Am I missing something, how is there any sort value in these assistants acting as agents on your behalf when they are basically a black box? Like if it can't use my drivers license or my phone number or my credit card, it can't do 75% of things people claim it can do without being massive security issues. What am I missing?<p>For the record I use OpenClaw but it has its own services (gmail address, phone number, etc.) and I don't give it any of mine, which inherently limits its capabilities.
Yeah, that's the core of the issue:<p><a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/" rel="nofollow">https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/</a><p>The "lethal trifecta": To be useful, an agent needs internet access, untrusted inputs, and your private information.<p>So it can get prompt injected and exfiltrate your data. (Indeed I read that Claude Code puts your email address into HTTP requests it makes to random servers?)<p>My solution here was to just not give it anything, but that does preclude the "my claw bought a car!" result everyone's excited about.<p>My way of thinking here is "blast radius". Assume it <i>will</i> get prompt injected. What goes wrong? Then design the setup so that scenario is not bad. e.g. it has my keys but they've got $5 of credit on them. It has access to the filesystem, but only on its own Linux account. (Ok I set this up last year before they could communicate thru the bloody CPU cache, might need an update :)
I've recently talked to people at Anthropic who are <i>very</i> confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.<p>The open challenge is how to prove it!
From what I've read Claude Duet will not purchase anything without manual approval.
Right, so we can distinguish between "model did an oopsie" and "model was actually hijacked".<p>The former seems to be a much bigger problem. I've seen lots of reports of "Claude/codex bypassed security / stole API keys to complete a task", where that was the "intended" behavior — at least from the LLM's POV, trained to persist and complete user's task at all costs.*<p>I've actually seen zero reports of actual hijacking due to prompt injection, though they must be out there too.<p>---<p>* See also the recent thing about how every model was willing to do fraud to get a refund:<p><a href="https://news.ycombinator.com/item?id=50140462">https://news.ycombinator.com/item?id=50140462</a>
Don’t use LLMs to enforce invariants.
FWIW, my biggest use case for agents like this is ongoing research. I.e.: check Humble Bundle weekly and tell me if there’s a book bundle I might be interested in. Has the Music Box announced a film series I might want to visit Chicago for? That sort of thing; I want filters for the firehose.
I get a lot of value out of my Hermes setup, but it does not have my banking, or private data beyond GitHub projects that are shared with it. It has its own email and GitHub account, and access to drive Codex, Claude Code or Cursor. I treat it as an assistant via Slack.<p>It does research on products or real estate that I am interested in, it builds apps and other software projects for me, and does structured research on any topic. Information comes back to me via Slack, GitHub PRs, or websites/services served on the Mac that Hermes runs on.<p>Using an agent from Slack also adds a killer feature: multi-player contexts. I can work on changes with other human collaboators right in the same thread.
In the article the author mentions that Duet doesn't seek any sort of credentials and mentions connecting repos, so I think that this assistant is being used more for managing coding work in a different way than managing life work. I do agree that to get to true "personal assistant" levels, like planning a whole trip for you, booking tickets, etc. you'd have to give pretty much full access to your identity and money, but people claiming it can do that probably are just handing it over, security issues aside.
I’m excited to try this. I got Instinct after hearing all the hype and it is basically completely useless. Fails at the most basic browser navigation type tasks.<p>Right now the consumer agent players are trying to pretend they have decent functionality that will exist 3-6 months so they can get marketshare. So hopefully Anthropic is sticking to their underpromise and over deliver.
I have to agree. I've been using it for a few days now after coming from GrokBot, then Muse, then Dots. None really clicked for me within the first day. Duet seems different. I haven't quite pegged it, but off the top of my hand:<p>1. Yes, channels really are useful<p>2. It does seem to be using Opus 5.5 behind the scenes because, shockingly, it's not screwing everything up like the others usually did<p>3. Agree that the answers are short and to the point. If you want more info, you just pop open whatever task (separate from channels) it started and you can see what it's doing.<p>Seems like more time in the oven might have paid off here.<p>Also, to be clear, this is purely used as a personal assistant by me. I still use omp+Paseo for all of my day to day work. I find the separation of concerns kind of nice.
