Four Personal AI Agents, Compared Through the Lens of Trust

Peter Yang compares four personal-agent setups with access to potentially sensitive information: Instinct, Grok Bot, ChatGPT and Codex, and Hermes. He explores convenience and account access through his own examples; his trust judgments are subjective and features or policies may change.

In his setup, Instinct works through messaging, Grok Bot uses a persistent cloud computer, ChatGPT handles cloud work while he uses Codex locally, and Hermes runs on his Mac mini. These descriptions reflect the configuration shown in the video, not an exhaustive security assessment.

Yang likes Instinct’s simple message-based interface and proactive follow-ups. He asks it to investigate subscriptions and says it cancels a renewal after requesting authentication information. He is uncomfortable sharing a password and two-factor code with an agent, even though he did so for the demonstration.

For a golf lesson, Instinct drafts an email and monitors for a reply before Yang confirms a new time. A restaurant request ends with him needing to call himself. A movie-ticket example describes an approval step for payment, but he does not show a completed ticket purchase.

Yang reviews Instinct’s policy and says disconnecting an integration does not automatically delete previously collected data; he shows a separate deletion control. This is his reading at the time, so current policies and the actual scope of deletion should be checked directly.

Grok Bot organizes multiple bots on a shared cloud computer. Yang uses them for website reporting, AI news, YouTube research, digital cleanup and family tasks. He is more comfortable with official integrations than entering credentials into a cloud browser.

He says deleting an individual bot does not necessarily clear shared files or browser sessions. The reset control shown appears to restore a saved snapshot, and he is unsure how to fully wipe the computer. His uncertainty is part of the result; the demonstration does not establish that any particular cleanup method is complete.

For work, Yang mainly uses ChatGPT and Codex and describes cloud and local workflows. He discusses a consumer data-control setting and his trust in the provider. Product behavior and privacy controls depend on account type and current documentation, and his confidence is not a guarantee against a leak.

Hermes runs on his Mac mini and communicates through Telegram in his setup. It provides briefings and scheduled health reports. Yang says its documentation describes local storage of conversations, memory and skills, while model providers may still receive information required to answer requests.

Yang cites a reported test by Alex Cohen in which an instruction placed in an email caused an agent to send a summary to another address controlled by the tester. It illustrates prompt injection: untrusted material can contain instructions that attempt to redirect an assistant. Yang says the product later described safeguards, but he cannot verify their effectiveness from the conversation alone.

He recommends reviewing apps connected to a Google account and removing access that is no longer needed. His demonstration suggests using an agent to prepare a list and assist with the browser work. The user should inspect each app and the consequences before revoking access; disconnecting access does not necessarily delete data previously held by a third party.

Yang’s conclusion is to match permissions to the task. He might delegate price comparisons but wants to review a non-refundable booking and is cautious with bank credentials and cloud-browser logins. His preferred tools reflect his own workflow rather than a universal ranking of security.