Always-on agents · In real life

Twenty-five things people actually run always-on agents for

I collected these from three places: what the vendors showed on stage this year, what people said in the long Hacker News threads about running their own, and my own notebook. Every item has one line for what it does and one for how it goes wrong, and I mark which ones are mine and which are reported.

Lera Leonteva
Lera Leonteva
CEO & Founder, Leo AI
 ·  9 min read
In short

People run always-on agents for briefings, inbox and calendar triage, overnight code work, monitoring, invoicing, prospecting and publishing. The twenty-five below come from vendor demos, community threads and my own company, each with its trap. The five failures I see most are silent failure, expired credentials, uncapped spend, an agent acting as you, and acting on stale data.

Part of the Always-on agents series, post 17 of 33.

A list like this is only useful if you can tell what is real. So every item below carries a tag. Reported means someone said they run it, in a launch demo or in a thread I link in the sources, and I have not run it myself. Mine means it runs in my company and I can describe the failure from memory. There are far more of the first kind than the second, which is honest: I run a handful of these things, not twenty-five.

Where this list comes from

Three sources. The vendor launches of 2026, which I went through in the headlines post: OpenAI showed dots working inside Slack and Teams to brainstorm, update calendars and review customer feedback; Microsoft describes Scout, now Autopilot, coordinating meetings and blocking time; Google describes Spark continuing tasks after the laptop closes; Meta describes Muse filling forms and booking travel. Then three Hacker News threads where people who actually run OpenClaw or similar agents answered the question directly, in January, February and April 2026. And then my own jobs, which are fewer and duller than anything on stage.

Personal

  1. A morning briefing from calendar, email and task boards. Reported. The most common first agent in every thread I read, and the one I would build first too. Trap: it is also the one people report breaking most often, and a briefing that quietly stops is worse than none, because you stop looking.
  2. A weather report assembled from the sources you trust. Reported. Small, cheap, and a good test of the loop. Trap: it teaches you nothing about permissions, so people graduate from it too fast.
  3. Watching listings or prices and alerting on a match. Reported. House listings during a search was one example; a school activities site with alerts was another. Trap: sites change their markup and the agent keeps reporting nothing, which looks the same as no news.
  4. Nightly flashcards from new notes. Reported. Reads what you wrote today in a notes app and writes cards for tomorrow. Trap: it will happily make cards from a note you half-wrote and never meant to keep.
  5. A summary of upcoming trips pulled from email. Reported. Confirmation emails in, an itinerary out. Trap: this is read access to your whole inbox for one convenience, and the permission post in this series is about exactly that trade.

Work

  1. Preparing you for the next meeting. Reported. Microsoft's headline example for Scout: it flags important meetings and generates the materials you need to prepare. Trap: a brief built from the wrong thread is confidently wrong, and you read it two minutes before the call.
  2. Triaging the inbox while the laptop is closed. Reported. The Spark pitch, in Google's words: you do not need to keep your laptop open to make sure it is running. Trap: triage is a judgement about what matters to you, and the agent learns that from what you ignored, not from what you said.
  3. Coordinating meeting times across time zones. Reported. Scout again: proactively scheduling and blocking time for deliverables. Trap: an agent that writes to your calendar can double-book you in two time zones at once. I only let mine propose.
  4. Summarising a Slack alerts channel. Reported. Someone pointed an agent at a noisy channel and got a digest. Trap: the digest hides the one alert that mattered under three that did not, and you trained yourself to trust the digest.
  5. Drafting emails to contractors and accountants. Reported. Drafting, in the thread I read, meant the person still pressed send. Trap: the first time you let it send, you have given it your voice, and the recipient cannot tell.

