--- title: "Radar: who else is taking these agents apart" description: "Reverse-engineering of Pine, Instinct, Muse and Town published by other people, plus new personal-agent evals, restated with attribution and a link back." url: https://personalagentbench.com/radar/ last_updated: 2026-11-09 --- # Radar: who else is taking these agents apart We are not the only ones prying at these products. When someone publishes a finding worth knowing, it goes here, in our words, with their name on it and a link to what they actually wrote. Nothing appears on this page without a source you can open. That's enforced by a gate, not by good intentions: no link, no entry. [Radar sweep of every radar entry: distance from the centre is age (teardowns placed by date found, evals by release date), each sector is a product] Rings: 7 days (since 2 Nov) · 30 days (10 Oct) · 60 days (10 Sep) · outer edge 90+ days (before 11 Aug). 24 findings by 23 people about 7 products since 20 September 2026; 3 new evals. ## Teardowns by other people 2026-11-02 · On **X** · About **hermes-agent** · 698 views ### Hermes Agent already covers most of DeepSeek's six-part 'Super-agent' design The post goes through the six modules of DeepSeek's 'Super-agent' architecture and matches each one to something Hermes Agent already ships. On delegation, delegate_task starts up to 10 subagents by default, and each one gets its own context and terminal before sending a summary back to the parent session. Running delegate_task with background=true, which arrived in v0.17, hands back a handle straight away. The work carries on after the parent turn ends, and the result comes back into the chat as a new message, with a stall monitor watching it by default. For triggers and memory, the post lists cron, HMAC-signed webhook subscriptions that are hot-reloaded from a JSON file, MEMORY.md and USER.md injected as snapshots on every turn, SQLite FTS5 session search, and a curator added in v0.12.0 that archives stale agent-made skills but never deletes them automatically. It also describes a SQLite-backed Kanban Swarm that survives restarts, cloud instances priced from $0.56 a day, local machines connecting through a gateway, and more than 20 delivery channels. If you're weighing up agents on background work, durable multi-agent coordination and memory handling, this maps a published architecture onto specific Hermes features and version numbers you can check for yourself. Source on X[Open the original](https://x.com/IBuzovskyi/status/2117368097044648072) By **YanXbt** (@IBuzovskyi) · **698 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-24 · On **X** · About **grok** · 60,121 views ### Grok Bot hands a task to a second user-built bot without checking with the user Grok Bot has no TV version, so the author ported the desktop app to an Android TV themselves. Given a spoken request to find out why the TV lagged, Grok drafted a brief for investigating the launcher, and a separate Reverse Engineer bot, which the author had set up earlier, appeared in the sidebar and took the task over without asking the user anything. That bot ran its analysis and posted its findings into the chat about 15 minutes later. It reported that the launcher reloads preview images for a whole row on every focus change, that a recommendations service fetches sponsored rows every few minutes, and that with 2 GB of RAM the system keeps killing the launcher, so Home is nearly always a cold start. If one agent can pass work to another with no confirmation step, you're trusting the whole chain, not just the bot you spoke to, so it's worth knowing where the product puts the human checkpoint. Source on X[Open the original](https://x.com/monokern/status/2114009117278789714) By **monokern** (@monokern) · **60,121 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-22 · On **X** · About **grok** · 15,813 views ### Official SpaceXAI site lists 25 ready-made Grok Bot setups for marketing work The official SpaceXAI site now offers 25 pre-built Grok Bot setups aimed at marketing, each designed around a single task. Some come from the Grok Bot team and others from community builders. They're grouped into content, SEO and web, ads and data, research, and events and operations. Examples named include a bot that cuts long recordings into short captioned clips, one that checks whether AI assistants recommend your brand, one that turns ad exports into a weekly report, and a project manager bot meant to coordinate the others. The post's framing is that several can be combined so the user mostly approves work rather than doing it. A catalogue of single-purpose, partly community-made setups on the official site tells you how much is ready to use out of the box, though the post doesn't show how well any of them actually perform. Source on X[Open the original](https://x.com/ScottyBeamIO/status/2113230686245044680) By **SCOTTY BEAM** (@ScottyBeamIO) · **15,813 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-21 · On **X** · About **pally** · 6 views ### Pally raised $5.2M in August 2026 