What you can actually hand to a personal AI agent

The pitch has not changed in two years. You will have a personal agent that understands your goals and works on your behalf around the clock, so you can stop doing the parts of your week that are just clicking. Every large vendor now sells a version of it, and on 3 June 2026 Meta shipped the mass-market shape of the idea by putting a Business Agent inside WhatsApp, Messenger and Instagram, free to get started, with paid subscription offerings promised “in the coming months” [8]. The pitch is aimed at people who do not write code and do not want to configure anything.

What you can buy this month is narrower and metered, and that is the useful thing to know. The products are real, they do run jobs while you are asleep, and each one comes with a monthly allowance, a list of actions it will not take without asking, and a set of countries where it does not work at all. This guide is for a solo operator or small-team owner who already pays for one assistant and wants to decide which recurring jobs to hand over. It is not for developers wiring agents to APIs, and not for a company that needs a procurement review first. Prices are US list, fetched on 5 September 2026.

An agent is a chat model with a browser, a clock and your logins

Strip the marketing and the difference between an assistant and an agent comes down to three additions. The model gets a browser it can act inside, a clock so it can start work without you, and your credentials so the pages it opens are your pages.

You can see all three in the shipping products. Claude in Chrome is a browser extension that lets Claude “read, click, and navigate websites alongside you”, manage multiple tabs at once, and run “recurring browser tasks” automatically on a schedule; it is available on all paid Claude plans and is not supported on other Chromium-based browsers or on mobile devices [2]. Google’s Gemini Spark is described as “your personal AI agent that can automate complex workflows and manage schedules for ongoing tasks”, reaching Gmail, Calendar, Docs, Sheets, Drive, Keep and Tasks, plus web browsing [7]. OpenAI now describes ChatGPT Work as “an agent designed for longer, multi-step work and finished deliverables”, which can “run once, repeat on a schedule or trigger, or monitor for changes”, with event triggers on new Gmail messages, new Slack channel messages and GitHub pull request activity [5].

That is the whole category. Nothing here reasons better than the chat window you already use. It just has hands, an alarm clock and a keyring, and every benefit and every new risk follows from those three things.

The mass-market version arrives where you already are

Meta’s announcement is worth reading as a distribution move rather than a technology one. Its Business Agent answers questions specific to a business, makes product recommendations from a business catalog, books appointments, qualifies incoming leads and closes sales, running across WhatsApp, Messenger and Instagram, where Meta counts “more than one billion active threads with businesses” every day [8]. More than one million businesses were already using a Business Agent on WhatsApp and Messenger at announcement, and getting started is free [8].

The durable lesson is not about Meta. The agent that reaches the most people is rarely the most capable one; it is the one already inside an app that people open without deciding to. For you that has two consequences. If your customers message you on a surface where an agent now answers instantly, an agent will answer them, and the only thing left to settle is whose. And you should stop waiting for a dedicated agent app to be worth adopting, because the capability is arriving inside the subscriptions you already pay for.

The monthly cap is the spec

Read the allowance before the feature list. Agent runs are metered in a way chat messages mostly are not, and the meter decides how much of your week can actually move.

Claude in Chrome is available on all paid plans, and the cheapest of those is Pro, listed at $20 per month billed monthly, or $17 per month with the annual discount at $200 billed up front [1][2]. Spark’s help page says it requires a Google AI Pro or Ultra subscription, and Google lists AI Pro at $19.99 per month and the cheaper AI Plus tier at $4.99, which does not qualify [6][7]. Spark also caps concurrency directly: “You can have up to 15 tasks running at a given time. You’ll have to wait for tasks to be completed before making another request” [7]. OpenAI’s help page for ChatGPT agent published a hard monthly figure, 40 messages per month on Plus and 400 on Pro, before the feature was retired in favour of ChatGPT Work, which “follows the same usage structure as Codex” rather than a flat message count [4][5].

Treat that as a budget of runs, not as a hire. Only one of those numbers is a published per-month agent allowance, the 40 messages OpenAI listed for Plus [4], and neither Anthropic’s pricing page nor Google’s Spark page states an equivalent monthly figure [1][6][7]. So plan against the number you can see rather than the one you hope for, and pick two or three recurring jobs to spend it on instead of pointing an agent at everything for a week and running dry.

The arithmetic is worth doing before you subscribe rather than after. A job that runs every weekday consumes about 22 runs a month on its own, so two daily jobs already sit above the 40-message ceiling OpenAI published for Plus [4]. Spark’s ceiling is shaped differently, a hard 15 tasks running at once with new requests waiting for the running ones to finish [7], which limits how much you can start in parallel rather than how much you can do in a month. Either way, two daily jobs and one weekly one is a realistic load for an entry-level paid plan, and that is a different product from the one in the pitch, where an agent watches your whole business without being asked.

