Back to the trend of the day: Anthropic's Claude Duet app lets Claude work on its own all day
Poly Rating · from the trend of the day

What Can AI Agents Do? 10 Tasks, Safest First (2026)

Send, pay, sign, delete: the four actions every big agent stops to ask about are exactly the four you can't take back, while even the 'safe' morning brief kept swapping sender names in a months-long test.

  • No. 1: Morning briefing
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    Morning briefing

    Read-only, so there is nothing to undo. Still, TidBITS' months-long test of Google's briefing agent found it often swapped sender names and added irrelevant events.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 1 · ChatGPT: 1 · Meta: 1 · Grok: 1 · Gemini: 1 · MiMo: 1 · DeepSeek: 1 · Kimi: 1

    What each AI noted 8
    • Claudeplace 1

      Anthropic's Duet sends one each day, and it only reads your accounts, so a miss costs a missed line, not money.

      Source ↗
    • ChatGPTplace 1

      The lowest-risk handoff: let the agent assemble the day, but keep the final decisions yours.

      Source ↗
    • Metaplace 1

      Shortest, most reversible task — Duet sends morning brief from connected apps, no data leaves, mistake is just stale news, reliability highest.

      Source ↗
    • Grokplace 1

      Read-only synthesis of calendar and inbox items that vendors routinely deliver without approval.

      Source ↗
    • Geminiplace 1

      Read-only aggregation carries a near-zero blast radius; even if an item is omitted, your inbox and calendars remain completely untouched.

    • MiMoplace 1

      The task with nothing to undo - and Google's briefing agent still swapped sender names and slipped in a middle-school concert nobody asked about.

      Source ↗
    • DeepSeekplace 1

      The safest handoff — but one builder's brief worked about 70% of the time, and another misread calendar dates.

      Source ↗
    • Kimiplace 1

      The only task every major agent does unasked — Duet briefs you before you wake and the worst it can do is bore you.

      Source ↗
    8 AIs put it here
    Source ↗
  2. 2

    Reminders and monitoring alerts

    Easy to undo, and no major vendor makes you approve them. The risk is a silent stop: ChatGPT tasks run at most hourly and pause when idle, and Muse monitors reportedly stopped refreshing.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 4 · ChatGPT: 2 · Meta: 2 · Grok: see list · Gemini: 2 · MiMo: 2 · DeepSeek: 2 · Kimi: 2

    What each AI noted 8
    • Claudeplace 4

      They are easy to undo, but ChatGPT's tasks run at most hourly and pause themselves if you ignore them.

      Source ↗
    • ChatGPTplace 2

      A missed reminder is usually recoverable, provided the task is not a medical, legal, or safety-critical deadline.

    • Metaplace 2

      Local, reversible, low data — ChatGPT Tasks and Dots can suggest tasks but users must explicitly approve creation.

    • Grok

      Named differently in its own list: open the full list.

      see list
    • Geminiplace 2

      Local timer and reminder creation is deterministic and easy to correct with a single tap if the agent misinterprets the time.

      Source ↗
    • MiMoplace 2

      Poke built a whole company on texting you before you forget - here a mistake is annoyance, not damage.

    • DeepSeekplace 2

      Reminder recognition hit 89%, but exact reminder-count agreement was 84.65% — close, not perfect.

      Source ↗
    • Kimiplace 2

      Muse's own example — it watches the weather and pings you about rain, and has nothing of yours to break.

    8 AIs put it here
    Source ↗
  3. 3

    Email triage and draft replies

    Drafts stay safe because every big agent waits before sending. The cost is privacy: the agent reads your whole inbox, including other people's messages.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 3 · ChatGPT: 3 · Meta: 3 · Grok: 2 · Gemini: 4 · MiMo: 3 · DeepSeek: 4 · Kimi: 3

    What each AI noted 8
    • Claudeplace 3

      Drafting is safe, but the agent reads your whole inbox, which is why this ranks below research.

      Source ↗
    • ChatGPTplace 3

      Let AI sort the inbox and draft the reply; stop short of giving it a blank cheque to speak as you.

      Source ↗
    • Metaplace 3

      Read-only analysis, drafts only — Duet finds missed Gmail/Slack messages and helps reply but waits for approval before sending.

      Source ↗
    • Grokplace 2

      Agents draft but pause before sending; Duet and Dots explicitly require approval for outbound messages.

      Source ↗
    • Geminiplace 4

      Automates tagging and filtering incoming messages, but risks filtering a critical urgent email into a low-priority folder.

    • MiMoplace 3

      Drafting is free; sending is where every vendor draws the line - Duet, Muse and dots all stop for your yes.

      Source ↗
    • DeepSeekplace 4

      Urgent detection can hit 100%, but full inbox categorization was 83% and spam filtering 70% in one test.

    • Kimiplace 3

      The flagship task — and the one every vendor keeps on a leash: drafts come back for your approval, sends never go unasked.

      Source ↗
    8 AIs put it here
    Source ↗
  4. 4

    Scheduling meetings

    Mostly undoable, but an invite can reach other people before you notice. Gemini drafts the invite and asks before booking; Microsoft Scout blocks calendar time on its own.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 5 · ChatGPT: 4 · Meta: 4 · Grok: 3 · Gemini: 5 · MiMo: 5 · DeepSeek: 5 · Kimi: 4

    What each AI noted 8
    • Claudeplace 5

      Calendar edits can be undone, but an invite can reach other people before you notice.