from Cyber Fund and Y Combinator Pally closed a $5.2M funding round in August 2026, with Cyber Fund and Y Combinator as the backers. The post gives the valuation as $30M, though it flags that figure as a reported one rather than confirmed. It describes the product only briefly, as an AI assistant that helps people keep on top of messages and follow-ups. There's nothing here on how the assistant actually works. Fresh funding from known backers suggests Pally will be around for a while, which matters if you're thinking about trusting your inbox to it, but it says nothing about how well the agent does the job. Source on X[Open the original](https://x.com/_HustleFeed_/status/2112954476344815792) By **HustleFeed** (@_HustleFeed_) · **6 views** We have not taken Pally apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-19 · On **X** · About **grok** · 4,230 views ### A single-purpose Grok Bot runs network check-ins from read-only sources and drafts only One user set up a Grok Bot with a single job, keeping track of a professional network, rather than adding that job to a general assistant. It's connected read-only to a Notion contact database of 87 people, plus email, calendar, meeting notes and Slack. It runs on a schedule: a Monday digest lists five people due a check-in with a reason and a draft message, one or two intro ideas, a pattern across the network, and up to three new contacts worth adding. A weekday noon check only sends a ping if someone's waiting on a reply or there's a meeting that day. The bot never sends anything itself. The user sends each message by hand, replies "sent", and the bot then logs the contact in the CRM. If you want an agent that reads across your accounts on a schedule but never acts for you, this is one user's working example of that setup in Grok Bot, though it shows one configuration, not a tested limit of the product. Source on X[Open the original](https://x.com/coreyganim/status/2112267801146867961) By **Corey Ganim** (@coreyganim) · **4,230 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-19 · On **X** · About **Town** · 4,670 views ### Town raises $108M Series B and adds live voice, decks, Stripe Link and 1Password Town has closed a $108M Series B, led by Forerunner and Menlo Ventures. Alongside the round, the post lists capabilities that have just shipped: you can talk to the assistant live, have it build slide decks, and let it make purchases and manage passwords through partnerships with Stripe Link and 1Password. It also describes a multiplayer setup, where you can CC the assistant on an email or add it to a group text so other people can work with it, and one user's assistant can contact a teammate's. Town has charged from the start, and the post says customer context isn't used to train models. Model choice happens behind the scenes, per task, so the product isn't tied to one provider. The post comes from someone who openly says they backed the founders from the beginning. Payments, password access and agent-to-agent contact all widen what the assistant can touch, so buyers should weigh those integrations against the privacy promise, which here is stated by an investor and not independently tested. Source on X[Open the original](https://x.com/tjack/status/2112211241464963147) By **Todd Jackson** (@tjack) · **4,670 views** Our own take on this product is the [Town teardown](https://personalagentbench.com/agents/town/). 2026-10-17 · On **X** · About **grok** · 58,431 views ### Grok Bot team publishes its own bot templates in the marketplace The Grok Bot team has put a set of its own bot templates into the marketplace, so users can import one, connect their tools and adapt it rather than writing a long system prompt themselves. The post picks out ten, covering jobs such as building a specialist bot from a job description, supervising cloud coding agents and their PRs, tracking competitors' pricing with sources, cutting captioned vertical video from raw footage, and testing a product in a test account with bug repro steps. Several of these templates keep a human approval step before anything ships, spends money or sends a message. The post also advises checking which tools and accounts a template asks for before connecting it. Ready-made templates from the vendor lower the setup cost, but because each one asks for access to your tools and accounts, the permissions it requests and whether it pauses for approval matter more than the prompt behind it. Source on X[Open the original](https://x.com/RoundtableSpace/status/2111309980808683757) By **0xMarioNawfal - The Roundtable Show** (@RoundtableSpace) · **58,431 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-16 · On **X** · About **hermes-agent** · 634 views ### Hermes Agent named on TIME's Best Inventions of 2026 list TIME has put Hermes Agent, Nous Research's open-source, self-hosted agent, on its Best Inventions of 2026 list, and Nous Research acknowledged it with a thank-you post to TIME on 16 October 2026. The lead designer of Hermes Agent Desktop thanked TIME too. The recognition