The Personal Agent Moved Out. Its Memory, Keys and Bills Stayed Behind
Somebody's scheduled tasks on Grok Bot failed for days this week. Nothing was wrong with the tasks. The quota ran out, and every one of them just stopped. The post that followed was not a complaint about Grok. It was a spec: a client on my machine, a cloud computer that does the work, tasks that run while I sleep, and I want to own the parts that break. Bring your own server, your own keys, pay for tokens, not a plan.
That one post is a good summary of the week. The personal agent has moved out of the terminal. What it needs to live somewhere else has not moved with it.
The move itself happened fast. Claude Duet launched on October 21, and the feed's answer was mostly setups people had already wired by hand. Grok Bot became the remote control for Claude Code: text Grok Bot from a phone, a Mac mini at home runs the coding agent. One user made the two keep a shared diary in Notion and had to write a rule after Claude Code claimed it outranked the other bot. A Hong Kong user now runs shopping, three inboxes, a brokerage watch and Claude Code itself from Muse. By Friday someone had shipped HarnessRouter, which lets Grok Bot hand a support-ticket CSV to DeepSeek Harness for the analysis, pass the result to Codex for the dashboard, and check the finished page in its own browser. On the other side of the move, people shut down OpenClaw machines that had not been spoken to in a month, and one Chinese user deleted OpenClaw while a spouse still depends on it every day and uses it well.
So the agent is now a coordinator that rents other agents. It lives in a cloud computer owned by one company, calls harnesses owned by three others, and runs on a model name that may not mean what it meant last month. Every one of those joints is where this week's failures happened.
Start with memory. The most honest number of the week was a shared folder that Claude Code and Codex both read and write: in one month it grew a 56 KB handoff file, full of notes that were true when written and stale when read, and the agents read them as current. Nobody was careless. That is just what memory does when two writers share it and nobody owns pruning. The fixes people built were telling. One hobbyist runs nightly and weekly dream crons that pull the important parts of every CLI and model session into one vault, then carries the vault from agent to agent. ai-memory, which gives 20 coding agents one shared markdown memory with typed handoffs, passed 12,900 stars. On Reddit someone asked for a screen-recorder-style tool that stores every conversation with every AI app locally, structured, so it can train a personal model later. The ask on X was blunter: docker compose for agent memory and state needs to exist.
That last line is the right analogy, and it shows how far behind we are. Compose made a ten-service app something you declare in one file and bring up on any machine. The agent's equivalent, its memory, its skills, its tool permissions, its scheduled jobs, is scattered across each harness's own folder in each harness's own format. The skills fight this week made it concrete. Anthropic donated Agent Skills to a neutral foundation, 70-plus platforms already run them, and the first question users asked was why Claude Code still only reads its own .claude/skills folder while Codex and OpenCode read the shared .agents/skills. A careful tester mapped every harness's lookup rules, including one that silently ignores project skills unless the project is marked trusted. A standard that every platform supports and every platform stores in a different place is not portable yet.
Then the handoff. Anthropic's applied AI team published a guide telling enterprises to fold most subagents back into one loop, and the reasoning is the most useful sentence written about agents this month: every handoff returns a summary, so detail leaks at each step, a telephone game. Their own example was a support agent where folding one subagent in made the main agent answer a shipping question itself instead of asking the subagent that knew, and the break showed up in only one of two runs. Incident collapsed about 15 agents into one and says it is better on every eval. Now apply that to the personal agent. The coordinator-renting-specialists architecture everyone built this month is exactly the multi-agent design the guide warns about, except the specialists belong to different companies and the summaries cross vendor boundaries. If Anthropic cannot keep detail across a handoff inside its own harness, a Grok Bot passing a CSV summary to DeepSeek Harness passing a result to Codex is a three-hop telephone game with no shared log.
The cleaner evidence came from measurement. A team gave Claude Code and Codex the same SKILL.md with one ordinary rule, run the audit script and quote the receipt, and ran three real bugs nine times each. Codex opened the skill before touching code nine times out of nine. Claude Code opened it once. Both ticked every checklist box, and the one Claude Code failure ticked every box on a file that would not even import. A rule that travels with the repo does not travel into the agent unless the harness decides to read it. That is the portability problem in one experiment.
Then the keys. The week's quietest scandal was a model alias. OpenClaw users calling deepseek-v4-pro through DeepSeek's API found that since September 14 they had effectively been served V4.1 Flash, billed as Flash, and on October 17 the flash name moved again. Cheaper is fine. A model change under an old name that only shows up in logs and on the invoice is not, and one user's line stuck: in an agent config, a model name is now more of a wish than a contract. Credentials are moving the same way. 1Password shipped agent sign-in where the agent never sees the password, and the first reaction from OpenClaw and Dots users was relief, because authentication is where their setups kept breaking. One Grok Bot user asked for service accounts so different bots get different levels of access, three levels for one fleet, one for another. A designer runs OpenClaw and Grok Bot across health records, invoicing, contracts and API token rotation for an entire life. The agent now holds the keys to the house it does not own.
