---
title: "Proactive AI agents: what starts them, what they ask first"
description: "Proactive AI agents mapped onto a published research framework: what can start each product we took apart, and what it asks before it acts."
url: https://personalagentbench.com/proactive-ai-agents/
last_updated: 2026-10-21
---

# Proactive AI agents: what starts them, and what they ask before acting

Proactive AI agents are agents that begin work you didn't ask for in that moment: a clock, an incoming email or their own review of your situation starts them, rather than a message you typed. A reactive assistant waits for a request and answers it. A proactive one has to decide whether to help, when to do the work, and how far to go before checking with you, and that last decision is where most of the risk and most of the annoyance live.

- A recent paper from KAIST and the University of Minnesota splits proactivity into three jobs: doing the right work, doing it at the right time, and keeping your trust. It isn't ours, and we have no connection to its authors.
- Two of its five design choices can be checked against shipping products from the outside: what can start the agent, and how far it goes before you approve.
- Of the products we've taken apart, Town and Instinct can be started by a clock or an incoming email. For Pine and Muse we didn't establish that.
- In the paper's simulated tests, no model and harness pairing matched the depth of help its simulated user wanted more than about 55% of the time.
- In its human study, trust fell further after one intervention at the wrong depth than it rose after a return to the right one.

## Proactive AI agent vs reactive assistant: who starts the work

The difference is the trigger. A reactive assistant does nothing until you send something. Every unit of work traces back to a request you made, so you always know why it's running.

A proactive AI agent can be started by something else. The paper behind this page defines proactivity as an agent's anticipatory behaviour aimed at a user's needs, opportunities or problems without an explicit request ([Definition 1, section 3](https://arxiv.org/html/2609.37267#S3)), and it names three things that can set it off: you, an outside event, or the agent's own periodic review. [The design space, section 4.1](https://arxiv.org/html/2609.37267#S4.SS1).

That's also a change in who's in charge. Once something other than you can start the work, getting the answer right isn't enough. Doing it mid-meeting, or sending it when you only wanted a draft, can make correct work unwelcome.

## The 3T framework for proactive AI agents

The paper is "Foundations of Proactive Agents: Principles, Technical Layers, and Proactivity-Gym" by Jio Oh, Seunghyun Do and Steven Euijong Whang at KAIST and Young-Jun Lee and Dongyeop Kang at the University of Minnesota, posted to arXiv on 29 September 2026. [Abstract and author list](https://arxiv.org/abs/2609.37267). It's a preprint. We're not affiliated with the authors and had no part in the work.

Its core idea is that proactivity needs three things at once, which it calls 3T. [The three principles, section 3.1](https://arxiv.org/html/2609.37267#S3.SS1).

- **Task capability.** Spotting a need you actually have, then doing the work correctly.
- **Temporal allocation.** Spending compute when it's available and when the result is needed, which includes deferring work to the hours you're not using the machine. The paper calls those hours sleep time.
- **Trust.** Keeping your confidence and your willingness to rely on it, which the paper treats as something the agent has to estimate from your stated rules, your past approvals and your feedback.

The product pages for the agents we took apart talk mostly about the first one. The paper's point is that an agent can be excellent at the task and still fail you on timing or reach.

## Five design choices behind every proactive AI agent

The paper turns the principles into five choices a builder has to make. [Design space, section 4.1](https://arxiv.org/html/2609.37267#S4.SS1).

| Choice | The options the paper names |
| --- | --- |
| Task scope | Help with what you're doing now, or with a separate task |
| Anticipation horizon | Needed now, later in this session, or after it |
| Activation trigger | Your request, an external event, or the agent's own review |
| Processing timing | Work while you're active, or while you're away |
| Intervention depth | Prepare quietly, suggest for review, or execute without asking again |

The paper suggests intervention depth as one observable sign of trust, because trust itself usually can't be seen. Its example is a developer who lets an agent edit tests unreviewed, then starts reviewing those edits too after a few mistakes. [Section 3.1](https://arxiv.org/html/2609.37267#S3.SS1).