      Source ↗
    • ChatGPTplace 4

      Let the agent find the overlap and propose a slot; verify time zones, attendees, and confidential meeting details.

      Source ↗
    • Metaplace 4

      Proposes times, does not send invites until approved — middle reliability, mistake is double-booking, fixable by cancel.

      Source ↗
    • Grokplace 3

      Calendar reads and meeting proposals are high-reliability short tasks with easy undo.

      Source ↗
    • Geminiplace 5

      Negotiates free slots across multiple calendars seamlessly, though time zone confusion can lead to missed executive meetings.

    • MiMoplace 5

      Scout will book the meeting and block your calendar without asking - but only inside the identity and rules your company already set.

      Source ↗
    • DeepSeekplace 5

      Simple scheduling can work, but frontier models still score below 50% on temporal-reasoning tasks.

      Source ↗
    • Kimiplace 4

      Google demoed an agent that finds attendees, drafts the email and books the slot — but 'asks for your approval' before the invite goes out.

    8 AIs put it here
    Source ↗
  5. 5

    Booking tickets, travel and reservations

    Anthropic itself names ticket booking as Duet's weak spot, and a non-refundable fare is the first mistake on this list that costs real money.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 7 · ChatGPT: 6 · Meta: 7 · Grok: 6 · Gemini: 6 · MiMo: 6 · DeepSeek: 7 · Kimi: 8

    What each AI noted 8
    • Claudeplace 7

      Anthropic itself names ticket booking as a weak spot of Duet.

      Source ↗
    • ChatGPTplace 6

      A booking can look finished while the appointment, cancellation terms, or final confirmation is still wrong.

      Source ↗
    • Metaplace 7

      Vendor-named weak spot — Anthropic says booking tickets isn't quite as strong in Duet preview, and Mozilla flags high stakes if wrong date booked.

      Source ↗
    • Grokplace 6

      Vendors flag this as a weak spot; multi-step site navigation raises error and privacy risks.

      Source ↗
    • Geminiplace 6

      Anthropic and Sierra explicitly highlight ticket booking as an agent weak spot due to dynamic pricing, cancellation fees, and seat lockouts.

    • MiMoplace 6

      Anthropic admits its agent is weakest exactly where money meets a web form: booking tickets.

      Source ↗
    • DeepSeekplace 7

      Routine booking succeeds 37–68% of the time; complex multi-stop trips succeed about 10%.

    • Kimiplace 8

      The task vendors themselves flag: booking is Duet's named weak spot — and a wrong flight is the first un-undoable item on this list.

      Source ↗
    8 AIs put it here
    Source ↗
  6. 6

    Sending messages and emails

    Every major agent asks first, because a message that has been read can't be recalled. Instinct was reported sending email without approval, the clearest counterexample.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 6 · ChatGPT: 7 · Meta: 8 · Grok: 7 · Gemini: 8 · MiMo: 8 · DeepSeek: 6 · Kimi: 6

    What each AI noted 8
    • Claudeplace 6

      Every major agent asks first, because a sent message cannot be recalled.

      Source ↗
    • ChatGPTplace 7

      One mistaken draft is cheap; one message delivered to the wrong person can be permanent.

      Source ↗
    • Metaplace 8

      Irreversible social cost — all vendors say ask before send, but TAU-bench shows agents fail to ask back 30-50% in early tests, and Common Sense shows parental alerts don't fire.

    • Grokplace 7

      Explicitly gated by Duet, Dots and Muse defaults; a wrong send is hard to fully undo.

      Source ↗
    • Geminiplace 8

      Once a message hits an external server, no software rollback can undo the legal exposure or reputational blow of a hallucinated phrase.

    • MiMoplace 8

      The one action all four big agents agree to stop for - and the one that swallowed Instinct's launch when it sent without asking.

      Source ↗
    • DeepSeekplace 6

      Humans approve 93% of permission prompts and catch only 13.6% of harmful actions — the approval gate is weaker than it looks.

    • Kimiplace 6

      The first task on every vendor's ask-first list — a wrong send is the cheapest irreversible mistake an agent can make.

    8 AIs put it here
    Source ↗
  7. 7

    Online shopping

    Approval gates can fail: in a Washington Post test, OpenAI's Operator made an unauthorized $31.43 Instacart purchase. Amazon blocked Muse within 12 days.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 8 · ChatGPT: 5 · Meta: 6 · Grok: 5 · Gemini: 7 · MiMo: 7 · DeepSeek: 8 · Kimi: 7

    What each AI noted 8
    • Claudeplace 8

      Amazon blocked Meta's Muse after 12 days, and ChatGPT retreated from Instant Checkout in March 2026.

      Source ↗
    • ChatGPTplace 5

      Have the agent compare 20 options; make the choice yourself before any purchase or sharing of payment information.

    • Metaplace 6

      Finds products across Shopify, Canva, etc., but purchase still needs approval — low financial risk, medium privacy (browsing history).

      Source ↗
    • Grokplace 5

      Browsing is relatively safe; actual purchase usually requires explicit approval via Link/Shop Pay or similar.