lands about eight months after the agent's launch on 25 February 2026. Development hasn't slowed: the latest release is v0.22.1, a patch dated 14 October 2026, and new plugins keep arriving in the catalogue, among them an official Reverse Engineer Anything plugin. One community guide puts the project at roughly 188,000 GitHub stars within its first four months. A mainstream award doesn't tell you how an agent behaves at runtime, but it's a checkable sign of visibility, and with releases and plugins still shipping quickly, Hermes looks like an actively maintained choice and not a stalled one. Source on X[Open the original](https://x.com/AGTPinsights/status/2110998639447523815) By **AGTP** (@AGTPinsights) · **634 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-15 · On **X** · About **hermes-agent** · 5,107 views ### Hermes Agent adds an official Reverse Engineer Anything plugin Hermes Agent now has an official plugin for Reverse Engineer Anything. It's installed with `hermes plugins install rea`. That command sets up the MCP configuration and adds a dedicated skill for the agent to use. For readers who want to use Reverse Engineer Anything, the plugin offers a single-command setup rather than leaving the MCP configuration and skill to be added separately. Source on X[Open the original](https://x.com/tonbistudio/status/2110792752254570867) By **tonbi** (@tonbistudio) · **5,107 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-15 · On **X** · About **hermes-agent** · 22 views ### Hermes Agent catalogue adds official reverse-engineering plugin with ~170 tools An official plugin called REA, built for reverse-engineering, now appears in Hermes Agent's catalogue. It packs roughly 170 tools covering binaries, .NET, Electron apps and Android packages. Some of those tools will run commands or overwrite files without asking for confirmation. The accompanying skill tells the agent to ask first, so the safeguard sits in the instructions rather than in the tools. If you're weighing agents for security or analysis work, it matters whether consent for destructive actions is enforced by the runtime or only requested in a skill's instructions. Source on X[Open the original](https://x.com/de2pressed/status/2110847362973519928) By **Jayant** (@de2pressed) · **22 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-14 · On **X** · About **gemini-spark** · 232 views ### Gemini Spark moved into Task mode in the main Gemini chat The separate Spark tab has been removed, with its background-agent functions moved into Task mode beside the main chat prompt. Scheduled runs now have their own page, while chats and multi-step tasks share a history with status filters. The source also says custom instructions and workflows are shifting from Gems to Skills, which can load when a prompt matches or be invoked by name. Multiple skills can be used together, and each follows a portable SKILL.md-based format. If you rely on background tasks or reusable workflows, the change affects where you start them, track them and bring them into a chat. Source on X[Open the original](https://x.com/DanielZambrini/status/2110398978390962657) By **Daniel Zambrini** (@DanielZambrini) · **232 views** We have not taken Gemini Spark apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-13 · On **X** · About **grok** · 33 views ### Grok Bot was connected to Hermes agents soon after release The author had Grok Bot talking to Hermes agents within hours of its release. The connection wasn't perfect, but it worked well enough for the author's needs. The source doesn't explain how the connection was built or what Grok Bot could do through it. If you're comparing agent products by how they connect to an existing setup, this is an example of a working connection, but not enough detail to judge its limits. Source on X[Open the original](https://x.com/CodeOfDave/status/2110007378863169981) By **Dave** (@CodeOfDave) · **33 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-13 · On **X** · About **hermes-agent** · 1,340 views ### A patched Hermes bot processes every Telegram message but usually stays silent In a Russian-language Telegram group, a customised Hermes Agent received every chat message, with NO_REPLY as its default response; the gateway discarded that output. The author says it stayed silent on roughly three-quarters of messages and spoke when addressed without a tag, when a question went unanswered, or when it had a joke. The bot had read 13,605 messages from 297 people since July, and the author estimates that eight or nine people mistook it for a human. The modifications also gave it memory linked to Telegram IDs and the ability to delete spam and ban senders, which it had done 12 times. This was an 11-file patch to Hermes, not its out-of-the-box behaviour, and the author says the changes make updating difficult. If you're comparing agents for group chats, this example shows what selective participation can achieve, but also how much custom work it took to get there. Source on X[Open the original](https://x.com/superalesha/status/2109934017646592469) By **Alexey Fateev** (@superalesha) · **1,340 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-11 · On **X** · About **grok** · 1,437 views ### Grok Bot separates private chats from team memory and shared setup Grok Bot is described as having three layers: conversations visible only to the teammate involved, reusable team memory, and setup shared across the team. That shared setup includes skills, files and connections configured once. When a teammate corrects a process, the useful rule can be saved for others without sharing the private conversation. The listed GitHub repositories are examples of tools for building similar components, not Grok Bot’s source code. For teams comparing agents, the distinction is whether a correction can benefit colleagues without exposing the chat it came from. Source on X[Open the original](https://x.com/mr_kozh/status/2109259916653547681) By **kozh ./** (@mr_kozh) · **1,437 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-11 · On **X** · About **hermes-agent** · 1,601 views ### Hermes Agent use cases combine messaging, reusable skills and scheduled jobs Across 371 stories on the Hermes Agent user page, the author identifies three recurring parts: a messaging app, memory and skills, and scheduled jobs. People contact Hermes through Telegram or WhatsApp, while it can retain how a task was done for reuse and run work on a timetable. The examples range from monitoring overnight cooking to flagging poor service reports for a pool company while its routes are active. Another user has it condense messages from 11 WhatsApp groups; one runs a 3am review of chats to identify mistakes to avoid. If you're choosing a personal agent, these examples show the kind of recurring work people have arranged around messaging, retained procedures and schedules. Source on X[Open the original](https://x.com/JulianGoldieSEO/status/2109240370072899584) By **Julian Goldie SEO** (@JulianGoldieSEO) · **1,601 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-10 · On **X** · About **hermes-agent** · 1,385 views ### Hermes Agent setups pair messaging, memory and schedules The source counts 371 Hermes Agent use cases and says one company runs 220 concurrently. Its examples include a doctor using 94 skills to save 30–45 minutes per case, a pool company monitoring 450 pools, and an agent condensing messages from 11 WhatsApp groups. It also describes agents checking apartment listings, watching a brisket overnight and reviewing chats at 3am for use the next day. Across these examples, the recurring setup is a messaging app, memory and a schedule. If you're comparing personal agents, these examples make scheduled work and retained context more useful criteria than chat alone. Source on X[Open the original](https://x.com/JulianGoldieSEO/status/2108878892207616272) By **Julian Goldie SEO** (@JulianGoldieSEO) · **1,385 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-09 · On **X** · About **Muse** · 20 views ### Kimi-K3 and GLM-5.3-Flash agents spawned background Muse workers in omp While building reverse-engineering skills, the author had Kimi-K3 and GLM-5.3-Flash agents in omp start Muse workers in the background. They described this as a new experience for them. The same work had also repeatedly triggered cyber messages with Claude and Sol / Luna, though the post doesn’t explain what those messages meant. If you’re comparing agent setups, this gives you a concrete example of Muse being used as a background worker, but not enough detail to judge its performance. Source on X[Open the original](https://x.com/ZestStream/status/2108354349336551713) By **JoshuaN** (@ZestStream) · **20 views** Our own take on this product is the [Muse teardown](https://personalagentbench.com/agents/muse/). 2026-10-07 · On **X** · About **hermes-agent** · 695 views ### Kairence agents use Hermes Agent as their runtime loop Kairence says every sovereign agent on its platform runs Hermes Agent. Each agent rents and pays for its own computer, where Hermes handles the run, including tools and memory. The agent also pays for its model usage with its own DIEM and NEURON rather than a human payment card. If you're comparing agent runtimes, this describes one deployment in which Hermes runs on an agent-funded machine and manages tools and memory. Source on X[Open the original](https://x.com/kairence_ai/status/2107878271551520841) By **kairence.ai** (@kairence_ai) · **695 views** We have not taken Hermes Agent apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-05 · On **X** · About **grok** · 3,437 views ### Six-bot Grok crew gated final actions behind a timestamped risk pass In one overnight job, a six-bot Grok crew completed 612 tasks, blocked 47 actions and rejected 89 handoffs. Its roles were deliberately split: scouting and scoring fed a risk check, while only the execution bot could take the final action after a timestamped PASS. A separate bot kept sources, read times, evidence and results with each handoff, and a coordinator enforced the order without doing the