Why Capability Is Not the Axis
The question arrives in our inbox in a consistent shape. Four names — Dispatch, OpenClaw, Grok Bot, Hermes — and one sentence: which one should we use. Someone on the team saw a demo, someone else read a warning, and leadership wants a single answer before anyone pays for anything.
The honest first answer is that three of the four are not the same kind of product, and one of them cannot run while your laptop is shut. Sorting that out changes the shortlist more than any feature comparison will.
It also turns out that capability is a poor way to separate these tools. METR, which measures model task horizons for a living, compared the two most-used harnesses against its own default scaffolding:
I looked into how Claude Code and Codex compare to the default scaffolds METR uses for time horizon measurements. It looks like they don't significantly outperform our default scaffolds on any models we've tried them on so far.
If the harness is not where the capability lives, then the harness is where the operations live. Operations is the axis, and it is the one nobody puts on a comparison page.
What follows is the scorecard we now use, and the four products scored against it. The four questions came out of operating unattended agents ourselves rather than out of a vendor matrix; the last section shows exactly where the numbers behind them come from.
What the Four Actually Are
Dispatch is a feature inside Claude Cowork that lets you assign and monitor work from your phone while the job executes on your desktop. Anthropic calls it Dispatch, not "Claude Dispatch" — that name is media shorthand. The engineer who shipped it announced it on March 17, 2026, Anthropic's own write-up followed on March 23, and it has since expanded into Claude Code. Availability is narrow: Anthropic's support documentation says verbatim that Dispatch is only available for some Pro and Max plans.
Critically, the phone is a remote control and not a runtime. Your desktop executes, and it has to stay awake with Claude Desktop open for the whole run. Practitioners who went deep on the Anthropic stack landed in the same place independently:
Claude just shipped Dispatch. You can now text Claude tasks from your phone and come back to finished work on your computer. But Dispatch is just the remote control.
OpenClaw is an MIT-licensed always-on agent that lives in your chat apps and runs on your own hardware — 389,434 stars and 81,854 forks when we read it on September 11, 2026, with a release shipped that same day.
Grok Bot is a persistent cloud virtual machine with a browser, filesystem and terminal that runs continuously and returns to you only for approvals. It entered beta on August 11, 2026. Of the four it is the one that most literally does the thing people mean by always-on. Access runs through SuperGrok tiers and Cursor Pro, Pro+, Ultra and Cursor Teams subscriptions, and xAI's documentation defers encryption and infrastructure questions to Cursor's separate security documentation. Buying Grok Bot means accepting Anysphere's security posture as well. That same page now carries the footer "© 2026 SpaceXAI LLC."
Hermes is an MIT-licensed, model-agnostic agent harness from Nous Research that runs on your own infrastructure across a CLI, messaging platforms and schedules, with a native desktop build in public preview since June. Do not confuse it with Hermes 4, the Nous language model family — same organization, two different products, and the easiest factual error to make about it.
Question 1: Which Tools Disappear When Nobody Is Logged In?
An agent running unattended does not inherit your permissions. Every OAuth-backed connector — email, calendar, chat, most publishing tools — is an interactive grant, and a scheduled run has no interactive session to inherit it from. The agent's reasoning stays fine. Its reach does not.
This is the question that costs the most and appears on no comparison page. In our own fleet, 43 of 201 scheduled runs explicitly logged losing a tool their interactive twin has. One log put it better than we could: the config lists the servers as connected, but their tools are not exposed to this session.
How the four answer it. Grok Bot sidesteps the problem by holding credentials itself — and creates a different one, because those credentials are shared across every Bot on the account. xAI's documentation says directly that you should not use separate Bots as a security boundary. Dispatch inherits your desktop session, which is why it works and also why it needs the desktop awake. OpenClaw and Hermes both hold their own credential stores, which is the more durable answer and the one that requires you to administer it.
Ask any vendor which specific integrations survive the unattended boundary. Do not accept the connector list as the answer.
Question 2: What Happens on a Transient Failure?
Networks fail. The question is whether the harness retries, and whether anyone is told when it does not. In our fleet, 43 of 201 runs died on a DNS error because the runner had no retry loop, and one of them burned 61 minutes before giving up. A further 24 scheduled runs never fired at all, because a laptop-hosted agent does not run when the laptop is closed, and those gaps cluster on weekends.
The number that matters for a buyer is the one that came out of it. One of our agents was scheduled 86 times and produced a report 60 times. That is 70% real uptime for an agent that looked like it ran daily, and nothing in any dashboard said otherwise.
How the four answer it. Hosted runtimes have the structural advantage here: Grok Bot's VM persists and does not care whether your machine is on. Self-hosted OpenClaw and Hermes are exactly as reliable as the box you put them on, which is a real answer if that box is a server and a bad one if it is a laptop. Dispatch is the strictest case — the run dies with your desktop.
Question 3: Does a Half-Finished Job Resume or Restart?
This is the question the four answer most differently and advertise least. A long job interrupted halfway is either resumable from its own state or it is not, and the difference shows up as either a delay or a silent gap in your data.
Hermes is the only one of the four whose session model is explicitly built for this. Its context compression writes a persistent parent-to-child lineage chain in SQLite rather than rewriting the transcript in place, so a compressed session keeps a traceable history. It also separates tool registration from tool exposure, so a run sees a resolved subset of the registered tools rather than all of them. Both are the kind of thing you only build after operating agents for a while.
Grok Bot answers the same question differently, with a VM that simply stays alive. Dispatch's run ends with the desktop session. OpenClaw sits in between and depends heavily on how you have configured it.