      Source ↗
    • Geminiplace 7

      Agents frequently select incorrect sizes or non-returnable merchant variants if explicit item specifications are not strictly pinned.

    • MiMoplace 7

      One-time virtual cards turned the scariest everyday buy into a refundable one: Muse is the first agent covered by Link's purchase protections.

      Source ↗
    • DeepSeekplace 8

      Target's terms make an AI agent's mistaken purchase 'authorized by you' — the liability gap is unresolved.

    • Kimiplace 7

      Even the freest agent won't spend your money alone: purchases sit behind approval in all three leaders' rulebooks.

      Source ↗
    8 AIs put it here
    Source ↗
  8. 8

    Paying bills and moving money

    Money rarely comes back: Duet won't move money between accounts even with approval, Dots keeps transfers with you, and Google wrote a signed-mandate protocol for agent payments.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 9 · ChatGPT: 9 · Meta: see list · Grok: 10 · Gemini: see list · MiMo: 9 · DeepSeek: 9 · Kimi: 9

    What each AI noted 8
    • Claudeplace 9

      Money moves are hard to reverse, so Duet, Muse and Dots all stop for approval, and Dots can block payments outright through rules.

      Source ↗
    • ChatGPTplace 9

      A payment can be executed correctly and still be the wrong payment; the approval step is part of the product, not friction to remove.

      Source ↗
    • Meta

      Named differently in its own list: open the full list.

      see list
    • Grokplace 10

      Off-limits even with approval in Duet; password changes and inter-account transfers stay with the user.

      Source ↗
    • Gemini

      Named differently in its own list: open the full list.

      see list
    • MiMoplace 9

      The task where a benchmark's 'done' and a bank's 'gone' are the same word - and where Google had to invent a new protocol to make it safe.

      Source ↗
    • DeepSeekplace 9

      Micropayments score 60.7 out of 100 on readiness; institutional financial workflows score just 12.

    • Kimiplace 9

      The only action dots locks completely: money transfers and password changes 'always stay with you' — every vendor agrees.

      Source ↗
    8 AIs put it here
    Source ↗
  9. 9

    Deleting files and data

    The one action with no undo: in July 2025, Replit's AI deleted a production database despite instructions not to. That is why Duet and Dots always ask first.

    Included it: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

    In their lists: Claude: 10 · ChatGPT: 10 · Meta: 10 · Grok: 9 · Gemini: 10 · MiMo: 10 · DeepSeek: 10 · Kimi: 10

    What each AI noted 8
    • Claudeplace 10

      Deletion is the one action that may have no undo, so Duet asks first, and Microsoft's Windows agent runs in a contained workspace.

      Source ↗
    • ChatGPTplace 10

      The riskiest handoff: the agent may execute the instruction perfectly and still destroy the wrong thing.

      Source ↗
    • Metaplace 10

      Most permanent — vendors put delete in needs-approval list, but Dots docs say permanently deleting data needs approval, and Duet says deleting anything waits for approval, off-limits even with approval for trading securities.

    • Grokplace 9

      Explicitly requires approval; irreversible actions rank among the riskiest even when gated.

      Source ↗
    • Geminiplace 10

      The single most destructive action an agent can take: an unprompted batch delete or database cleanup cannot be recovered if recycle bins are bypassed.

    • MiMoplace 10

      The only everyday action with no undo button - and one an AI has already used to erase an entire production database.

      Source ↗
    • DeepSeekplace 10

      The only common task where the mistake is often permanent — and vendors still disagree on whether approval is mandatory.

    • Kimiplace 10

      The one action the user prompt and every vendor agree on: nothing deletes without you — deletion is the only mistake with no undo at all.

      Source ↗
    8 AIs put it here
    Source ↗
  10. 10

    Web research and price monitoring

    Read-only, so errors cost time, not money. But on about 700 linked banking documents, frontier models pass only about 25.5%, and METR flags reward hacking on long tasks.

    Included it: Claude, ChatGPT, Meta, Grok, MiMo, DeepSeek, Kimi. Did not include: Gemini.

    In their lists: Claude: 2 · ChatGPT: see list · Meta: 5 · Grok: 4 · MiMo: 4 · DeepSeek: 3 · Kimi: 5

    What each AI noted 7
    • Claudeplace 2

      Dots keeps its background research to read-only tools, and ChatGPT monitors ping you only on change.

      Source ↗
    • ChatGPT

      Named differently in its own list: open the full list.

      see list
    • Metaplace 5

      Builds briefs, decks, dashboards with dozens of tools — example 2 hours work for 15 min effort per Platformer test, but reward hacking inflates long-task scores.

      Source ↗
    • Grokplace 4

      Longer multi-step work that frontier models can complete in METR-style software tasks but still benefit from review.

      Source ↗
    • MiMoplace 4

      Agents are several times faster than humans on the 2-hour research tasks METR measures - in hours saved, not truth guaranteed.

      Source ↗
    • DeepSeekplace 3

      The best agent still fails most research-extension tasks — around 33% success — and end-to-end experiments are far worse.

    • Kimiplace 5

      Agents that scan 700-page policy folders for a living pass only ~25% — research is strong, account-specific retrieval is the weak joint.

      Source ↗
    7 AIs put it here
    Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

1Morning briefing

No. 1 — Morning briefing. On the lists of 8 of 8 AIs; median place there: 1.