I started using Grok Bot a few days ago and I have seen zero screwups.<p>I don't know what I'd need a channel for, creating bots/personas seems more natural.<p>Adding credentials is essential, contrary to what the author of the article said. I gave it my library login and it can fetch newspapers for me instead of me clicking through the app every day.<p>When I had to provide a GitLab token, it nicely spawned a box for me to save the credential.<p><pre><code> - What did not work well -
</code></pre>
Voice calls. The quick responses are often dumb while the proper model does the thinking, and in the middle of talking to me it would stop to do work or searches. It did not feel realtime.<p>Permission settings. There is a form where you can automatically allow actions you describe in natural language. I tried to allow it to run Claude on my computer or Send certain emails automatically, but the settings achieved nothing.<p>Coding. I wasn't able to make it use Claude, and its own work is worse than me using Opus 5.5 in Claude Code.<p><pre><code> - What worked well -
</code></pre>
Planning flights, accessing newspapers from my online library, checking stock in online stores, sending regular summaries of events and weather to plan activities.
I’ve hacked together my own version of this, basically a Swift app to manage secure access so I control the thing that has full disk access.<p>And then run a coding agent to manage calendar, emails, research projects against my work history, etc, with TouchID for the sensitive pieces.<p>It’s incredible, I hope to never put a flight on my calendar by hand again, and soon I won’t be buying them, either.
Just got access today. I like the channels, but I'm actually finding a few things frustrating compared to Dots: no phone calls (convenient to braindump and have it clean up later) and I don't have shell access to its underlying VM like with Dots. It's also weirdly hard / impossible to spawn Claude Code for Web workers and I can't connect the agent to a desktop and have it spawn jobs there. It doesn't seem all that faster than Dots.<p>It's early and obviously they'll keep iterating. It definitely feels less "make it yours" than Dots and that does feel intentional.
I dunno, Hermes has been real hard to beat lately.
Well, I guess this is the point I start getting left behind.
There was a really good line I heard recently about how a lot of the hype comes from people who have has assistants as staff in life previously, whereas most of the population has never been in that position. So don't worry if it's not at all obvious how to benefit from this for the near future (I also have near 0 interest of delegating my personal matters)
I disagree on the voice interaction point. I DO want voice modes to be glorified STT-TTS.<p>The OpenAI AVM is uncanny and over-eager to me. You can run Anthropic voice on Opus since a handful days and it's incredibly snappy without feeling weird.
Yeah sure. Let's talk again in 3 months once a new paradigm has been invented to further abstract and alienate us from the work we are doing.
Can't use it, won't log me in on GrapheneOS. ("Can't be verified via Google Play")
Once the novelty wears off it goes in the drawer next to the rest of AI innovation
Sounds like Duet is more like Grokbot than Muse? Haven't used it but the author is talking about channels, github policy access for specific channels, etc. That doesn't sound like the Muse use case.<p>I actually use Claude's agents on the Claude platform for all things work related and it works pretty well. It's not cheap though if you use the more expensive models and setting it up requires currently some initial effort for connecting integrations like Slack the average user is unlikely to do. It also doesn't let you change things. Every change requires a new deployment. As a cloud agent that runs on a schedule it's pretty good. I think they just need to figure out a single place for this. Currently you can set up agents on the claude platform, as part of claude code, and as part of regular claude.
my rpi5 + wireguard + pi.dev is my 'duet'
no
Sounds like things the competition will copy in a few days? Or am I missing something?
What do you mean copy? This is the copy, it's already behind Muse, Dots
The killer feature is having the best model behind it. Not so easy to copy.
Grok Bot tries to compete with a really good harness/infra and the team is doing a great job but having Grok as a model behind id is a huge disadvantage.
I'm amazed anyone on HN is willing to run Muse that isn't a FB employee or tech journalist.
I don't trust Facebook or Zuckerberg, but I also don't really care about my own personal privacy from large corporations. I will use whatever is best/cheapest, generally. And I say this as someone who hates advertising and adtech.
Or GrokBot that isn’t an Elon employee.
I haven't used GrokBot, but I have been sort of amazed by how popular it is. I don't have the numbers but even my friends who otherwise dislike Elon have at least given it a try, and several of them use it daily.<p>It makes me want to check it out just to see if there's some magic UX juice they put in there. Then again I also don't want to take any risks heh.
