How always-on AI agents work as background teammates

Until recently, an AI agent lived inside a chat session. When you closed the tab, it stopped. This week the direction of travel became clearer. Perplexity launched "teammates" that own ongoing work and act when something changes. DeepSeek's Harness team open-sourced a prototype that watches a GitHub repository and picks up requests addressed to it. Meta added live voice to its Muse agent, which keeps working in the background while you talk. Airbnb told shareholders it is building its own agent to plan and book trips.

For engineers, this shift matters more than any single model release. A chat agent is a function call with a human waiting on the other end. A background agent is a service. It needs the things every service needs: an event source, a queue, durable state, a scheduler, access control, monitoring and a budget. This article explains what changed, how these systems are built, and how to keep them safe and affordable. For wider context, see the agentic AI topic page.

What happened

Perplexity launches teammates (4 November 2026)

On 4 November 2026 Perplexity published a blog post introducing "teammates", which it describes as "personal agents that can take on that long-running work". Teammates run inside Perplexity Computer, its existing agent product, and use its tools and files.

The company says teammates "remember project goals, task history, and shared files across runs" and can act without a new prompt, for example a sales teammate that notices a regular customer has stopped buying. Colleagues can assign work to a teammate in Slack. Teammates send progress updates and approval requests, and you can inspect, redirect or take over.

Perplexity's help centre adds detail. Teammates are a research preview on the web for individual Max subscribers; Enterprise plans are not included by default, and iOS is coming "soon". For larger goals a teammate runs several agents in parallel, each with its own computer and browser. It can monitor Slack, GitHub and Linear and start work when something changes. Saved credentials are encrypted and teammates cannot view them. Work draws on the Max plan's monthly credits, and parallel agents and large codebases use more. New teammates default to Claude Opus 5.5, and you can choose the model per teammate. Perplexity Max costs $200 per month, as reported when the plan launched in July 2025.

Some summaries said teammates run "around the clock". Perplexity's own pages do not say that; they describe agents that keep a role and memory, run on schedules and react to events.

DeepSeek open-sources dsh-superagent (31 October 2026)

On 31 October 2026 DeepSeek published dsh-superagent-prototype on GitHub under the MIT licence. TechNode reported on 2 November that it comes from "DeepSeek's Harness team", the group behind DeepSeek Harness (dsh), the company's open-source agent harness. The prototype runs as a bundle for that harness. It is not a new model.

According to the README, as summarised by TechNode and other write-ups, the agent is configured around a single GitHub repository and, optionally, Feishu chats. It turns authorised requests into work items. Each work item gets its own working directory and agent session, typically a git worktree. Results, such as a pull request, go back to the original conversation. A local web panel lists items that need human attention.

The caveats are explicit. DeepSeek calls it a "research prototype for reference only, not an official DeepSeek product" and "research code, not production-ready software". The README says the public code is not identical to the internal version. Auto-merge is off by default. Worker sessions run with the full access of the operating system user that starts the service, so a dedicated account is advised.

Meta adds live voice and avatars to Muse (5 November 2026)

On 5 November 2026, as reported by The Next Web, Meta added live voice conversations to Muse, its personal AI agent. Users can interrupt at any point. Muse "can also keep working on tasks in the background while the conversation continues". An optional animated avatar runs on Muse Realtime Avatar, a model built by Meta Superintelligence Labs. Meta says its own raters preferred its avatars to those of Runway and HeyGen. The feature is available in the Muse app on phones, the web and Mac, but only in the US for now. Voice for Meta's AI glasses and the Muse Charm clip-on device has no date yet.

At its Connect event on 23 September, reported by TechCrunch, Meta said Muse "will work in the background and check back in when it's done".

Airbnb plans its own trip-planning agent (Q3 results, 5 November 2026)

In its third-quarter 2026 shareholder letter, filed with the SEC alongside its 5 November earnings call, Airbnb wrote: "We're building our own AI agent to help guests plan and book trips. We plan to start rolling it out to guests in the first half of 2027." Rather than a chat window, the company says, the agent "draws on a library of hundreds of travel-specific interface elements" and composes them in real time. Because Airbnb handles reservations, payments and support, it says the agent will be able to help with changes, refunds, rebooking and 24-hour safety support.

The letter also says about 40% of all customer support issues in Q3 2026 were resolved without a human agent, up from a third in Q2 2026.

How a long-running agent works

A chat agent and a background agent can share the same model and tools. What differs is everything around the model.

A chat agent is like a taxi. You get in, give a destination, and the driver works only while you are in the car. A background agent is like a building's facilities manager. They have a list of responsibilities, a key ring with limited access, a logbook, a budget, and a rule that anything expensive needs a signature. Work arrives from many directions: a tenant reports a leak, the boiler service is due on Tuesday, a sensor shows a temperature spike. Building that manager in software takes seven parts.

