What always-on AI agents cannot do yet: 12 limits to know before you rely on one

The short answer: always-on agents are useful for repeating, checkable jobs, and unreliable for anything that needs judgement, trust or a signature. The four main products are new (two are in preview or beta, two are still rolling out), their makers admit specific weaknesses, none has published results, and several details that matter to a business, such as how long data is kept, are not stated. Use them with approval on, on low-risk jobs, and expect to supervise. Below are 12 limits, marked as either stated by the vendor or our view.

Sources are the vendors' own pages: Anthropic and its safety page for Claude Duet, OpenAI for ChatGPT dots, Meta for Meta Muse and xAI for Grok Bot. Checked on 29 October 2026; these products change quickly, so check the vendor's page before you rely on a limit listed here.

1. They can misread a message or what is urgent

Stated by Anthropic for Duet: it "still might misread a thread or miscalibrate what's urgent." Expect the same from every agent. What to do: never use an agent as the only reader of a channel where a missed message costs money. Keep a human glance at anything it marks low priority, and ask it to quote the line it based each decision on.

2. Approval fatigue defeats the safety net

Stated by Anthropic: "Approval fatigue is a serious issue." Duet, Muse and dots all ask before they send, pay, sign or delete; if you approve a long list without reading, the check does nothing. What to do: keep jobs small so each approval is a few items, read the content (the recipients, the figures), and do not tick "don't ask me again" on risky steps.

3. Instructions can hide in emails and web pages

Our view, supported by Anthropic's safety page: page text and downloads come back to the agent, and a message you did not write can contain text aimed at steering it. This is a known weakness of agents that read untrusted content. What to do: test it on purpose (a harmless fake instruction in a test email), keep sending and paying on approval, and do not connect the agent to accounts it does not need.

4. They are weaker at personal errands and cannot always show their work

Stated by Anthropic: Duet is weaker at errands such as booking tickets because its core was built for work, and it cannot yet show you its browser. What to do: use it for office jobs. If you cannot watch what it did, rely on its activity log and keep the stakes low.

5. Usage limits are shared and can run out

Stated: Duet "uses the same usage limits as the rest of Claude", and its background checks count; bigger jobs such as a financial model or a deck use them up quickly (Anthropic). OpenAI says conversations with a dot do not count toward ChatGPT limits but tasks it starts in Codex or ChatGPT Work do, and the extended limits last only the first month. Muse meters in weekly tokens. What to do: watch the meter for the first week, and do not judge normal usage from a promotional first month.

6. The price after the launch period is unsettled

Stated by OpenAI: after the first month it will "share usage terms for each plan". Grok Bot has no standalone price and its own usage inside X Subscription tiers. Our view: budget for the plan, not the promotion, and do not upgrade a plan only to test a brand-new feature.

7. Many people cannot get them yet

Stated: Duet is a US waitlist for Pro and Max subscribers (no Team or Enterprise plan). Muse is in the US and Canada and, per Meta's help centre, "in limited testing and isn't available in all locations yet". ChatGPT Pro does not offer dots in the UK, the EEA or Switzerland; Business Premium does. xAI states no regions for Grok Bot. What to do: check your country and plan first; the comparison lists each.

8. Privacy and training defaults are unclear or differ

Stated: Anthropic's Duet safety page does not state how long data is kept or whether it is used for training, and describes no admin controls. Memory persists until you reset it, and disconnecting an app does not erase what was learned. Meta offers a training opt-out. OpenAI keeps Business content out of training by default. The xAI pages we checked say little. What to do: read the terms before connecting customer records, and start with data you could email to a stranger.

9. There are no published results

Our view: none of the four vendors has published accuracy tests for these agents on business tasks, so any claim of hours saved is a guess, including ours. What to do: run one job for two weeks and count your own hours; see how to run the first two weeks.

10. They are only as good as the documents you give them

Our view: an agent that drafts replies from your policy is only as accurate as that policy. If it is out of date, contradictory or missing, the agent fills the gap with a confident guess. What to do: give it one clear, current document per job, and tell it to say "not in the document" instead of guessing.

11. You depend on one vendor's product

Our view: a standing job built inside one vendor's agent does not move easily. Plans, regions and terms are changing monthly. What to do: keep the brief (the written job) in your own files so you can run it in a different tool, and keep a plain tool for anything critical, such as a booking system that sends its own reminders.

12. They are new, and things will break

Stated: Duet is a research preview, Grok Bot is in public beta, Team Bots are in public beta, Muse is in limited testing and dots are still rolling out. Anthropic says Duet's settings "are still changing". What to do: do not build a process that fails badly if the agent has a bad day, and keep a manual way to do the job.

What these limits mean in practice

They do not mean "do not use agents". They mean: choose a job with a small downside, keep approval on, review every day at first, keep customer records out until you have read the terms, and judge by your own numbers. The right match between job and tool matters more than the tool. Use our Should AI do it? checker to see whether a job suits an agent, a plain tool or a person, and read what an always-on agent can automate for jobs that fit.

Get an honest plan for your business

A Business AI Plan ($99 once, with an optional $29 a month) is built around exactly these limits: it ranks your opportunities, says for each task whether you, AI or a plain tool does it, and keeps a person on every send, spend, publish and delete. Start with the free 2-minute AI plan finder.

Frequently asked questions

Can I trust an AI agent with customer emails? With approval on, yes for drafts you review. Without it, no: agents make confident mistakes and can be steered by text in a message.

Are always-on agents safe? Not risk-free. The vendors build in approvals and limits, but they admit gaps and some privacy terms are not stated. Test on low-risk jobs first.

Will an AI agent replace an employee? No. Treat it as a fast assistant that still needs supervision.

What is the biggest risk? Approving without reading. The safety features only work if a person checks what is about to happen.

Which agent has the fewest limits? None is clearly ahead. Which limits matter depends on your country, your plan and the job; see our comparison.

When will these limits go away? We cannot say. Check each vendor's page; we update our guides when they change.

Sources: Anthropic: Introducing Claude Duet, Anthropic: Claude Duet safety, privacy and security, OpenAI: introducing dots, OpenAI help: getting started with your dot, Meta help: Muse subscriptions, Meta: introducing Muse, xAI: X Subscription, xAI: introducing Grok Bot. Checked 29 October 2026.

Disclosure: Dapols uses Claude, an Anthropic product, to help draft and research its articles.