Developer

  1. Running slow tests overnight and fixing what fails. Reported. A favourite in the April thread: leave it a failing suite, wake up to a branch. Trap: the fix that makes the test pass is not always the fix that makes the code right.
  2. Turning tickets into pull requests. Reported. Jira in, GitHub pull request out, with a human reviewing the diff. Trap: review fatigue. A pull request a night is thirty a month, and I know I would give the thirtieth a glance.
  3. Turning customer feedback into pull requests. Reported. OpenAI's developer demo at DevDay did this live. Trap: feedback is a complaint, not a specification, and an agent will implement the complaint.
  4. Triaging support email against the code and the issue tracker. Reported. The agent reads the report, finds the matching issue or the likely function, and drafts a reply. Trap: it will match confidently to the wrong issue, and the customer gets a polite non-answer.
  5. Diagnosing a crashing home server from your phone. Reported. One person debugged a box remotely through the agent while away. Trap: an agent with shell access that can fix a server can also finish it off, and the April thread had reports of deleted repositories.

Business

  1. Quotes, invoices and scheduling for a small trade business. Reported. A gardening business ran its diary and paperwork through one. Trap: an invoice with the wrong number on it is a customer conversation you did not want.
  2. Correlating cancellations with product analytics. Reported. Payment cancellations on one side, usage events on the other, a weekly note on what they have in common. Trap: correlation presented as cause, every Monday, by something that sounds sure.
  3. Chasing invoices. Reported. An early dots tester was described sending invoice follow-ups. Trap: money and tone. A reminder that sounds curt to a good customer costs more than the invoice.
  4. Long-horizon prospecting. Reported. Salesforce built this into Agentforce in September: an agent that pursues a sales goal across days and weeks with memory. Trap: a prospecting agent that sends is a spam machine with your name on it. Signals in, a ranked list out, and I would make a human press send.
  5. Carrying out HR, finance and IT process work. Reported. Workday's Autopilot Agents are pitched as doing the work, not answering questions about it. Trap: process work touches people's pay and access, which is the least reversible category there is.

Marketing

  1. Publishing social content on a schedule. Reported, and mine. People in the February thread ran auto-posting through an agent. Leo, my product, does a stricter version of this every hour: it looks at what an audience is responding to, picks a clip from footage the brand already has, edits it and books it on the calendar. Trap: filler. The best rule in Leo is the one that says no match, no post.
  2. Digests of social conversations on your topics. Reported. Set the topics, get a daily read of what people are saying. Trap: the agent cannot tell a trend from three loud accounts, and will report both the same way.
  3. A daily audio briefing published to a private podcast feed. Reported. One of the more inventive ones in the April thread. Trap: nobody checks a feed that always has a new episode, so an error reads as a normal day.
  4. Outreach on LinkedIn with the agent deciding whom to message. Reported. Someone ran outreach scripts with AI-driven decisions. Trap: platform rules. Automated behaviour is exactly what gets accounts restricted, and I have written at length about that risk on Instagram.
  5. Publishing a daily blog post on its date. Mine. The post you are reading went live because a job on my Mac at 09:05 found it was due, checked it was not already up, and uploaded it. Trap: it is only as good as what is staged. A missing file means a quiet morning, which is why a second job at 09:40 checks that every due post is actually live.

The five that go wrong most often

These are mine, in the sense that I have either had each one happen or built something specifically to stop it. The threads above are full of the same five under other names.

  1. Silent failure. The agent stops and nothing tells you, because success and idleness look identical. One commenter's morning briefing broke repeatedly and the agent promised it would never happen again. My answer is a watchdog that emails only when something is wrong, and a rule that every job logs a line even when it did nothing.
  2. Credential expiry. My repo-sync job failed silently for eight days, from 29 September to 7 October 2026, because the default cloud login on the machine had expired and nothing told me. Every unattended job I run against our cloud now uses a service identity that does not expire that way, and the permissions post is the long version.
  3. Uncapped spend. One person in the April thread spent about $40 in a week just fixing their setup; the OpenClaw creator reportedly ran up $1.3 million in model tokens in thirty days, which is a different scale of the same mistake. Set a cap before the first run, not after the first bill.
  4. Acting as you. An agent that logs in as you, sends as you and pays as you is indistinguishable from you, including to the people who trusted you. Microsoft's answer is an agent with its own identity; mine is a service account with the narrowest permissions that still work.
  5. Acting on stale data. A job that fires after the machine wakes, with yesterday's state, does yesterday's work today. Mine did exactly that on 21 September, fired before the network was up and gave up. Now it checks what already happened before it acts, and catches up on everything due rather than only today.

