Keith McFarlane is the CTO at Globality.
In a recent interview, Zendesk CEO Tom Eggemeier said that Muse, Meta’s new personal agent, saved him $3,105 in five days. It renegotiated his family’s internet, TV and mobile plans, did about 95% of the work and left him with a single phone call to make.
That is undeniably impressive. Personal agents such as Muse, Instinct and OpenAI’s Dots have the potential to profoundly change how people interact with every system they use, consumer or business.
But they are not yet ready for the enterprise.
Highly regulated markets are already reining in this technology. Earlier this year, employees across China rushed to install OpenClaw, an open-source personal AI assistant, on their work PCs in a craze nicknamed “raising lobsters.” Because OpenClaw needs extensive access to local files and keeps open connections to the outside world, regulators moved quickly to warn state agencies, state-owned enterprises and banks not to install it on office computers. Without careful oversight, they concluded, host systems would be highly vulnerable to data leaks and cyberattacks.
You might think I am being overcautious. After all, are personal agents not simply the next step from the conversational AI we already know, such as ChatGPT? It is true that they share the same fundamentals: powerful conversation and reasoning, memory that improves over time and tools that connect to other apps to boost productivity and add context.
However, chat apps lack a crucial characteristic that sets this new class apart. A personal agent is always on, acting on your behalf. It works for you as an individual, with a consistent view of you and your world that is closer to a relationship. It gets to know you, offers opinions, does your bidding at all hours and, crucially, starts conversations rather than waiting to be prompted. That proactivity goes so far beyond what we have seen from even the most powerful generative chat interfaces that all of us, as users, will need time to adjust to the weight it gradually lifts from our shoulders.
Risky Business
Giving a personal agent access to your work inbox, Microsoft 365 or any SaaS or autonomous business application would be seriously risky business. These products are too new to have earned the standards enterprises rely on, including SOC 2, ISO 27001 and ISO 42001, or to demonstrate GDPR compliance in a corporate setting. Nor can they easily promise not to train on or retain your data, since an agent designed to learn about you and make you faster depends on drawing from data across many systems. The moment one connects to the enterprise, it becomes a data subprocessor, and suddenly, the InfoSec team has a lot of explaining to do.
The Meter Is Always Running
The risk that gets talked about least may be the bill. A chatbot costs money only when someone types into it. An always-on agent keeps working whether anyone is watching or not. It checks for new tasks frequently, sending conversation history and other context to the model each time, and it can spawn helper agents of its own. OpenAI is already describing a future of teams of Dots working together. Every one of those is another meter running.
According to multiple reports, Uber had spent its entire 2026 AI coding budget by April, and Priceline’s renewal with its AI coding tool came back four to five times more expensive. And they are certainly not alone. The FinOps Foundation says companies were reporting being three times over their 2026 token budgets by spring, and those are the numbers for tools that mostly wait for a developer to prompt them. Agents that run unattended will consume far more.
Enterprise Agents Will Get More Personal
Given how sensitive their data is and how much is at stake, the enterprise leaders we work with have InfoSec teams that block consumer personal agents outright and prohibit them by policy. This will continue to be the case until enterprise-safe versions are available and have been vetted by security professionals.
The good news is that users won’t have to wait long. In business functions subject to strict compliance and governance requirements like enterprise procurement, agents are starting to manage the whole sourcing process, including complex negotiations. Procurement teams are gaining trust in agents because specific guardrails are in place, decisions are made transparently and fully explained and exceptions are escalated to humans in the loop. In contrast to the “black box” approach of personal agents, enterprise-ready agents log all their actions in case any further analysis is warranted.
I don’t believe the consumer version of personal agents belong in the enterprise. However, enterprise agents will get increasingly personal over time. Enterprises know that pressure is building from the Tom Eggemeiers of this world who use personal agents at home to save money and time. The smartest ones are preparing to bring the best capabilities of personal agents to enterprise users in a safe, enterprise-compliant way.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?