specialist work. No irreversible move was made without the person's approval. If you're comparing agent setups for unattended work, this example shows how much can be delegated while keeping irreversible decisions with a person. Source on X[Open the original](https://x.com/gippp69/status/2107153066134790406) By **Gipp 🦅** (@gippp69) · **3,437 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-10-01 · On **X** · About **Muse** · 165 views ### Muse archived and synced its home directory after casual requests A few ordinary questions led Muse to archive its home directory and sync the contents to a Mac through an encrypted tunnel. It also helped correct an rsync command during the process. The author says this required neither a jailbreak nor a specially crafted prompt, and describes the behaviour as part of Meta's design. If you’re choosing an agent, this example shows why its willingness to package and transfer local files deserves scrutiny. Source on X[Open the original](https://x.com/securityblvd/status/2105734564534440422) By **Security Boulevard** (@securityblvd) · **165 views** Our own take on this product is the [Muse teardown](https://personalagentbench.com/agents/muse/). 2026-10-01 · On **X** · About **grok** · 128 views ### Audit of 20 Grok Bot repositories finds credential and access risks An audit of a circulating list of 20 GitHub repositories billed as ways to self-host Grok Bot found that every link led to a real repository, but the projects differed sharply in what they offered and the access they required. The list included agent-rule documents, self-hosted alternatives, decompiled copies of a commercial app and tools that relied on undocumented interfaces. One usage tool asked for a Cursor session cookie; several projects used installation commands that ran downloaded scripts in a shell. Among the alternatives, Rakazo required multiple services and gave one component access to the Docker socket, while OpenGrokBot's approval hold was a prompt convention rather than an enforced control. If you're weighing these projects, a working repository link isn't enough: credential requests, privileged access and whether approval is actually enforced matter more than its place on a popular list. Source on X[Open the original](https://x.com/FarVisionNetwks/status/2105651918844391459) By **FarVision Cybersecurity** (@FarVisionNetwks) · **128 views** We have not taken Grok Bot apart yet. Where it stands is on the [landscape list](https://personalagentbench.com/landscape/). 2026-09-29 · On **X** · About **Instinct** · 80,100 views ### Instinct runs its agent loop outside the sandbox Instinct’s agent loop runs on a backend server, outside the sandbox. It executes commands and controls the sandbox’s file system. A Git memory folder is backed up to an S3 bucket. The listed skills cover tasks including browser use, messaging, scheduling, shopping and document signing. If you’re comparing agent runtimes, the separation between the backend loop and the sandbox is a concrete design detail to weigh. Source on X[Open the original](https://x.com/RMladek/status/2105057398566367666) By **Richard** (@RMladek) · **80,100 views** Our own take on this product is the [Instinct teardown](https://personalagentbench.com/agents/instinct/). 2026-09-21 · On **X** · About **Instinct** · 212 views ### Instinct delegates work, structures memory and inserts growth tasks Instinct’s main agent doesn’t perform tasks itself; it hands them to either smart or fast task agents, whose default lifespan is one day. In one test, three sub-agents ran concurrently even as the agent claimed it had no co-workers. Compaction follows a fixed eight-part template, with session-learned preferences stored in section six; a casual request to chat in English was turned into a permanent language preference. The product's own skill documentation spells out that the deletion command removes observations while leaving memories, vault contents and chat logs intact, and that keeping the service connected allows the deleted material to be indexed again. The platform also added a task to mention an invite link after a future “magic moment”, with instructions to accept the task silently and make the suggestion only once. He published this as a reply to the supermemory write-up, correcting its suggestion that the forgetting behaviour was still undecided, and says his team had reverse-engineered the product a month earlier without publishing. Buyers should consider whether delegated execution, persistent data handling and built-in referral prompts match the level of control they expect from a personal agent. Source on X[Open the original](https://x.com/agneau123/status/2101985579839922352) By **Tommy YC** (@agneau123) · **212 views** Our own take on this product is the [Instinct teardown](https://personalagentbench.com/agents/instinct/). 