How I would pick your first one

Pick something read-only that you will notice if it stops. The morning briefing wins on both counts, which is why the morning brief post in this series builds one, and why I would not start with anything that sends, pays or deletes. Then, before you give it a second job, read the post on agents versus automation and ask whether the second job needs judgement at all. Most of the items above do not, and the ones that do are where the traps live.

Sources

  1. CBS News, Sam Altman unveils dots, OpenAI's new AI personal agent (accessed October 20, 2026)
  2. Microsoft 365 Blog, Introducing Microsoft Scout: your always-on personal agent (accessed October 20, 2026)
  3. DataCamp, Gemini Spark: Google's always-on AI agent explained (accessed October 20, 2026)
  4. PBS NewsHour, Meta launches personal AI agent, Muse, to help with everyday tasks (accessed October 20, 2026)
  5. Salesforce, Salesforce expands Agentforce with new agents (accessed October 20, 2026)
  6. Workday, Workday launches Autopilot Agents that get real work done across HR, finance and IT (accessed October 20, 2026)
  7. Hacker News, Ask HN: Any real OpenClaw users? What's your experience? (January 2026) (accessed October 20, 2026)
  8. Hacker News, OpenClaw is changing my life (February 2026) (accessed October 20, 2026)
  9. Hacker News, Ask HN: Who is using OpenClaw? (April 2026) (accessed October 20, 2026)
  10. Hacker News, OpenClaw creator spent $1.3M on OpenAI tokens in 30 days (May 2026) (accessed October 20, 2026)
  11. Nous Research, Hermes Agent README: daily reports, nightly backups, weekly audits (accessed October 20, 2026)

Written by Lera Leonteva. Items marked reported come from the linked threads and announcements as read on the access date; I have not run them.

Frequently asked questions

What is the most common thing people use an always-on agent for?

A morning briefing built from calendar, email and task boards. It appears in every community thread I read and in the launch material of every vendor, and it is the first one I would build, because it is read-only and you notice when it stops.

Which of these do you actually run?

Two on this list, and both are the dull ones: the job that publishes a post on its date and the hourly publishing loop inside Leo, my product. The rest are reported by the people who run them, in the threads and announcements linked in the sources.

What goes wrong most often with always-on agents?

Silence. The agent stops, or loses its credentials, or acts on stale data, and nothing tells you, because an agent doing nothing looks like an agent with nothing to do. My repo-sync job failed quietly for eight days in October 2026 for exactly that reason.

Should an always-on agent be allowed to send email or post on my behalf?

Not at first. Drafting is reversible and sending is not. I let agents publish where I can unpublish, and I let them propose calendar entries rather than create them. When something must send, a human presses the button or a cap and a log sit in front of it.

Is an always-on agent cheaper than doing these jobs by hand?

For read-only jobs with a small local model, the model cost can be zero and the machine a few dollars a month. The cost that surprises people is attention: checking that the agent is still right. Budget for that before the token bill.

Lera Leonteva
Lera Leonteva
CEO & Founder, Leo AI

Lera Leonteva is the founder and CEO of Leo AI, where she works on turning long-form footage into short-form video that earns attention on its own merits. She writes Video Scaling Strategies, taking one piece of content that worked and one that did not, and using what the market is doing to explain the gap.

The always-on agent I run for social video

Leo watches what your audience is responding to, picks a clip from footage you already have, edits it and books it on the calendar. Every hour, without being asked. It is the agent this whole series grew out of.

Book a demo See the always-on product

Keep going with the series

Every post in the Always-on agents series is on one page, newest first. If you would rather see the agent I run for social video, here it is.