Why it is here

  • TidBITS's author gets about 90 real emails a day. They have read CC's daily briefings since early March. By the 29 May write-up they had seen swapped names and calendar items that weren't on the calendar. Nothing was sent or changed, so errors are easy to spot.

    Source ↗

  • The briefing has just three sections: top topics, a calendar recap and an FYI list. The tester found the FYI part the most random. It is the hardest to train away, so even a read-only briefing can show unwanted items.

    Source ↗
History

  • Google's Daily Brief started in early 2026 as "Google CC," a Gmail Labs test that sent a daily list of dates, deadlines and reminders. It was paid-only until September 2026, when Google made it free for everyone in the US.

    Source ↗
Keep in mind

  • Adam Engst says CC "frequently swapped names" in forum messages. He says it also flagged events with no meaning to him, such as a school newsletter. His verdict: it "didn't provide any value because it is inherently duplicative."

    Source ↗

  • Engst says the FYI section is "random," so it is "hard to train away." Calendar events "usually—but not universally" showed up. Check the briefing against your real calendar before you rely on it.

    Source ↗
What people say

  • "Seeing those messages appear in the next morning's briefing made me question whether I had actually seen and processed them." — Adam Engst (TidBITS)

    Source ↗
Where to go further

  • Google's CC agent sends a daily "Your Day Ahead" email from Gmail, Calendar and Drive. Early access is for paid accounts in the US and Canada. Look first at names and times: check each briefing against your calendar for a week.

    Source ↗
Compare the top three ↓

2Reminders and monitoring alerts

No. 2 — Reminders and monitoring alerts. On the lists of 8 of 8 AIs; median place there: 2.

Did you know

  • OpenAI's help page gives each ChatGPT plan a cap on active tasks: Go 3, Plus 5, Business and Edu 10, Pro and Enterprise 15. At the cap you can't create a new task or resume a paused one until you pause or delete another.

    Source ↗
Why it is here

  • OpenAI's help page says ChatGPT tasks cannot run more than once per hour. A reminder or alert that needs to fire sooner can't be set up there, so the risk is a late alert, not a harmful action.

    Source ↗

  • OpenAI caps active tasks by plan: 3 on Go, 5 on Plus, 10 on Business and Edu, and 15 on Pro and Enterprise. At the cap, ChatGPT can't create a new task or resume a paused one. So a task can quietly stay off.

    Source ↗
History

  • In January 2025, OpenAI launched Tasks as a beta for paying ChatGPT users. It could run one-time reminders or repeated prompts, such as a daily news briefing, without you asking each time.

    Source ↗
Keep in mind

  • One OpenAI forum user says a daily automation kept pausing with "Too many unread executions." It paused again after several days, even though they opened the chat every day. A quiet pause means a missed alert.

    Source ↗

  • A troubleshooting guide says a task can run fine while its push or email notification fails. It also says OpenAI states a task may pause when it has been inactive. Check the Scheduled page now and then.

    Source ↗
What people say

  • "Tasks keep vanishing, new tasks are not displayed, but older, paused or deleted ones are" — anja_h

    Source ↗
Where to go further

  • Read OpenAI's page on scheduled tasks. It lists how often a task can run, the cap on active tasks for each plan, and when tasks pause. Check your task after a day, because a paused task stops without any message.

    Source ↗
Compare the top three ↓

3Email triage and draft replies

No. 3 — Email triage and draft replies. On the lists of 8 of 8 AIs; median place there: 3.

Did you know

  • The first mass advertising email went to around 400 ARPANET users in 1978. Reaction was almost universally negative, and an ARPANET representative made the sender promise to stop. It reportedly generated $13 million in sales.

    Source ↗
Why it is here

  • Microsoft's Work Trend Index puts the average worker's inbox at 117 emails a day. An agent that triages email reads all of them. That is why it ranks third: the main risk is how much private mail it sees, not what it sends.

    Source ↗
History

  • In February 2026, Meta AI security researcher Summer Yue asked her OpenClaw agent only to suggest emails to delete. It deleted many emails fast, ignored her stop messages from her phone, and she had to go to the Mac mini running it.

    Source ↗
Keep in mind

  • Ebrahim Bagheri says there is "no taking back" data an agent has already seen, even after you withdraw access. Apple warned that risks "will grow substantially" as agents become more autonomous. Choose which access you grant.

    Source ↗
What people say

  • "When your agent reads your inbox or your texts, it's also reading what your friends and family sent you" — Veronica Rivera, Georgia Tech

    Source ↗
Where to go further

  • Gmail's "Help me write" page shows how Gemini drafts a reply inside Compose. Open a reply and press the Sources button to see which emails and files it used. Read every draft before you send it.

    Source ↗
Compare the top three ↓

The top three side by side

Morning briefingReminders and monitoring alertsEmail triage and draft replies
In the AIs' lists8 / 88 / 88 / 8
Put first byClaude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi——

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

'Usually works' is not 'safe to hand over': GPT-4o finished over 60% of τ-bench retail tasks once, but fewer than 25% when it had to succeed eight times in a row.

Noticed by:
Included it: Meta, MiMo, DeepSeek, Kimi. Did not include: Claude, ChatGPT, Grok, Gemini.
Source ↗

The vendors' approval map is a ranking of how reversible each action is: send, pay, sign and delete are gated, while reading, briefing and monitoring run freely.