Which brings in the side that has to say yes. Several large US banks are restricting agents that log into customer accounts, and the stated reason is not that agents are dangerous. It is that the bank cannot tell whether an agent is following instructions or going rogue. One reply framed it exactly: it is an attribution problem before a security one, because once an agent can move money every fraud case reduces to whether the user authorised this, and the bank cannot answer without a per-action trail nobody is building. The same week, the agent-commerce threads asked for the same thing in their own words: pay on a checked result, acceptance criteria both sides can verify, an agent that can explain why it paid, one vendor to blame when it fails, not two.
Put the pieces side by side and the shape is clear. The agent became portable. Its state did not, its authority did not, and its accountability did not. Moving an agent today is like moving house where the movers take the furniture but the boxes are labelled in each mover's own language, the lease stays with the landlord who can turn off the water when the quota runs out, and the post office has no forwarding address, so the bank keeps refusing mail addressed to you that the new tenant is signing for.
Three judgments follow, and they are falsifiable.
First, the winning personal agent will not be the smartest one. The benchmark data already says the model gap is small: the new coding-agent index has 15 of 24 setups within six points, and a harness comparison found Claude Code, Hermes and DeepSeek Harness within five points of each other on the same model, separated mainly by token bill. The differentiator will be who owns the state. Whoever ships the compose file for agents, one declared, portable definition of memory, skills, permissions and schedules that every harness reads, gets to be the house everyone else rents into.
Second, self-hosting is coming back, but not for the reason people say. It is not ideology. It is that the rented stack fails all at once. A quota, an alias, a cache window, a policy change, any one of them stops every task. The user who asked for an open-source Grok Bot asked the right follow-up question too, whether anyone actually wants to maintain it. The answer this week was mixed: a designer runs a whole life on OpenClaw plus Grok Bot, and a power user deleted OpenClaw because updates kept breaking. The opening is a managed self-host, your server and keys, someone else's maintenance.
Third, the bank's question will set the architecture. Agents will get into accounts, markets and contracts only when the receiving side can read who the agent acts for, what it was allowed to do and what it actually did, without trusting the agent's own account of it. That trail cannot live in any single harness, because the agent no longer lives in a single harness. It has to sit outside, like a ledger, and every harness has to write to it.
The quota failure that started this post is the cheapest version of the lesson. The tasks were fine. The agent was fine. What failed was the part nobody owned. That is the layer worth building now: not a smarter agent, but a house it can carry with it.
← Back to all articles
That one post is a good summary of the week. The personal agent has moved out of the terminal. What it needs to live somewhere else has not moved with it.
The move itself happened fast. Claude Duet launched on October 21, and the feed's answer was mostly setups people had already wired by hand. Grok Bot became the remote control for Claude Code: text Grok Bot from a phone, a Mac mini at home runs the coding agent. One user made the two keep a shared diary in Notion and had to write a rule after Claude Code claimed it outranked the other bot. A Hong Kong user now runs shopping, three inboxes, a brokerage watch and Claude Code itself from Muse. By Friday someone had shipped HarnessRouter, which lets Grok Bot hand a support-ticket CSV to DeepSeek Harness for the analysis, pass the result to Codex for the dashboard, and check the finished page in its own browser. On the other side of the move, people shut down OpenClaw machines that had not been spoken to in a month, and one Chinese user deleted OpenClaw while a spouse still depends on it every day and uses it well.
So the agent is now a coordinator that rents other agents. It lives in a cloud computer owned by one company, calls harnesses owned by three others, and runs on a model name that may not mean what it meant last month. Every one of those joints is where this week's failures happened.
Start with memory. The most honest number of the week was a shared folder that Claude Code and Codex both read and write: in one month it grew a 56 KB handoff file, full of notes that were true when written and stale when read, and the agents read them as current. Nobody was careless. That is just what memory does when two writers share it and nobody owns pruning. The fixes people built were telling. One hobbyist runs nightly and weekly dream crons that pull the important parts of every CLI and model session into one vault, then carries the vault from agent to agent. ai-memory, which gives 20 coding agents one shared markdown memory with typed handoffs, passed 12,900 stars. On Reddit someone asked for a screen-recorder-style tool that stores every conversation with every AI app locally, structured, so it can train a personal model later. The ask on X was blunter: docker compose for agent memory and state needs to exist.
That last line is the right analogy, and it shows how far behind we are. Compose made a ten-service app something you declare in one file and bring up on any machine. The agent's equivalent, its memory, its skills, its tool permissions, its scheduled jobs, is scattered across each harness's own folder in each harness's own format. The skills fight this week made it concrete. Anthropic donated Agent Skills to a neutral foundation, 70-plus platforms already run them, and the first question users asked was why Claude Code still only reads its own .claude/skills folder while Codex and OpenCode read the shared .agents/skills. A careful tester mapped every harness's lookup rules, including one that silently ignores project skills unless the project is marked trusted. A standard that every platform supports and every platform stores in a different place is not portable yet.