The failure mode is an action, not a paragraph

When a chat model is wrong, you read a bad paragraph and delete it. When an agent is wrong, it has already clicked something. The vendors are unusually blunt about this. Anthropic writes that “the biggest risk facing browser-using AI tools is prompt injection attacks where malicious instructions hidden in web content could trick Claude into taking unintended actions”, says its current configuration reduces attack success rates to “less than 0.08%” in internal testing, and then states plainly that “the risk is not zero. Novel attacks may emerge that our evaluations didn’t cover, and a successful one could lead to outcomes like data exfiltration” [3].

The guardrails tell you where the vendors expect trouble. Claude in Chrome blocks access to adult content and pirated material sites, asks approval before accessing financial websites, requires confirmation for high-risk actions such as file downloads or sensitive data entry, and offers a manual approval mode where you review every action [3]. Gemini asks for review before “sending communications, modifying your data, making purchases, and submitting web forms”, and before a browser task starts it asks you to review the plan and warns that it “will choose which sites to use to complete the task, and it may share your personal info with those sites” [7]. ChatGPT agent paused on sensitive logins and prompted you to take control of the virtual browser, and while you held control “screenshots are not captured, which helps protect passwords and other sensitive data you enter” [4].

There is a second risk that is easier to overlook because nothing attacks you. A browser extension acting in your session sees whatever that session sees, so an agent asked to summarise a page in one tab is one instruction away from a tab holding a client’s contract or your own banking. The mitigation is dull and it works: keep the agent in a browser profile that only holds the logins the job needs, and close everything else before a scheduled run. That is why the vendors gate financial sites behind an extra permission rather than trusting the task description [3].

Anthropic also names the workflows to keep away from an agent: managing financial accounts or investments, handling legal documents or contracts, processing medical or health information, accessing work accounts with sensitive company data, and interacting with sites containing other people’s personal information [3]. Take that at face value. It is the vendor telling you where its own testing stops being reassuring, and no productivity gain on your calendar is worth arguing with it.

Start with the jobs that repeat, reverse and check fast

Three shapes work reliably today. The first is the scheduled pull: a recurring browser task that visits the same few pages every Monday and comes back with the numbers or the summary you would otherwise fetch by hand [2]. The second is triage inside a mailbox you own, which is one of the examples Google lists for Spark, summarising or archiving newsletters and unsubscribing from email lists [7]. The third is the long assembly job, where a research task or a draft deliverable runs on a schedule or a trigger and lands finished rather than as a chat transcript [5].

What they have in common is that a wrong result costs you a minute. An archived newsletter comes back. A bad summary gets deleted. Compare that with anything that spends money, signs, sends to a person whose opinion of you matters, or touches an account you cannot restore, and the asymmetry is obvious enough that it should be your only rule for what an agent gets.

A worked version of the first shape looks like this. You have three dashboards you check every Monday morning, and the numbers end up in the same sheet. The agent job is one sentence long: open these three pages, read these four figures, add a row to this sheet with today’s date. It runs on a schedule, it touches nothing that sends or spends, and checking it costs the time it takes to look at one row. If the layout of a dashboard changes, the row comes back wrong or empty, which you notice immediately, which is the property you are actually buying.

Two habits make the difference between an agent that saves time and one that quietly costs it. Give it the narrowest access that lets the job run, using a separate account for the connected service where the tool allows it. And watch the first three runs end to end before you let anything run unattended, because the failure you need to see is not the one the vendor documented, it is the one specific to your data.

Deterministic automation is still cheaper than an agent

If the steps are identical every time, you do not need judgment and you should not pay for it. A Zapier, Make or n8n workflow that moves a form submission into an invoice runs the same way on the thousandth pass as on the first, costs nothing per run in supervision, and fails loudly rather than creatively. An agent is for the version of that job where the steps vary, the page moved, the format is different every week, or the decision is whether this particular email deserves a reply at all.

The expensive mistake is spending an agent allowance and your review time on work a fixed automation already does. It is worth checking your list of candidate jobs for that before you subscribe to anything, because the jobs that feel most agent-shaped are often the ones that were only ever three steps and a trigger.

What still goes wrong

The names churn faster than your habits do. The OpenAI help page for ChatGPT agent now opens by saying “ChatGPT agent is no longer available” and pointing users to ChatGPT Work for longer, multi-step tasks instead [4][5]. That happened inside a year, to a flagship feature, and it will happen again, so build routines you can rebuild in an afternoon rather than workflows that assume a product name survives.

Availability is uneven in ways the marketing does not mention. Gemini Spark requires you to be 18 or older with a personal Google account rather than a work or school one, and is unavailable in the European Economic Area, Nigeria, Switzerland and the United Kingdom [7]. Claude in Chrome runs only in Google Chrome, not on other Chromium-based browsers and not on mobile devices [2]. If you work in an excluded country or live on your phone, the honest answer is that the current generation of personal agents is not for you yet.

The last problem is the one no vendor can fix for you. Confirmation prompts arrive while you are doing something else, and by the fourth week you approve them without reading. Google’s own documentation says that “Gemini can make mistakes and do unexpected things” [7], and Anthropic says the residual injection risk is above zero [3], which together mean the supervision is the product, not an inconvenience attached to it. If you are not going to read the prompts, do not give the agent anything worth confirming.