Three of those choices happen inside the model and can't be seen from outside. Two can. What starts the agent and what it asks before acting leave traces in a product's interface and runtime, which is what our [teardowns](https://personalagentbench.com/agents/) record. Our scorecard already asks both: [what you get to approve](https://personalagentbench.com/how-scoring-works/#what-you-get-to-approve-before-an-ai-agent-acts) is intervention depth asked of a real product rather than a simulation, and the trigger question sits with [how you reach it](https://personalagentbench.com/how-scoring-works/#how-you-reach-it-and-what-can-start-it-without-you).

## How the proactive AI agents we took apart start, and what they ask first

These rows only restate what our own pages say. The first four products were examined first-hand; Hermes Agent and OpenClaw are source readings at a pinned revision, not things we ran. This is a map, not a ranking.

| Product | What can start it without you | What it does before acting | How sure we are | Evidence |
| --- | --- | --- | --- | --- |
| Instinct | A clock, or an event on your mail, calendar, documents or location; a platform safety check runs before a wake becomes an action | Shows an approval card with approve, deny or dismiss, bound to the exact text shown; reading isn't gated in the design we saw | Observed that both exist; the check wasn't tested against hostile input | [Wake-ups](https://personalagentbench.com/agents/instinct/#it-wakes-itself-up), [approval](https://personalagentbench.com/how-instinct-ai-works/#step-5-where-instinct-asks-you-first) |
| Town | A routine can fire on a schedule, an incoming email, a calendar entry or a recording, as well as a manual run | Approval is set in configuration (run mode, account scope, tool list, approval mode), and a tool can carry extra approval | Observed; the routines' execution bodies were not established | [Routines](https://personalagentbench.com/agents/town/#town-ai-routines-the-clock-can-start-it), [control](https://personalagentbench.com/agents/town/#control) |
| Muse | Not established for tasks you'd give it. A background loop ran hourly memory passes on the VM we watched; Meta's in-product guidance says calls can be scheduled once you confirm, which we never saw | Permissions, approvals and outbound traffic pass through one gatekeeper, with an approvals tab beside the activity feed | Gatekeeper observed on the web surface; scheduling is Meta's description only | [System insertions](https://personalagentbench.com/agents/muse/#a-hundred-and-forty-one-system-insertions-in-a-single-session), [control](https://personalagentbench.com/agents/muse/#control), [calls](https://personalagentbench.com/muse-vs-pine/#muse-vs-pine-on-phone-calls-observed-and-reported-access) |
| Pine | Not established. Other software can drive it through its REST endpoint, which isn't the same as starting on its own | A start confirmation, with its own expiry, gates the task; a separate identity confirmation appears when a company wants the account holder | Confirmations observed; self-starting not established | [Control](https://personalagentbench.com/agents/pine/#control), [what wakes Pine](https://personalagentbench.com/pine-vs-instinct/#what-wakes-pine-and-instinct) |
| Hermes Agent | Cron jobs, if the gateway's ticker is running; messages through its gateway | Terminal and code-execution commands that match a dangerous pattern need approval (default `smart` asks an auxiliary model first; isolated backends skip the prompt); cron and unattended sessions default to deny when nobody can answer; memory rewrites and deletes from the background review are staged for you | Source reading at a pinned revision; not run | [Cron](https://personalagentbench.com/hermes-agent/architecture/#hermes-agent-cron-and-state-on-disk), [approvals](https://personalagentbench.com/hermes-agent/architecture/#where-hermes-agent-runs-commands-and-what-you-approve-first) |
| OpenClaw | Cron, if enabled on the gateway; messages from its chat channels | The sandbox falls back to off, and host commands need no allowlist match and raise no ordinary prompt by default at 2026.10.2 | Source reading at a pinned revision; not run | [Scheduled work](https://personalagentbench.com/openclaw-security/#review-openclaw-scheduled-work-and-tool-availability), [exec defaults](https://personalagentbench.com/openclaw-security/#understand-openclaw-exec-full-off-and-deny) |

Against the paper's scale, the mix sits inside each product. Instinct suggests before it sends but reads without asking. Hermes runs commands without asking unless they match a dangerous pattern, and it skips even that prompt on an isolated backend; the [architecture page](https://personalagentbench.com/hermes-agent/architecture/#where-hermes-agent-runs-commands-and-what-you-approve-first) notes that sending a message or calling an MCP tool doesn't pass through that check, while [memory](https://personalagentbench.com/hermes-agent/memory/) has a separate gate: the background review can't rewrite or delete an entry without your approval. Town lets the setup decide, so the depth depends on how the routine was configured. One label per product would hide that.