1. Triggers and events

A chat agent has one trigger: a person typing. A background agent has many. The common ones are:

Messages and mentions, such as a Slack tag or a GitHub comment.
Schedules, such as "every weekday at 9 a.m.".
State changes in connected systems: a new ticket, a failed CI run, a drop in a metric.

There are two ways to notice events. Polling means asking "anything new?" at intervals, like checking your letterbox every hour. Push means the other system calls you, through a webhook, like a doorbell. Push is faster at scale. Polling is simpler and survives missed deliveries. Many systems use push with a slow polling sweep as a safety net. If you already run event streams, the patterns in real-time AI from streams to decisions carry over directly.

2. A task queue and a router

Events are not tasks. A Slack message saying "thanks!" should not start a job. The next layer turns worthwhile events into units of work.

DeepSeek's design shows this clearly. A Router session receives each incoming message. Real work becomes a Ticket. Each Ticket runs in its own Worker session and directory. This is the orchestrator-workers pattern applied to a stream of requests rather than one big prompt. Perplexity describes the same shape: a teammate splits a large goal into tasks and runs several agents in parallel.

A queue gives three things a chat loop lacks: back-pressure (a burst of requests waits its turn), retries (a failed task runs again without anyone resending it) and isolation (one stuck task does not block the rest).

3. Durable state and memory

A background agent must remember across days, restarts and crashes. Separate two kinds of state.

Execution state is where a task is right now: which step, which tool calls succeeded, what is waiting. This must survive a process crash, otherwise a half-finished job either vanishes or repeats a side effect such as sending an email twice. Durable workflow engines such as Temporal exist for exactly this. The general patterns are covered in long-running tasks.

Knowledge state is what the agent has learned: project goals, past decisions, feedback. Perplexity's example is a teammate that factors in a vendor's lead time after being told about it once. This is agent memory, and it needs a policy: what is written, who can see it, and how it is corrected when it is wrong.

4. A scheduler

The scheduler decides when work runs. It handles recurring jobs, delayed follow-ups ("check again in two days"), deadlines and concurrency limits. Perplexity's operations example flags gaps 72 hours before a deadline; that is a scheduler's job, not the model's. Keep scheduling logic in ordinary, testable code. A model is a poor clock.

5. Tool permissions and isolation

In the background nobody watches each step, so permissions are the main safety mechanism.

Both vendors this week put isolation first. Perplexity runs each teammate on its own computer with its own browser sessions and cookies, and lets you pick which GitHub repositories a teammate can reach. DeepSeek gives every Ticket its own directory and warns that workers inherit the full rights of the operating system user. An agent's real permissions are whatever its process can do, not what its prompt says. Run it in a sandbox, under its own identity, with scoped credentials. The page on agent identity and delegation explains why "the agent acts as me" is a weak default.

Background agents also read untrusted text all day: issue comments, emails, web pages. Prompt injection defences matter more here than in chat, because there is no person in the loop to notice something odd.

6. Human checkpoints

A good background agent neither asks permission for everything nor acts alone on everything. It sorts actions into tiers, much as a junior employee can buy stationery but needs a signature for a new laptop.

DeepSeek's prototype shows the pattern in miniature. The agent opens a pull request, but auto-merge is off. Items that need a person appear on a panel. Perplexity's teammates send approval requests and present finished work for review. The design ideas behind this are in human-in-the-loop.

7. Observability

When an agent works while you sleep, you need a record of what it did and why. Log every trigger, task, tool call with arguments and result, approval, and the tokens and money spent, grouped by task so you can replay one job end to end. Without this you cannot debug, answer an auditor, or tell whether the agent is improving.

How it differs from a chat loop

The inner loop (think, call a tool, read the result, repeat) does not change. What changes is who starts it, who watches it and what happens when it ends.

Aspect	Chat agent	Background agent
Who starts work	A person typing	Events, schedules, mentions
Who watches	The person, live	Nobody, by default
Memory	The conversation	Durable store across runs
Failure handling	The person retries	Queue retries, resumes from state
Safety	Human sees each step	Permissions, sandbox, approval tiers
Cost risk	Bounded by attention	Unbounded unless capped

Teams underestimate the last row. In chat, a person gets bored and stops. A background agent never gets bored.

