Two AI helpers that act for you: only one tells you its rules

Two AI helpers now offer to work inside your email and business apps, and only one has told the public when it must stop and ask you first. Anthropic's Claude Duet comes with a published list of approvals and limits. Grok Bot, from SpaceXAI, has a run of dated feature launches but no published approval rules.

What Duet promises

Anthropic published its page on 21 October 2026. Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you what it is about to do and waits for approval. The rule covers the type of action, so a scheduled job and a request you typed hit the same checkpoint.

Some things are off limits even with your approval, including trading securities and moving money between accounts. A separate safety check also blocks requests to share credit card numbers and government ID.

What is known about Grok Bot

SpaceXAI's own documentation returned an access error for every attempt to load it. What follows comes from earlier coverage, as of 21 October 2026, and is not the vendor's specification.

• 11 August 2026: an early beta gave each Bot its own cloud computer that signs into Gmail, a CRM and web apps.
• The Bot comes back to you when a decision or approval is needed.
• Later additions include Android, shared Team Bots, X monitoring and a claimable @mail.grokbot.com address.
• None of these updates is an approval rule.

The record does not say which decisions count, or whether a scheduled routine is treated like a one-off request.

The login question

Anthropic says Duet follows the design of its Claude Managed Agents, so the agent never directly sees your passwords or sign-in tokens. A Bot with its own computer signed into Gmail is effectively signed in as you. Earlier reporting did not establish how those logins are stored or whether the model can read them.

Gaps on both sides

Anthropic says you can disconnect any app Duet uses. It does not say what happens to what Duet already learned from that app. It also describes no reset covering memory and scheduled tasks. That is a gap in the documents, not proof of bad behavior.

The fair comparison is not that one product is safer. Duet's rules are narrower and written down. Grok Bot's are broader and undocumented, so only Duet can be checked in advance.

What to do

Before connecting work email or client files to any AI agent, ask two things: what can it do without asking you, and how does it store your logins. Ask about retention too, and re-check vendor pages before you buy.