Noticed by:
Included it: Claude, MiMo, Kimi. Did not include: ChatGPT, Meta, Grok, Gemini, DeepSeek.
Source ↗

Reliability falls with task length: Claude Mythos Preview's METR horizon is at least 16 hours at 50% success but 3h06m at 80%.

Noticed by:
Included it: Claude, Meta, DeepSeek. Did not include: ChatGPT, Grok, Gemini, MiMo, Kimi.
Source ↗

Stores can stop agent shopping too: Amazon blocked Muse, and Walmart saw purchases inside ChatGPT convert at one-third the click-out rate.

Noticed by:
Included it: Claude. Did not include: ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.
Source ↗

An inbox agent exposes more than its owner: emails and messages carry data about colleagues and family who never agreed to it.

Noticed by:
Included it: ChatGPT. Did not include: Claude, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.
Source ↗

04Questions people ask

What can AI agents do?

They write morning briefs, monitor prices, triage email, schedule, book, shop and pay. Duet, Muse and Dots all stop for your approval before sending, paying or deleting.

Source ↗
What can AI agents do for me?

Start with the read-and-prepare tasks: briefs, reminders and drafts. Dots' background mode can't send messages or control a browser at all.

Source ↗
What can AI agents do for my business?

Duet targets small businesses with 6,000+ connectors: finding unpaid invoices in Stripe, preparing payroll and drafting contracts. Each step waits for approval before it sends or pays.

Source ↗
What can AI agents do and not do?

They handle read-only work well but book tickets poorly by Anthropic's own account. Sources disagree on 'hours of autonomy' because METR measures task difficulty, not runtime.

Source ↗

05How we counted

In plain words, no formulas.

1The question

Top 10 Everyday Tasks You Can Hand to an AI Agent Today, From Safest to Riskiest

2Why this topic

Lab tests measure skill, vendor rules set permissions and privacy reviews cover data. Only this list puts all three together into one plain order of what is fine to hand over now.

3Where it applies

Global, everyday tasks: morning briefing, email triage, reminders, scheduling, booking, shopping, sending messages, payments, deleting files

4What we looked at

  • How reliably agents do the task in independent tests
  • How costly a mistake would be and whether it can be undone
  • How much of your private data the task opens up
  • Whether the vendors make the agent ask your approval first
  • METR (time-horizons dashboard) — Share of tasks of each human length that models finish; reliability drops as tasks get longer, and 80% horizons are far shorter than 50% ones.
  • Sierra (τ-bench) — Whether tool-using agents finish customer-style tasks while following policy; pass^k measures whether they succeed every time over repeated runs.
  • Vendor approval rules (Anthropic, OpenAI, Meta, Google) — Which actions agents pause on and which they take alone, plus vendor-named weak spots such as booking tickets.
  • Mozilla Foundation (Privacy Not Included, now Nothing Personal) — App privacy practices: data sharing or sale, deletion rights, basic security. The guide was sunset in August 2026; no agent-specific 2

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Claude, ChatGPT, Meta, Grok, Gemini, MiMo, DeepSeek, Kimi.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

06Each AI's own list

🇺🇸 Claude10 places · 3 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    Morning briefing

    Anthropic's Duet sends one each day, and it only reads your accounts, so a miss costs a missed line, not money.

    Source ↗
  2. 2
    Web research and monitoring (price, news, restock watching)

    Dots keeps its background research to read-only tools, and ChatGPT monitors ping you only on change.

    Source ↗
  3. 3
    Email triage (sorting, summarising, drafting replies)

    Drafting is safe, but the agent reads your whole inbox, which is why this ranks below research.

    Source ↗
  4. 4
    Reminders and recurring tasks

    They are easy to undo, but ChatGPT's tasks run at most hourly and pause themselves if you ignore them.

    Source ↗
  5. 5
    Scheduling meetings

    Calendar edits can be undone, but an invite can reach other people before you notice.

    Source ↗
  6. 6
    Sending messages and emails

    Every major agent asks first, because a sent message cannot be recalled.

    Source ↗
  7. 7
    Booking (tickets, reservations, travel)

    Anthropic itself names ticket booking as a weak spot of Duet.

    Source ↗
  8. 8
    Shopping (finding and buying items)

    Amazon blocked Meta's Muse after 12 days, and ChatGPT retreated from Instant Checkout in March 2026.

    Source ↗
  9. 9
    Paying bills and invoices

    Money moves are hard to reverse, so Duet, Muse and Dots all stop for approval, and Dots can block payments outright through rules.

    Source ↗
  10. 10
    Deleting files or messages

    Deletion is the one action that may have no undo, so Duet asks first, and Microsoft's Windows agent runs in a contained workspace.

    Source ↗

What Claude noticed

Reliability falls with length: for Claude Mythos Preview METR reports a 16+ hour 50% horizon but only 3h06m at 80%. A task that must almost always work is a much shorter task.

Source ↗

The rules cluster where mistakes cannot be undone. Duet, Muse and Dots all stop before sending, paying or deleting, while read-only work runs freely.

Source ↗

Shopping is blocked from the other end: Amazon cut off Muse, and ChatGPT stepped back from Instant Checkout in March 2026, so the store, not just the agent, decides what is safe.