Question 4: Who Reads the Approval Flag?
Every one of these products advertises human approval somewhere. The question is not whether an approval mode exists. It is whether anything enforces it, and whether you can see after the fact what the agent actually did.
We learned to ask this the hard way. Auditing one of our own agents, we found a draft-versus- live safety switch documented three times in its README and implemented nowhere — no script read it, and setting it to draft did nothing at all. A documented control that no code implements is worse than no control, because it manufactures confidence.
How the four answer it. This is where the governance gap is widest, and it is the section a buyer should read twice.
- Anthropic writes the limitation itself in its Cowork documentation: audit logs do not cover Claude Cowork yet. The Compliance API was extended to Cowork on August 11, 2026, but that is Enterprise-only and gated to the primary owner.
- Grok Bot's Action Recording — the only real view into what the agent did — is Enterprise-only and off by default. There is also no spend cap and no API.
- OpenClaw's network posture is closed by default but its execution posture is open: the sandbox mode in the default config is set to off, and the project's own SECURITY.md states that tools execute host-first unless explicitly sandboxed. Prompt injection is explicitly out of scope for vulnerability reports.
- Hermes and OpenClaw both put the audit trail entirely in your hands, for better and worse.
The sharpest version of the OpenClaw critique also contains the best argument for the whole category:
I'm definitely a bit sus'd to run OpenClaw specifically - giving my private data/keys to 400K lines of vibe coded monster that is being actively attacked at scale is not very appealing at all... But I do love the concept and I think that just like LLM agents were a new layer on top of LLMs, Claws are now a new layer on top of LLM agents, taking the orchestration, scheduling, context, tool calls and a kind of persistence to a next level.
That criticism has partly been answered. OpenClaw 2.0 at the end of August shipped per-session permission modes, workspace-anchored filesystem access, a write-only credential store with network egress bound to declared hosts, and model allowlists. Bitsight, whose methodology is the only published one we trust here, found more than 30,000 exposed instances earlier in the year, including dashboards accepting the single letter "a" as a valid auth token. If you see the figure of 500,000 quoted anywhere, it traces to one unverified aggregator.
The Four, Scored
| Dispatch | OpenClaw | Grok Bot | Hermes | |
|---|---|---|---|---|
| Category | Feature in Cowork | Always-on, self-hosted | Always-on, hosted | Always-on, self-hosted |
| Runs with your laptop shut | No | Yes, on your host | Yes | Yes, on your host |
| Q1 Tools survive unattended | Inherits desktop | Own credential store | Yes, shared across Bots | Own credential store |
| Q2 Survives a failure | Dies with desktop | As good as your host | Persistent VM | As good as your host |
| Q3 Resumes mid-job | No | Config-dependent | VM stays alive | Yes, session lineage |
| Q4 Audit trail | Not for Cowork yet | Self-managed, sandbox off | Enterprise-only, off by default | Self-managed |
| Spend cap | Plan-bounded | None, you pay tokens | None | None, you pay tokens |
Grok Bot Enterprise landed eight days before we published this, which is the most recent movement in the group:
Grok Bot for Enterprise is available today. It's free for all Grok and Cursor enterprise customers for the next two weeks.
We could not verify a single Grok Bot price from a first-party source, because x.ai's pricing page returns a 403 to automated requests. Every dollar figure in circulation for it is third-party. For a product whose pitch is that you hand it your logins, that is its own data point. The most honest summary of the overall tradeoff came from someone who used two of them:
After using it a bit, Claude Cowork Dispatch covers 90% of what I was trying to use OpenClaw for, but feels far less likely to upload my entire drive to a malware site.
Where Our Numbers Come From
The four questions are not theoretical. We have run scheduled, unattended Claude agents every day since June 18, 2026 — 86 days and 201 logged runs as of this writing, across fifteen scheduled jobs wired into eleven tool servers. The scorecard is the residue of operating that fleet and reading its logs.
The single most useful thing it taught us has nothing to do with any vendor. One of our agents rebuilds a pricing page every morning at 6:15. On 21 of its 38 logged runs it did the work correctly and then could not publish it, because the publishing tool exists in an interactive session and not in a headless one. The build succeeded. The log said so. Nobody was alerted, and the page served the previous day's numbers.
The failure mode of an always-on agent is almost never a crash. It is a half-success that reports itself as a success — which is why the four questions above are about delivery and visibility rather than capability.
Who Should Not Deploy One Yet
If the job is something you would not let a new hire do unsupervised on their first week, an unattended agent is the wrong tool this quarter. If nobody on your team can answer question four for the system you are about to buy, you do not have an approval process, you have a setting. And if the work is genuinely important, budget for the monitoring before the agent — the failure mode is silence, and silence costs nothing to produce.
For a business that wants work happening while it sleeps and has no infrastructure team, Grok Bot is the only hosted answer of the four. For control with someone who can operate a server, OpenClaw after the 2.0 hardening is more defensible than its reputation, provided you turn the sandbox on, because it will not be on for you. For teams building infrastructure rather than buying a product, Hermes has the best ideas and the roughest edges. And if what you actually wanted was to start a long job and walk away from your desk, Dispatch is the right tool and the other three are overkill.
We covered the control-versus-convenience tradeoff for coding agents in our OpenClaw vs Claude Code vs Codex comparison, the governance questions in what Grok Bot means for business, and what running many agents at once looks like in our piece on orchestrating 60+ Claude agents. The hard part was never getting an agent to do the task. It is finding out when it did not.