Everyone's arguing about what the Windows 11 agent can access. Documents folder, personal files, the usual privacy panic. I get it, but I think we're arguing about the wrong thing.
The access isn't the story. The background is.
This agent doesn't wait for you to ask it something. It runs on its own schedule, in the background, doing whatever it decided needed doing. And that's a fundamentally different thing from every agent I've built, because every agent I've built has one thing this one doesn't: a human who pressed "go."
I've been running self-hosted agents for a while now, and the scariest moment in that whole time wasn't a model doing something unexpected. It was realizing I had a cron job firing an agent at 3am that I'd completely forgotten about. It was doing its thing, quietly, for weeks. When I finally looked at the logs, I couldn't tell you why it had made half the decisions it made. Nobody had asked it to. It just... ran.
That's the Windows 11 agent. It's a cron job with a language model inside, and nobody at Microsoft is going to tell you what it's doing at 3am, because they don't know either. Not because they're hiding anything — because the model's behavior isn't fully predictable. That's the whole point of the thing.
Here's what actually bothers me. When an agent runs in the foreground, there's accountability. I invoke it, I watch it work, I can stop it. The loop is human-model-human. But a background agent breaks that loop. The model acts, and the first time a human finds out about it is when something's already happened. That's not an agent. That's a process running with your credentials and nobody watching.
I'm not saying background agents can't work. I run them. But I run them with guardrails that took me months to build — circuit breakers, rate limits, frozen tool surfaces, and logs that I actually read. The Windows 11 agent ships with a settings toggle and a promise.
The uncomfortable truth is that we don't have good answers for unattended autonomy yet. We don't know how to make a model that acts without supervision and doesn't eventually do something stupid. We're all just hoping the blast radius stays small. Microsoft is hoping the same thing, except their blast radius is everyone's Documents folder.
Maybe I'm wrong. Maybe the agent is boring and well-behaved and this is all theoretical. But I've seen what happens when you give a model autonomy and walk away. It's never boring for long.
I'd rather have an agent that asks too many questions than one that never asks any because it's running in the background and there's nobody to ask.
Top comments (0)