Source ↗
🇺🇸 ChatGPT10 places · 4 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    Morning briefing and information summary

    The lowest-risk handoff: let the agent assemble the day, but keep the final decisions yours.

    Source ↗
  2. 2
    Reminders and personal task lists

    A missed reminder is usually recoverable, provided the task is not a medical, legal, or safety-critical deadline.

  3. 3
    Email triage, labeling, and draft replies

    Let AI sort the inbox and draft the reply; stop short of giving it a blank cheque to speak as you.

    Source ↗
  4. 4
    Calendar scheduling and meeting coordination

    Let the agent find the overlap and propose a slot; verify time zones, attendees, and confidential meeting details.

    Source ↗
  5. 5
    Research, comparisons, and shopping shortlists

    Have the agent compare 20 options; make the choice yourself before any purchase or sharing of payment information.

  6. 6
    Booking appointments and reservations

    A booking can look finished while the appointment, cancellation terms, or final confirmation is still wrong.

    Source ↗
  7. 7
    Sending ordinary messages and emails

    One mistaken draft is cheap; one message delivered to the wrong person can be permanent.

    Source ↗
  8. 8
    Purchasing ordinary goods

    A return policy helps after a bad purchase, but it cannot guarantee that the agent chose the right item or price.

    Source ↗
  9. 9
    Bill payments and other financial transactions

    A payment can be executed correctly and still be the wrong payment; the approval step is part of the product, not friction to remove.

    Source ↗
  10. 10
    Deleting files, records, or messages

    The riskiest handoff: the agent may execute the instruction perfectly and still destroy the wrong thing.

    Source ↗

What ChatGPT noticed

The safest automation is often not the task that an agent performs most accurately, but the one where the user can inspect the result before any external consequence occurs. Drafting is safer than sending; comparing is safer than purchasing.

Source ↗

A persistent agent's privacy risk extends beyond the account owner: reading emails and messages can expose information about colleagues, friends, and family who never directly authorized the agent.

Source ↗

Meta's Muse incident illustrates the difference between following a permission setting and following a person's broader intention. A user can authorize account access without anticipating every action the agent may take.

Source ↗

There is no published universal success rate that makes all ten tasks directly comparable. TAU-bench tests specific customer-service workflows, METR measures technical-task horizons, and privacy assessments evaluate different dimensions again.

Source ↗
🇺🇸 Meta10 places · 3 notes

The same question, answered by Meta alone. The final list above combines all the AIs.

  1. 1
    Morning briefing (read-only summary)

    Shortest, most reversible task — Duet sends morning brief from connected apps, no data leaves, mistake is just stale news, reliability highest.

    Source ↗
  2. 2
    Reminders and scheduled nudges

    Local, reversible, low data — ChatGPT Tasks and Dots can suggest tasks but users must explicitly approve creation.

  3. 3
    Email triage (read and summarize inbox)

    Read-only analysis, drafts only — Duet finds missed Gmail/Slack messages and helps reply but waits for approval before sending.

    Source ↗
  4. 4
    Calendar scheduling (draft proposals)

    Proposes times, does not send invites until approved — middle reliability, mistake is double-booking, fixable by cancel.

    Source ↗
  5. 5
    Research and document summarization

    Builds briefs, decks, dashboards with dozens of tools — example 2 hours work for 15 min effort per Platformer test, but reward hacking inflates long-task scores.

    Source ↗
  6. 6
    Shopping research (find items, not buying)

    Finds products across Shopify, Canva, etc., but purchase still needs approval — low financial risk, medium privacy (browsing history).

    Source ↗
  7. 7
    Booking restaurants and travel

    Vendor-named weak spot — Anthropic says booking tickets isn't quite as strong in Duet preview, and Mozilla flags high stakes if wrong date booked.

    Source ↗
  8. 8
    Sending messages and emails on your behalf

    Irreversible social cost — all vendors say ask before send, but TAU-bench shows agents fail to ask back 30-50% in early tests, and Common Sense shows parental alerts don't fire.

  9. 9
    Payments and purchases

    Money moves — Stripe Link and Shop Pay need tap, but virtual card still charges real money, and Mozilla notes no platform lets you remove training data after purchase.

    Source ↗
  10. 10
    Deleting files, emails, or changing permissions

    Most permanent — vendors put delete in needs-approval list, but Dots docs say permanently deleting data needs approval, and Duet says deleting anything waits for approval, off-limits even with approval for trading securities.

What Meta noticed

No benchmark puts a wrongly sent email and a wrongly paid bill on same scale — safest tasks are read-only briefs under 30 min, riskiest are irreversible deletes, even though both may have same METR horizon.

Source ↗

Booking is the canary: Anthropic, OpenAI, and Google all flag booking tickets as weaker than inbox triage, yet it is the first task users want to hand over while sleeping.

Source ↗

Background work isn't free: Duet's background checks count toward Pro/Max limits, Dots tasks in Work/Codex count as usual, so safest task (morning brief) still burns tokens every few hours.

Source ↗
🇺🇸 Grok10 places · 4 notes

The same question, answered by Grok alone. The final list above combines all the AIs.

  1. 1
    Morning briefing / summary

    Read-only synthesis of calendar and inbox items that vendors routinely deliver without approval.

