In 2026, four closed personal-agent products shipped within seven weeks of each other — Grok Bot, Meta Muse, OpenAI's dots and Cue by Manus — and all four landed on the same shape: a chat app in which each conversation is not a transcript but an agent. A bot with its own name, personality, model, computer and connected apps. You talk to them like contacts.
On Wednesday a repository called OpenMausBot collected roughly 1,190 stars in a day. It is the open version of that shape, Apache 2.0, by the developer Milind Soni, and explicitly declared an unofficial clone: "an independent project inspired by Grok Bot," unaffiliated with xAI, Meta, OpenAI or Manus.
The technical difference from the originals is where everything runs. Each bot is driven by one of the CLIs already installed and logged in on your own machine. A small harness server on 127.0.0.1 owns the agent processes, normalises their different protocols into one event stream and pushes it to the interface over SSE. Transcripts, keys and events live in a local directory, not a cloud. The app holds no transports of its own: it sends typed commands over HTTP.
Each bot also gets a computer — a Linux desktop in the cloud, an isolated local VM, or, where the platform certifies it, your own machine. On macOS and Ubuntu under Xorg, host control is available after explicit opt-in; on Wayland it stays switched off until a safety issue is resolved. That is the right direction: fail closed rather than ship a disclaimer.
Then come the approval cards. Shell commands, file edits and questions surface as cards in the chat — allow, deny, or answer — and a permission broker turns every risky action into a decision you make. A Composio integration connects hundreds of apps over OAuth: mail, Slack, GitHub, Notion.
Why it matters: the form was decided before anyone evaluated it. An assistant in one window was last year; this year it is a team you treat like colleagues — delegate, watch, approve. The clone is interesting because it moves the trust boundary: the same capabilities — other people's inboxes, a whole computer, tools holding real credentials — now run on hardware you control. That removes the vendor from the equation, not the risk.
And the risk is concrete. An agent with mail and filesystem access is an attack surface that an approval dialog does not solve, because the most dangerous action is rarely the one that looks like a shell command. OpenMausBot is honest about its state: "early but real." API keys sit in plaintext in a config file (with restrictive permissions), dictation is macOS-only, and the Windows installer is unsigned. Anyone deploying it for real work should read those three lines first.
