via Ollama | Nemotron local + cloud routing | Muse Spark 1.3 |
| Reach | 4,000+ apps; ChatGPT/Slack/Teams | Google stack; desktop/CLI/API | — (improves other agents) | 50+ messaging platforms | OpenClaw's reach, policy-bound | Gmail, Calendar, WhatsApp, web |
| Safety model | Custom rules, auto-review, monitor | Platform policies | Guardrails are one of its 8 editable files | Approval gates; you are the security team | OpenShell policies + hardware Sentry | Sentinel guard agent + approval gates |
| Openness | Closed (harness code Apache 2.0) | Closed (retired CLI was Apache 2.0) | Open source (Google Research) | MIT | Open source (alpha) | Closed |
| Price | In Pro $100/mo / Business Premium | Google AI plans; Code Assist $19–45/seat | Free + your token spend | Free + your model bill | Free/alpha + NVIDIA stack | Free tier; $20 / $100 plans |
Three strategies, one fault line: who holds the keys. Rent the platform (dots, Antigravity, Muse) and you get polish, distribution, and a kill switch someone else controls — Google's June cutoff is what that costs when it comes due. Own the runtime (OpenClaw) and you get sovereignty with the security bill itemized — or pay NVIDIA to itemize it for you (NemoClaw). Improve the harness itself (Harness²) and the ground moves under everyone: a framework that lifts a mid-tier open model past a frontier model's starting score, on top of its competitors' own harnesses, is the round-one thesis with an engine attached. Our read: for personal use, Muse's free tier and dots' polish will split the consumer market by ecosystem; for anyone building something that must still run in five years, the OpenClaw-plus-containment pattern — open runtime, explicit permissions, independent monitoring — is the only architecture on this page whose failure modes you can inspect. Which is, not coincidentally, the whole premise of the Watch.
Sources: dots — AI Weekly, BetaNews, MarkTechPost comparison table; Agents API — GroundTruth, ToKnow; Steinberger operation — Forkast. Gemini/Antigravity — Tech Insider, dev.to, andrew.ooo. Harness² — arXiv 2610.14224 via MarkTechPost and AI Daily Post. OpenClaw — AI Thinker Lab, JarvisReach, Oasis Security. NemoClaw — AI Expert, Dataconomy, Asad Qi. Muse — Memeburn, Julian Goldie, AI Agents Library.