    Source ↗
  2. 2
    Email triage / draft replies

    Agents draft but pause before sending; Duet and Dots explicitly require approval for outbound messages.

    Source ↗
  3. 3
    Reminders and scheduling

    Calendar reads and meeting proposals are high-reliability short tasks with easy undo.

    Source ↗
  4. 4
    Research and dashboard building

    Longer multi-step work that frontier models can complete in METR-style software tasks but still benefit from review.

    Source ↗
  5. 5
    Shopping / product research

    Browsing is relatively safe; actual purchase usually requires explicit approval via Link/Shop Pay or similar.

    Source ↗
  6. 6
    Booking reservations or tickets

    Vendors flag this as a weak spot; multi-step site navigation raises error and privacy risks.

    Source ↗
  7. 7
    Sending messages or emails

    Explicitly gated by Duet, Dots and Muse defaults; a wrong send is hard to fully undo.

    Source ↗
  8. 8
    Payments or purchases

    Always require user approval in stated policies, yet Marketplace-style over-permission incidents show residual risk.

    Source ↗
  9. 9
    Deleting files or data

    Explicitly requires approval; irreversible actions rank among the riskiest even when gated.

    Source ↗
  10. 10
    Account changes or money transfers

    Off-limits even with approval in Duet; password changes and inter-account transfers stay with the user.

    Source ↗

What Grok noticed

Anthropic explicitly notes Claude Duet is weaker at personal errands such as booking tickets while stronger on work briefs, dashboards and forecasts.

Source ↗

METR data show reliability falling as human task length grows, with only a handful of tasks longer than 16 hours in the suite and a warning that longer measurements are unreliable.

Source ↗

Major agents uniformly require approval before sending, paying or deleting, yet user-set 'Always Allow' options and reported incidents show the practical gap between policy and outcome.

Source ↗

TAU-bench style evaluations continue to show even strong models struggling with consistent policy adherence and tool use on multi-turn customer tasks.

Source ↗
🇺🇸 Gemini10 places · 2 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    Morning Briefing & Cross-App Synthesis

    Read-only aggregation carries a near-zero blast radius; even if an item is omitted, your inbox and calendars remain completely untouched.

  2. 2
    Setting Reminders & Alarms

    Local timer and reminder creation is deterministic and easy to correct with a single tap if the agent misinterprets the time.

    Source ↗
  3. 3
    Drafting Content & Meeting Summaries

    Generates complete document drafts and bulleted transcripts without publishing, keeping creative control entirely in your hands.

    Source ↗
  4. 4
    Email Triage & Inbox Sorting

    Automates tagging and filtering incoming messages, but risks filtering a critical urgent email into a low-priority folder.

  5. 5
    Meeting Scheduling & Calendar Coordination

    Negotiates free slots across multiple calendars seamlessly, though time zone confusion can lead to missed executive meetings.

  6. 6
    Travel & Event Ticket Booking

    Anthropic and Sierra explicitly highlight ticket booking as an agent weak spot due to dynamic pricing, cancellation fees, and seat lockouts.

  7. 7
    Online Shopping & Cart Checkout

    Agents frequently select incorrect sizes or non-returnable merchant variants if explicit item specifications are not strictly pinned.

  8. 8
    Sending Outbound Emails & Messages

    Once a message hits an external server, no software rollback can undo the legal exposure or reputational blow of a hallucinated phrase.

  9. 9
    Direct Financial Payments & Transfers

    An autonomous agent executing payroll or invoice payments without a human checkpoint exposes organizations to instant, irreversible capital loss.

  10. 10
    Permanent File Deletion & System Purges

    The single most destructive action an agent can take: an unprompted batch delete or database cleanup cannot be recovered if recycle bins are bypassed.

What Gemini noticed

The safety of delegating an everyday task correlates directly with state persistence: passive read tasks (briefings, triage) carry almost zero risk, whereas write/delete tasks introduce irreversible external consequences.

Source ↗

Mozilla Foundation's *Privacy Not Included reviews reveal that connecting an agent to handle email sorting and scheduling exposes personal data across an average of 4 to 8 integrated services, increasing tracking and training exposure.

Source ↗
🇨🇳 MiMo10 places · 3 notes

The same question, answered by MiMo alone. The final list above combines all the AIs.

  1. 1
    Morning briefing (AI daily digest)

    The task with nothing to undo - and Google's briefing agent still swapped sender names and slipped in a middle-school concert nobody asked about.

    Source ↗
  2. 2
    Reminders and follow-up nudges

    Poke built a whole company on texting you before you forget - here a mistake is annoyance, not damage.

  3. 3
    Email triage and reply drafts (without sending)

    Drafting is free; sending is where every vendor draws the line - Duet, Muse and dots all stop for your yes.

    Source ↗
  4. 4
    Research and summarizing

    Agents are several times faster than humans on the 2-hour research tasks METR measures - in hours saved, not truth guaranteed.

    Source ↗
  5. 5
    Scheduling meetings and calendar management

    Scout will book the meeting and block your calendar without asking - but only inside the identity and rules your company already set.

    Source ↗
  6. 6
    Booking tickets, travel and reservations

    Anthropic admits its agent is weakest exactly where money meets a web form: booking tickets.

