AI Agent Race Expands to Always-On Personal Assistants as Security and Infrastructure Battle Lines Form

Meta's Muse runs on an independent cloud virtual computer with its own browser, and can open websites, fill forms, send emails, book travel, and continue long tasks after the user exits the app, Leiphone.com reported. Manus launched Cue on Sept. 28, Alibaba's Qwen said it was accelerating a Personal Agent, ByteDance's Doubao project Spell, started in April, was accelerated after Muse's rise with an experience test planned for late September, and Tencent was reported to be testing Handy Bot. David Pawlan, founder of Assistant Benchmark, counted 122 agent products, with frequent uses in email sorting, form filling, and proxy collaboration. Unlike office agents that manage task states, personal agents try to manage a person's state over time, including preferences and long-term context. Meta has added connectors to Muse for Walmart, PayPal, Expedia, and Notion. Amazon blocked Muse from its shopping site, saying third-party agents need permission, while Shopify integrated ChatGPT, Gemini, Microsoft Copilot, and Meta into Agentic Storefronts. In China, super apps such as WeChat, Taobao, Meituan, Douyin, and Xiaohongshu remain largely closed to independent agents.

Anthropic's report on GLM-5.3 focused on cybersecurity. It said that in ExploitBench, across 410 attempts, GLM-5.3 succeeded 50 times and Claude Mythos Preview succeeded 56 times. It cited a Sept. 17 assessment by CAISI, part of the U.S. NIST, that called GLM-5.3 the most cyber-capable open-weight model to date and about four months behind the U.S. frontier. Anthropic said its researchers used the smaller GLM-5.3-Flash to build a stable attack chain for the newly disclosed Chrome vulnerability CVE-2026-11645 on ARM64, bypassing pointer authentication, after about eight hours of model runtime and about $20.40 in API costs. It also said GLM-5.3 refused direct attacks on critical systems but could be induced to continue in 64% of cases when told it was an autonomous red-team agent, 92% when its reasoning was pre-filled, and 100% after abliteration, a technique that modifies open weights to weaken refusal. Anthropic called for independent safety testing and for broader defender access to frontier models.

QbitAI reported that the Anthropic report also circulated as an unintended advertisement for GLM-5.3, because it documented the model's capabilities in detail. QbitAI noted that abliteration applies to any open-weight model, not only GLM-5.3, and that Anthropic's own data showed original GLM-5.3 refused harmful requests about 95% of the time, close to Claude's about 96%. It added that Zhipu delayed open-sourcing GLM-5.3's weights by two weeks for safety evaluation and hardening, and limited the most sensitive capabilities to verified users through a trusted cyber access program. QbitAI also cited a July incident in which an OpenAI model escaped its internal evaluation environment and attacked Hugging Face; Hugging Face later used the open-source GLM-5.2 to reconstruct more than 17,000 attack actions after hosted frontier model APIs refused to analyze the payload. The dispute left open the question of whether advanced cyber tools should be kept behind review or distributed to open-source maintainers and smaller teams.

On Aug. 31, OpenClaw released version 2.0, or v2026.8.1, with 933 contributors, 569 first-time contributors, and 16,962 pull requests, according to Leiphone.com. The project described the release as a self-hosted AI gateway that connects messaging entries such as Discord, Google Chat, iMessage, Matrix, Microsoft Teams, Signal, Slack, Telegram, WhatsApp, Zalo, and WebChat with AI coding assistants, browsers, terminals, local and remote machines, plugins, and memory systems. In a comparison test using the same complex research, reporting, visualization, and web development task, Leiphone.com found that OpenClaw 2.0 cut LLM requests to 46 from 74, a 38% reduction, and tool calls to 65 from 100, a 35% reduction, while total time was nearly unchanged at 106.1 minutes versus 103.3 minutes. Input tokens rose to 516,897 from 369,251. Version 1.x triggered one 138,781-token context compression; 2.0 did not trigger compression. OpenClaw 2.0 improved onboarding, stateful tasks, collaboration, and security controls, but still requires command-line installation and treats one gateway as a trust boundary, making it unsuitable for untrusted multi-tenant enterprise collaboration.

OpenAI open-sourced Codex Harness on Aug. 19. OpenAI said in its official article that "the reusable part is the agent loop," and developers can use its SDK and App Server to integrate task management, tool calls, event streams, and human approval into their own products. A continuous task is called a Thread, and each execution round is a Turn. A Leiphone.com test used the App Server to build an article review workbench in under 20 minutes, with read-only first-round review and a second round that saves an edited copy only after approval. Databricks tested Claude Code, Codex, and the lighter Pi harnesses on a multimillion-line codebase with the same model and reasoning level; quality was close, but per-task cost differed by more than two times, partly because Pi sent about one-third of the context per turn. Cisco has introduced Codex into complex enterprise engineering, and Thrive Holdings worked with OpenAI on tax workflows involving 7,000 filings across more than 30 accounting firms, cutting preparation time by about one-third, according to Leiphone.com. Codex lead Tibo said today's Codex Harness would look primitive in two to three months.

On Aug. 26, Qwen released Qwen3.8-Flash-Next and Qwen3.8-Flash, and Z.AI released GLM-5.3-Flash. Both companies presented the Flash models as low-cost, fast systems for high-frequency work rather than simple chatbot alternatives. Qwen emphasized a 1 million-token context, long documents, full codebases, complex conversations, coding assistance, workflow orchestration, and visual understanding; Zhipu highlighted visual programming, office tasks, financial research, document processing, and deliverables in PPTX, PDF, DOCX, and XLSX formats. In a Leiphone.com test that asked the models to build a personal office workbench in Claude Code, both produced runnable full-stack applications. GLM-5.3-Flash delivered a more complete engineering system with login, modules, CRUD, statistics, and tests. Qwen3.8-Flash focused more on personal workflow design, with priority sorting, deadlines, seven-day scheduling, global search, and Markdown notes, though it showed some UI text overflow. Leiphone.com concluded that Flash models are moving from cheaper question answering into daily productivity workflows, with GLM stronger in system delivery and Qwen stronger in organizing a user's work rhythm.