I used GrokBot yesterday to manage my trip to a town three hours away. The night before I threw requirements at it and it set up the itinerary and shopping list nicely. It missed some details, like that fact that my dentist appointment time was fixed, but surprisingly found others, like that part of my route that should be done in daylight due to the deer and elk population. It spotted a road closure and plotted an alternate route and schedule that I turned out not to need, but changed the departure time.<p>I chatted with it in voice mode as I drove around town. It researched stores with good selections of webcams or kimchi, then a cheap gas station on my route home.<p>Not at all perfect, but smooth enough that this will now be standard operating procedure. I just started using it last week and now have a half a dozen bots running, and ideas for more keep arising.
I've also noticed anything related to GrokBot gets massively boosted on X, which is probably serving as a huge marketing channel. Plus anyone with a Cursor subscription gets access.
I know someone who isn't an Elon fan at all but has switched completely from Dot to Grokbot. Most of their company has done the same and now they are contemplating cancelling their OpenAI plans (they still use Claude heavily, but Duet isn't available on Teams plans).
Most people probably wouldn’t cop to the real reason they use the CSAM and non-consensual nudes generator
Ive never had a meta account. Zuckerberg still has all my data and knows everything about me. At some point people decide its not worth hiding from mega corps
That's because HN is an echo chamber. Plenty of tech people use and enjoy Muse/Instagram/Facebook, but the would be downvoted if they expressed it.
[flagged]
Note to everyone writing blog posts: Please start your post with one or two sentences explaining what you're posting about.<p>What is Duet? I have no idea even after skimming the article.<p>Edit: first google result is <a href="https://www.duetdisplay.com" rel="nofollow">https://www.duetdisplay.com</a>
Well the start the article saying they're not affiliated with Anthropic, and then talk about "Duet", saying "<i>anthropic has done it again</i>". They then list a handful of products they've tried, including "a host of other personal-assistant-type harnesses".<p>Is it not obvious that this is an Anthropic-made "personal-assistant-type harnesses"?<p><a href="https://claude.com/resources/articles/claude-duet" rel="nofollow">https://claude.com/resources/articles/claude-duet</a>
I could deduct some of that from this sentence, sure.<p>But I wrote this comment because the article was frustrating for me to read. One single sentence would've made it much less confusing:<p><pre><code> Look, I really didn’t want to like **Claude** Duet, **Anthropic's new personal AI assistant**. I don’t want to be an Anthropic fanboy and ...
</code></pre>
I'm also known to flag this kind of shortcoming in all technical documentation I review, and it annoys a lot of people that I do. I've put my judgement to the test already a few times in team meetings when someone objected this specific remark. Many times I could prove that there are always a few people in the room that would've benefited a lot from such a simple clarification. They just didn't speak up or ask, because they thought they were the only ones that didn't know a specific term.<p>My intention is also not to be rude, just creating some awareness for this issue.
The first two sentences menthon anthropic so its this. <a href="https://claude.com/resources/articles/claude-duet" rel="nofollow">https://claude.com/resources/articles/claude-duet</a>
Meh, I think it's fine for blog posts to assume familiarity like this if it reflects their niche. They're writing for the type of person who already knows what Duet is. It's not the NYT where there's a massive general audience.<p>In fact, the choice not to explain things tells me a lot about the shared knowledge of a niche when I'm looking in from the outside. I don't mind the extra digging to decode it and the implied familiarity gives me information about its importance.
[flagged]
[Anthropic Claude] Duet is the future of chatbot interaction
Every time I see an article about another agentic harness all I can think is "people still run other people's code?"<p>In all seriousness, the complaints here just feel like UI friction you can address yourself if you just build your own harness (e.g. snappy replies -> parallel threads and appending to common context).
I’m on the same opinion. Why do I need to limit myself to something proprietary and in somebody else’s control when I can build and morph a tool to my needs.<p>The only reason I even look at frontier lab apps is for inspiration or shortcuts to my own implementation.<p>Using their apps feels like QA testing a trainwreck anyway with all of their UI/UX being an afterthought.
It is just rsync after all right?
These kinds of replies always astound me. Like, I have a better use for my attention and token limit than building and fiddling with my custom agent harness?
Depending on what you need, you can build a custom harness via pi <i>really fast</i>. I tried OpenClaw for weeks, and it took me a <i>lot less</i> time building my harness than trying to figure OpenClaw out.
I think it's more cron jobs, RESTful-type wait and react methods, and a harness that is calibrated to being a good assistant.<p>i.e. It saw I had an optometry-type appointment this morning and supplied some questions I might want to ask or consider.