Cost control

Every source this week flagged cost. Perplexity says parallel agents and large codebases use more credits. Write-ups of DeepSeek's README note that each Ticket consumes model tokens and a busy repository can create many Tickets. The controls that work:

Hard budgets at several levels. Cap spend per task, per agent per day and per month. A task that hits its cap stops and asks. Think of a prepaid card, not a credit card. See cost and latency budgets.
Filter before you think. Drop events that need no action with cheap rules or a small model before they reach the expensive one.
Limit concurrency. A queue with five slots keeps a burst of 200 events from becoming 200 parallel sessions.
Stop runaway loops. Cap steps per task, detect repeated identical tool calls, and use a circuit breaker for failing dependencies. An agent retrying a broken API all night is the classic surprise bill.
Right-size the model. Use a strong model for planning and a cheaper one for routine summaries.
Alert on the trend. A sudden jump in daily spend usually means a loop or a noisy trigger, not more useful work.

What it means in practice

Agents become services, and services need owners. Someone must be on call for a background agent, as for any production system. Decide who before launch.

The harness matters more than the model. This week's products differ less in model choice than in how they route events, isolate work and ask for approval. DeepSeek released a harness bundle, not a model. If you build your own, invest in the agent harness first.

Identity becomes the main risk surface. An agent that reads Slack, GitHub and Gmail with your permissions can leak or change a lot. Treat agents as non-human users with their own accounts, scopes and audit trails.

Approval design becomes product design. Too many requests and people stop reading them; too few and the agent does something regrettable.

Consumer agents are moving towards action. Airbnb controls the whole transaction, from reservation to payment to support. An agent that can change a booking or start a refund needs the same tiered permissions and audit logs as an internal one.

What to do now

Pick one bounded, recurring job for a first agent, such as bug triage or a weekly metrics summary. Avoid anything that moves money or deletes data.
Write the job description as a spec: sources, outputs, schedule and what "done" means.
Give it its own identity with the narrowest scopes that work. No shared personal tokens.
Run it in an isolated environment under a dedicated account.
Define three action tiers: act freely (read, draft, comment), act then notify (open a pull request), ask first (merge, send externally, spend, delete).
Set hard budgets per task, day and month, plus a step cap. Make hitting a budget a visible event.
Make execution state durable and side effects idempotent, so a crash resumes rather than repeats.
Log every trigger, tool call, approval and cost by task, and review a sample weekly.
Test against injected instructions in comments and emails before connecting real channels.
Name an owner and a kill switch that anyone on the team can use.

Risks and open questions

Most of this is preview software. Perplexity calls teammates a research preview whose behaviour may change. DeepSeek says its prototype is not production-ready. Treat both as signals of direction, not finished blueprints.

Vendor claims are unverified. Meta's avatar preference result comes from its own raters. Perplexity has published no reliability figures. Airbnb's agent will not reach guests until the first half of 2027.

Costs are opaque. Perplexity does not say how many credits a typical teammate uses. A cheap demo can become an expensive month on a busy channel.

Memory can drift. An agent that learns from feedback can learn the wrong lesson and repeat it quietly. Public guidance on auditing agent memory is thin.

Accountability is unclear. When a background agent sends a wrong message to a customer, responsibility between the person who set it up, the channel owner and the vendor is not settled.

Watch next: teammates on enterprise plans, whether DeepSeek turns the prototype into a product, background voice on Meta's glasses, and what Airbnb's agent can do alone when it ships.

Frequently asked questions

What is an always-on AI agent?

An agent that keeps a role and memory across runs and starts work itself when an event or schedule fires. Most are idle most of the time, like a smoke alarm that is always installed but sounds only when it detects smoke.

Is a background agent just a cron job with a language model?

Partly. A scheduler is one ingredient. A real background agent also needs event triggers, a queue, durable state, scoped permissions, approvals and monitoring. A cron job calling a model with no budget or approval step is a fragile start.

Do I need a special framework to build one?

No, but you need the parts. Many teams combine an event source, a queue, a durable workflow engine and an existing agent harness.

Which actions should always need human approval?

Anything hard to undo or that leaves your organisation: merging to a main branch, messaging customers, spending money, changing permissions and deleting data. Reading, drafting and opening a pull request for review are usually safe.

Is DeepSeek's dsh-superagent ready for production?

No, according to DeepSeek. The README calls it research code that is not production-ready and says the public version differs from the internal one.

Summary

Agents took a clear step from chat towards background work this week. Perplexity launched teammates for Max subscribers as a research preview, with memory, schedules, Slack and GitHub monitoring, isolated computers and approval requests. DeepSeek's Harness team open-sourced dsh-superagent, an MIT-licensed prototype that turns GitHub and Feishu requests into isolated worker sessions. Meta added US-only live voice to Muse, which keeps working in the background. Airbnb plans to start rolling out its own trip-planning agent in the first half of 2027. A long-running agent is a service, not a conversation: build the triggers, queue, durable state, permissions, checkpoints, logs and budgets first, start with one bounded job, and give it an owner and an off switch.

Always-on AI agents move from chat sessions to background teammates