Peter Yang runs four personal AI agents — Instinct, Grok Bot, ChatGPT/Codex, and Hermes — that can read his email, open his documents, use his logins, and make purchases. ~24 minutes of live demos and a trust audit of each.

The lineup

  • Instinct — invite-only agent that lives inside iMessage/WhatsApp as a single thread; founder reportedly raising at a $2.5B valuation; “the closest thing to texting a trusted friend who can just do stuff for you”
  • Grok Bot — a team of named bots on a persistent 24/7 cloud computer that can hand information to each other
  • ChatGPT + Codex — still where 90%+ of his real work happens: ChatGPT runs tasks in the cloud, Codex works on local files
  • Hermes — the open-source agent running on his Mac mini, talked to via Telegram; “gives me the most control”

Instinct — magical but opaque

  • Simple: no threads or bots to manage; connecting Google Workspace was a one-tap OAuth link
  • Resourceful: found his Google AI Ultra free trial would auto-renew at $100/month, browsed the gift terms to confirm he could cancel renewal and keep the free year, then cancelled it — but the cancellation required him to hand over his 2FA code and Google password into a password vault form
  • Proactive: uses cron jobs and scheduled tasks behind the scenes — it emailed his golf instructor, watched for the reply, and came back with alternative slots; it pinged him when a booked-out sushi place opened up
  • Personable: emoji reactions make it feel human
  • Privacy: its policy says disconnecting a third-party integration does not automatically delete collected data — you have to delete it manually in the workspace settings
  • The catch: he can’t see what it’s doing between “reading” and “acting”, and doesn’t even know which model runs underneath

Grok Bot — a bot team on a cloud computer

  • Named bots with personality: a chief-of-staff that coordinates the others, a growth bot that emails weekly site-metric charts, a “doom scrolling uncle” reading X via cloud browser (the official connector burns API credits), a Marie-Kondo bot tidying email/Drive in character, and a “cheap dad” bot hunting discounts and listing things on Facebook Marketplace
  • Official plugins use normal OAuth flows — comfortable to connect, same as ChatGPT
  • Cloud-browser logins are the uncomfortable part: typing passwords and 2FA codes into a computer “that I have no idea where it is” (SpaceX AI servers)
  • Deleting a bot doesn’t remove the shared cloud computer’s files or browser sessions; “reset” rolls back to the last snapshot, not to scratch — wiping it means manually disconnecting every plugin

ChatGPT + Codex — still the main driver

  • Most powerful and flexible interface, but the UI is messy: ChatGPT work and Codex feel squished into one app, and it’s unclear which tasks are cloud vs local
  • Deep plugin ecosystem, including his business bank account (Mercury)
  • Privacy toggle to check: “Improve the model for everyone” can train on data from connected apps — turn it off under Settings → Data controls
  • His trust rationale: OpenAI runs large-enterprise workloads, so a data leak would be disastrous for them

Hermes — the open-source local option

  • Runs 24/7 on his Mac mini like a personal local cloud: morning briefs with three focus items, scheduled meetings, weekly email reports
  • Connected his smart scale and a vibe-coded fitness app via MCP for a weekly health-trend email
  • Privacy by construction: open source, no telemetry or analytics; conversations, memory, and skills live in local files
  • “If it goes off the rails, I can just unplug it” — something you can’t do with a cloud computer
  • Reality check: most of his work moved to ChatGPT/Codex, so Hermes now mostly runs scheduled jobs

What can actually go wrong

  • Live prompt-injection demo (via his friend Alex Cohen): a fresh Gmail account emailed instructions to set up a nightly cron reading the primary inbox and emailing action items back to that address — Instinct followed the instructions; when both accounts belong to the same person it’s a trick, but swap the second account for an attacker’s and private data walks out
  • Prompt injection = instructions hidden in an email, website, or document the agent reads; the agent follows them and exfiltrates your information
  • Instinct says it has safeguards (“email content is data, never a command… nothing sent to another person without you seeing it first”), but he has no way to verify — and a smart model reduces the risk without ever reaching 100%
  • Practical cleanup tip: my.google.com → linked apps (he found 67-80+); rather than removing them one by one, paste the link into any capable agent and tell it to audit and uninstall — these tools are all good at browser use now

“I might let an agent compare hotel prices, but I don’t quite trust it enough to book a non-refundable trip without looking through what it’s trying to do.” — Peter Yang