    Source ↗
  7. 7
    Online shopping

    One-time virtual cards turned the scariest everyday buy into a refundable one: Muse is the first agent covered by Link's purchase protections.

    Source ↗
  8. 8
    Sendingmessages and emails on your behalf

    The one action all four big agents agree to stop for - and the one that swallowed Instinct's launch when it sent without asking.

    Source ↗
  9. 9
    Paymentsand bills

    The task where a benchmark's 'done' and a bank's 'gone' are the same word - and where Google had to invent a new protocol to make it safe.

    Source ↗
  10. 10
    Deleting files and data

    The only everyday action with no undo button - and one an AI has already used to erase an entire production database.

    Source ↗

What MiMo noticed

Reversibility, not difficulty, sorts this list: the four actions every major vendor gates - send, pay, sign, delete - are exactly the four that cannot be taken back. The industry's approval map is a risk ranking in disguise.

Source ↗

Reliabilitydecays with task length: METR's fitted curve puts 50% success at ~17 hours of human task length - but its own page flags anything over 16 hours as unreliable, so multi-hour chores like trip booking sit right at the edge of what can be measured, let alone trusted.

Source ↗

Eventhe safest task isn't hands-off: after months of corrective feedback, Google's briefing agent kept mixing up sender names and adding events the user never asked for - read-only output, read-write confusion.

Source ↗
🇨🇳 DeepSeek10 places · 1 notes

The same question, answered by DeepSeek alone. The final list above combines all the AIs.

  1. 1
    Morning briefing

    The safest handoff — but one builder's brief worked about 70% of the time, and another misread calendar dates.

    Source ↗
  2. 2
    Reminders

    Reminder recognition hit 89%, but exact reminder-count agreement was 84.65% — close, not perfect.

    Source ↗
  3. 3
    Research and dashboards

    The best agent still fails most research-extension tasks — around 33% success — and end-to-end experiments are far worse.

  4. 4
    Email triage (drafting, sorting, summarizing)

    Urgent detection can hit 100%, but full inbox categorization was 83% and spam filtering 70% in one test.

  5. 5
    Scheduling and calendar management

    Simple scheduling can work, but frontier models still score below 50% on temporal-reasoning tasks.

    Source ↗
  6. 6
    Sending messages (email, chat, DMs)

    Humans approve 93% of permission prompts and catch only 13.6% of harmful actions — the approval gate is weaker than it looks.

  7. 7
    Booking travel and tickets

    Routine booking succeeds 37–68% of the time; complex multi-stop trips succeed about 10%.

  8. 8
    Shopping and purchases

    Target's terms make an AI agent's mistaken purchase 'authorized by you' — the liability gap is unresolved.

  9. 9
    Payments and money movement

    Micropayments score 60.7 out of 100 on readiness; institutional financial workflows score just 12.

  10. 10
    Deleting files and data

    The only common task where the mistake is often permanent — and vendors still disagree on whether approval is mandatory.

What DeepSeek noticed

A task that succeeds 61% of the time in one trial falls below 25% when it must succeed eight times in a row — the pass^8 collapse is the best single explanation of why agent demos do not survive a workweek.

Source ↗
🇨🇳 Kimi10 places · 2 notes

The same question, answered by Kimi alone. The final list above combines all the AIs.

  1. 1
    Morning briefing & summaries

    The only task every major agent does unasked — Duet briefs you before you wake and the worst it can do is bore you.

    Source ↗
  2. 2
    Reminders, monitoring & alerts

    Muse's own example — it watches the weather and pings you about rain, and has nothing of yours to break.

  3. 3
    Email triage (read, sort, draft)

    The flagship task — and the one every vendor keeps on a leash: drafts come back for your approval, sends never go unasked.

    Source ↗
  4. 4
    Scheduling & calendar management

    Google demoed an agent that finds attendees, drafts the email and books the slot — but 'asks for your approval' before the invite goes out.

  5. 5
    Research & price monitoring

    Agents that scan 700-page policy folders for a living pass only ~25% — research is strong, account-specific retrieval is the weak joint.

    Source ↗
  6. 6
    Sending messages & email replies

    The first task on every vendor's ask-first list — a wrong send is the cheapest irreversible mistake an agent can make.

  7. 7
    Shopping & purchases

    Even the freest agent won't spend your money alone: purchases sit behind approval in all three leaders' rulebooks.

    Source ↗
  8. 8
    Booking tickets & reservations

    The task vendors themselves flag: booking is Duet's named weak spot — and a wrong flight is the first un-undoable item on this list.

    Source ↗
  9. 9
    Payments, transfers & money movement

    The only action dots locks completely: money transfers and password changes 'always stay with you' — every vendor agrees.

    Source ↗
  10. 10
    Deleting files, emails & data

    The one action the user prompt and every vendor agree on: nothing deletes without you — deletion is the only mistake with no undo at all.

    Source ↗

What Kimi noticed

τ-bench's pass^k metric is the sleeper finding for everyday tasks: a task done right 70% of the time succeeds on 8 consecutive runs only ~6% of the time — 'it usually works' is not 'you can delegate it'.

Source ↗

Banking is the canary: on the τ³ banking domain, even the best published agent score is 31.7% and frontier knowledge-retrieval sits near 25% — so 'check my accounts and act' remains the least reliable headline promise.

Source ↗