The paper's three personas make the same point from the other side. Reviewer wants approval before changes, Planner lets the agent prepare within the stated task, and Operator delegates specified actions, and in its shopping example even Operator still has to approve replacement and price-adjustment claims. [Personas, appendix D.1](https://arxiv.org/html/2609.37267#A4.SS1); [example, appendix D.3](https://arxiv.org/html/2609.37267#A4.SS3). Real people want different depths for different jobs, and a product with one global switch can't express that.

## When a stranger can wake your proactive AI assistant

The trigger column has a cost the paper doesn't dwell on, because its users are simulated and friendly.

An agent your inbox can wake is an agent a stranger can address. Anyone who can send you an email can, in principle, put text in front of a model that holds your credentials, without you seeing it first. Instinct has its own email address and can be woken by incoming mail. Town routines can fire on an incoming email, and the Town agent reaches your messages through its [native Mac app](https://personalagentbench.com/agents/town/#the-town-ai-mac-app-is-native-and-that-s-the-whole-point). That pairing is what the [Muse vs Town comparison](https://personalagentbench.com/muse-vs-town/) flags: something that isn't you can start an agent that can reach your messages.

So the thing to look for is the check between "something happened" and "act on it". Instinct has one, a platform-side check that runs before a wake turns into action. We [observed that it exists](https://personalagentbench.com/how-instinct-ai-works/#step-1-what-starts-instinct-ai) and didn't test it against a hostile message. Hermes defaults cron and unattended sessions to deny when a dangerous command needs an answer nobody can give, and its own security policy calls the approval gate a heuristic and says the operating system is the only real boundary. [Hermes vs OpenClaw](https://personalagentbench.com/hermes-vs-openclaw/#how-hermes-vs-openclaw-describe-their-own-security-model). OpenClaw's guidance treats email, fetched pages and attachments as untrusted, and notes that channel access controls decide who can talk to the bot but don't strip hostile text out of a document an allowed user forwards. [Threat model](https://personalagentbench.com/openclaw-security/#define-the-openclaw-security-threat-model).

Reading is the gap that shows up in practice. Instinct's approval card covers actions, and reading isn't one; in one [reported case](https://personalagentbench.com/is-instinct-safe/#instinct-login-codes) it found a one-time login code in a connected inbox and used it without asking. Every trigger a proactive agent gains widens that gap.

Our own exam treats the noisy side of this as a cost. On the [live alerts task](https://personalagentbench.com/tasks/live-alerts/), an alert about nothing counts against the agent on its own line and never cancels out against the alert that mattered.

## What Proactivity-Gym found about proactive AI agents

Proactivity-Gym is the paper's test bed: 10 hand-written scenarios of 7 to 10 simulated days each, covering research, travel, shopping, health, finance and other areas, each with three personas who want different intervention depths. [Section 5](https://arxiv.org/html/2609.37267#S5). The scenarios hold 124 tasks between them, not all of which fire in every run. [Evaluation unit, appendix E.1](https://arxiv.org/html/2609.37267#A5.SS1). Nine models were run in three harnesses (OpenClaw, Claude Code and Codex) for 23 combinations, three runs per scenario and persona. [Setup, section 5.1](https://arxiv.org/html/2609.37267#S5.SS1).

The trust result is the one that stands out. TR-D measures how often the agent chose the intervention depth the persona expected. Across all 23 configurations it ran from 35.51%, for Gemma 4 12B in Codex, to 54.27%, for Claude Opus 5 in Claude Code. [Full results, table 7](https://arxiv.org/html/2609.37267#A6.SS1). Better task scores didn't buy much of it: task capability correlated with TR-D at only 0.34. [Introduction](https://arxiv.org/html/2609.37267#S1).

Many misses went the other way from overreach. Where the persona expected the agent to just do the thing, 77.21% of cases ended without a valid attempt to execute, and 45.96% even for Claude Opus 5. [Trust details, appendix F.5](https://arxiv.org/html/2609.37267#A6.SS5). Timing was weak too: apart from Claude Opus 5 at 51.7%, every model scored under 20% on deferring competing work. [Results, section 5.2](https://arxiv.org/html/2609.37267#S5.SS2).