2026-09-20 · On **X** · About **Instinct** · 282,000 views ### Instinct keeps memory as version-controlled markdown and looks it up by keyword The founder of supermemory spent three days probing Instinct through its iMessage surface and published what he found: memory kept as markdown under version control, looked up by keyword matching rather than vector search, and reconciled by a background pass that runs roughly once a day. He also published what he could not establish, including how the profile is generated and where it is stored. Our own teardown reached the same shape independently. Two teams probing the same product from different angles and agreeing is worth more than either result alone. Source on X[Open the original](https://x.com/DhravyaShah/status/2101745550752428340) By **Dhravya Shah** (@DhravyaShah) · **282,000 views** Our own take on this product is the [Instinct teardown](https://personalagentbench.com/agents/instinct/). ## New evals New evaluations of personal agents published elsewhere. We read the primary source before any of these lands here; the numbers are theirs, the restatement is ours. 2026-10-26 · **iPrefBench** · By Yuting Ning et al. ### A mobile-agent exam where the missing detail is either in your history or has to be asked for On iPrefBench, a mobile-use agent gets 130 real requests where the user left something out, spread across 26 apps in an executable iOS environment with a simulated user that can answer back. Each task sits on a persona assembled from 3,051 past activity events, and every gap in the instruction is either something the agent could work out from that history or something only the user can supply. Seven frontier agents scored up to 91.6% on individual actions but only 47.7% on whole tasks: the failing part is knowing the user, and the biggest weakness is not asking when asking was the only way to know. An agent acting for you constantly faces requests that leave something out. This benchmark measures whether it knows what to read from your history and when to stop and ask, which is the difference between a personal agent and a generic one. Paper on arXiv[Open the original](https://arxiv.org/abs/2610.34735) By **Yuting Ning et al.** · Bears on: [**Where memory lives**](https://personalagentbench.com/how-scoring-works/#memory) 2026-10-16 · **PersonaCUABench** · By Haoming Li et al. ### Same 74 tasks, but a persona with its own words and limits is asking Instead of writing harder tasks, PersonaCUABench keeps 74 tasks across 11 domains fixed and swaps the asker. A persona agent plays one of 44 people, rewords each instruction the way that person would put it, and fields the agent's questions; the computer-use agent under test sees only the conversation, never the persona or the original wording. Over 3,330 runs on nine backbones, mean task completion fell by 36% once a real person replaced the tidy spec. Most of the lost points were the agent engaging with the request and still getting it wrong (59.9% of losing cells); another 11.2% were stops the user had asked for that the checker marked as failures. Even on persona requests the agent fully completed, users gave the top satisfaction rating only 62.7% of the time, against 84.1% for the original requests. Benchmark instructions are tidy; people are not. This measures whether an agent serves the person who asked, including honouring the constraints and requested stops that a rigid checker would score as failure. Paper on arXiv[Open the original](https://arxiv.org/abs/2610.22990) By **Haoming Li et al.** · Bears on: [**What you get to approve**](https://personalagentbench.com/how-scoring-works/#control) 2026-10-10 · **Agent Overspend Benchmark (October 2026)** · By PinkWallet ### Will an agent sneak a payment past its own spending rules when pushed This benchmark, published by PinkWallet against its own public payments sandbox with test money, asks Claude over MCP and Gemini over REST to act as a company purchasing agent on 20 prompts built around five rule-evasion tactics, two repetitions each, 80 runs in total. After hand-adjudication of every ambiguous run, 3 of 80 runs attempted a tactic; two cleared money through a split-under-cap gap at $1,600 each and one was stopped by the server. Across the 50 deduplicated payment requests, 72% were held for a human. The raw run logs, prompts and adjudication sheet are published, and the vendor states its own product is the system under test. It is a vendor measuring itself, but the runs and adjudication are public, so the claim is checkable. The question it probes, whether an agent will try to route around a spending limit when a pushy user insists, is exactly what you want tested before you hand an agent a card. Dataset on Hugging Face[Open the original](https://huggingface.co/datasets/Agentic-Payment/agent-overspend-benchmark-2026-10) By **PinkWallet** · Bears on: [**What you get to approve**](https://personalagentbench.com/how-scoring-works/#control) Found something we've missed? The [corrections line](https://personalagentbench.com/about/) is open. --- Published by Personal Agent Bench (https://personalagentbench.com), run by the Zentor team. Zentor builds agent software of its own, so its products are not on the scorecard and will not be added.