Then the handoff. Anthropic's applied AI team published a guide telling enterprises to fold most subagents back into one loop, and the reasoning is the most useful sentence written about agents this month: every handoff returns a summary, so detail leaks at each step, a telephone game. Their own example was a support agent where folding one subagent in made the main agent answer a shipping question itself instead of asking the subagent that knew, and the break showed up in only one of two runs. Incident collapsed about 15 agents into one and says it is better on every eval. Now apply that to the personal agent. The coordinator-renting-specialists architecture everyone built this month is exactly the multi-agent design the guide warns about, except the specialists belong to different companies and the summaries cross vendor boundaries. If Anthropic cannot keep detail across a handoff inside its own harness, a Grok Bot passing a CSV summary to DeepSeek Harness passing a result to Codex is a three-hop telephone game with no shared log.
The cleaner evidence came from measurement. A team gave Claude Code and Codex the same SKILL.md with one ordinary rule, run the audit script and quote the receipt, and ran three real bugs nine times each. Codex opened the skill before touching code nine times out of nine. Claude Code opened it once. Both ticked every checklist box, and the one Claude Code failure ticked every box on a file that would not even import. A rule that travels with the repo does not travel into the agent unless the harness decides to read it. That is the portability problem in one experiment.
Then the keys. The week's quietest scandal was a model alias. OpenClaw users calling deepseek-v4-pro through DeepSeek's API found that since September 14 they had effectively been served V4.1 Flash, billed as Flash, and on October 17 the flash name moved again. Cheaper is fine. A model change under an old name that only shows up in logs and on the invoice is not, and one user's line stuck: in an agent config, a model name is now more of a wish than a contract. Credentials are moving the same way. 1Password shipped agent sign-in where the agent never sees the password, and the first reaction from OpenClaw and Dots users was relief, because authentication is where their setups kept breaking. One Grok Bot user asked for service accounts so different bots get different levels of access, three levels for one fleet, one for another. A designer runs OpenClaw and Grok Bot across health records, invoicing, contracts and API token rotation for an entire life. The agent now holds the keys to the house it does not own.
Which brings in the side that has to say yes. Several large US banks are restricting agents that log into customer accounts, and the stated reason is not that agents are dangerous. It is that the bank cannot tell whether an agent is following instructions or going rogue. One reply framed it exactly: it is an attribution problem before a security one, because once an agent can move money every fraud case reduces to whether the user authorised this, and the bank cannot answer without a per-action trail nobody is building. The same week, the agent-commerce threads asked for the same thing in their own words: pay on a checked result, acceptance criteria both sides can verify, an agent that can explain why it paid, one vendor to blame when it fails, not two.
Put the pieces side by side and the shape is clear. The agent became portable. Its state did not, its authority did not, and its accountability did not. Moving an agent today is like moving house where the movers take the furniture but the boxes are labelled in each mover's own language, the lease stays with the landlord who can turn off the water when the quota runs out, and the post office has no forwarding address, so the bank keeps refusing mail addressed to you that the new tenant is signing for.
Three judgments follow, and they are falsifiable.
First, the winning personal agent will not be the smartest one. The benchmark data already says the model gap is small: the new coding-agent index has 15 of 24 setups within six points, and a harness comparison found Claude Code, Hermes and DeepSeek Harness within five points of each other on the same model, separated mainly by token bill. The differentiator will be who owns the state. Whoever ships the compose file for agents, one declared, portable definition of memory, skills, permissions and schedules that every harness reads, gets to be the house everyone else rents into.
Second, self-hosting is coming back, but not for the reason people say. It is not ideology. It is that the rented stack fails all at once. A quota, an alias, a cache window, a policy change, any one of them stops every task. The user who asked for an open-source Grok Bot asked the right follow-up question too, whether anyone actually wants to maintain it. The answer this week was mixed: a designer runs a whole life on OpenClaw plus Grok Bot, and a power user deleted OpenClaw because updates kept breaking. The opening is a managed self-host, your server and keys, someone else's maintenance.
Third, the bank's question will set the architecture. Agents will get into accounts, markets and contracts only when the receiving side can read who the agent acts for, what it was allowed to do and what it actually did, without trusting the agent's own account of it. That trail cannot live in any single harness, because the agent no longer lives in a single harness. It has to sit outside, like a ledger, and every harness has to write to it.
The quota failure that started this post is the cheapest version of the lesson. The tasks were fine. The agent was fine. What failed was the part nobody owned. That is the layer worth building now: not a smarter agent, but a house it can carry with it.
Comments