The 30-person human study is where "useful or annoying" gets an answer. Acceptance of correct help that competed with ongoing work was 26.7%. For help done during sleep time, it was 97.8%, even when the output needed fixing the next morning. When an immediate option would cost only 10 minutes of review and clashed with nothing, 64.4% still preferred the overnight version. [Human study, section 5.3](https://arxiv.org/html/2609.37267#S5.SS3).

Trust also moved unevenly. On the study's five-point scale, going from an aligned intervention to a misaligned one cost 1.86 points on average, while the reverse gained 1.27. In an aligned, misaligned, aligned sequence, trust ended at 3.43 against a starting 4.43. [Section 5.3](https://arxiv.org/html/2609.37267#S5.SS3). The paper also found that LLM judges rated trust highly for agents that got the depth wrong, so a model grading another model would have missed what the people noticed. [Section 5.2](https://arxiv.org/html/2609.37267#S5.SS2).

## What the Gym can't tell you about shipping products

It measures models inside agent harnesses, not products. None of the four we took apart were tested, and the OpenClaw, Claude Code and Codex results describe those harnesses running particular models in a simulation, not anyone's consumer service.

The users are simulated. A language model plays each persona, with a rule-based state machine deciding what gets approved. [User simulator, appendix D.2](https://arxiv.org/html/2609.37267#A4.SS2). The authors describe the gym as an initial testbed with simplified resource constraints and user models, and list wall-clock execution and longer real-world workflows as future work. [Limitations](https://arxiv.org/html/2609.37267#S6) and [future work, appendix H](https://arxiv.org/html/2609.37267#A8).

You can't rerun it yet. The paper says the authors plan to release the code and the gym's data on publication; as of 21 October 2026 they aren't out. [Reproducibility statement](https://arxiv.org/html/2609.37267#S6.SSx2). The human study is 30 people reading written scenarios: enough to show a direction, not to predict how everyone reacts.

## What we couldn't establish

- Whether Pine or Muse can start work without you. Our teardowns don't show it, and Muse's scheduled calls are Meta's description, not something our account received.
- How well Instinct's pre-action check holds up against a hostile email. We know it's there; we didn't attack it.
- What Town's routines do once they fire. Their execution bodies weren't available to us.
- Whether any product adjusts its depth as your trust changes, which is the behaviour the paper argues for. Our teardowns describe each product's approval controls at one point in time, so they can't show whether those controls shift with use.
- How Hermes and OpenClaw behave when actually triggered. Both are source readings; neither was connected to a live inbox.

## FAQ

**What is a proactive AI agent?** An AI agent that can start work without a fresh request from you, prompted by a schedule, an outside event such as an incoming email, or its own review of what you're doing. It then has to choose when to do the work and whether to prepare, suggest or act.

**What's the difference between proactive and reactive AI?** A reactive assistant only acts when you ask, so every action traces back to a message you sent. A proactive one can be woken by something else. That makes it more useful when you're busy and harder to predict, because you didn't choose the moment.

**Are proactive AI assistants annoying?** They can be, and the timing matters more than the quality. In the KAIST and Minnesota study, correct help that competed with what people were doing was accepted in 26.7% of responses, and help prepared while they were away in 97.8%, even when it needed fixing.

**What are examples of proactive AI agents?** Among products we've examined, Town runs routines on a schedule, an email or a calendar entry, and Instinct can be woken by a clock or by events on your mail, calendar, documents or location. Open-source agents such as Hermes Agent and OpenClaw can run scheduled jobs from their gateways.

**Are proactive AI agents safe?** It depends on the check between the trigger and the action. An agent that an incoming email can wake can be reached by anyone who emails you, so look for what it does before acting and whether reading your data is gated at all.

**What are ambient agents?** As the term is commonly used, it means agents that run in the background, watching events and acting or surfacing things when they judge it useful. In the paper's terms, that's an agent with event or self-review triggers and work done while you're not active.

**Can I test Proactivity-Gym myself?** Not yet. The authors say they plan to release the code and data on publication, and as of 21 October 2026 they haven't been released.

---

Published by Personal Agent Bench (https://personalagentbench.com), run by the Zentor team. Zentor builds agent software of its own, so its products are not on the scorecard and will not be added.