AI Agents Trends: Perplexity Teammates and Meta Spaces Give Solo Operators Persistent Agents

Two agent products added the same capability in the first week of November: work that continues after the conversation ends. Perplexity introduced Teammates on November 4, and Meta added Spaces to its Muse agent on November 6. In the same week, security firm Apiiro counted 1,122 public copies of one coding agent settings file that contained passwords or keys, all traceable to a permission setting that outlasts the moment it was granted.

Read together, the three items describe the decision now facing a solo operator. An agent that keeps working needs fewer prompts from its owner, and every grant of access it receives stays in force for longer. The useful questions now cover what an agent is assigned, what it can reach, and who checks the result.

What shipped

Perplexity Teammates are agents assigned to ongoing work. According to Perplexity's help center, a teammate keeps its role until the user changes it, schedules its own follow-ups, retains memory between conversations, and can split a goal into tasks that run in parallel. Each teammate runs on its own isolated computer with a separate desktop and browser, and its browsing sessions and cookies are not shared with other teammates. The company's announcement says a user can review completed work, take over the desktop, or redirect the agent while it runs, and that teammates can be added to Slack channels.

The access model is specific. The help center says credentials are encrypted and that teammates cannot view them, and it tells users to review requested permissions and to allow only the GitHub repositories a teammate needs. The initial research preview is limited to individual Perplexity Max subscribers on the web. Perplexity describes the feature as still under development and says its behavior may change.

Teammates draw on the monthly credits included with Max, and the help center says parallel agents, large files or codebases, and frequent automations consume more of them.

Meta Spaces takes a lighter approach. TechCrunch describes Spaces as topic-focused conversations in the Muse sidebar, which Meta calls custom experiences. A user describes an idea in chat and Muse builds a tracker, planner or project board. Meta says connected apps keep a Space updated in the background without a new request. Meta's examples are personal, such as a gift tracker and a wedding planner, and TechCrunch's report does not name the supported apps, availability by region, or a price. Mark Zuckerberg said on Meta's October earnings call that Muse agents had reached 10 million users in the US and Canada less than two months after launch, a figure that measures reach and does not measure completed work.

What a remembered permission can cost

The Apiiro study is the practical warning for anyone running agents alone. The Hacker News reported that when a user picks “Yes, and don't ask again” in Claude Code, Anthropic's coding agent, an allow rule is saved to .claude/settings.local.json in the project folder. When that rule records one exact command, any password or token typed into the command is saved in plain text.

Apiiro found 104,185 copies of the file in 103,617 public GitHub repositories. Of those, 1,122 held at least one secret, for 1,379 distinct secrets in total, including 379 database passwords. Apiiro did not test whether the credentials still worked, although one organization it notified confirmed that its key had been live. Of the 16 coding agents whose documentation the researchers compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.

iTnews reported that most of the exposed files belonged to individual developers, and that the count included 122 Supabase service-role keys. Boris Cherny, head of Claude Code at Anthropic, said on Hacker News that the company is looking at prevention, and argued that exposed copies had been checked in manually because the tool excludes the file from git when it is created. Apiiro's data complicates that account: in 539 of the 1,105 repositories it traced, a commit listing Claude as a co-author had changed the file.

Automated scanning does not settle the problem. Across the 1,122 files, gitleaks flagged 564, TruffleHog flagged 643, and 215 were flagged by neither, mostly because a password typed inside a command does not match a known key format.

Separating the reviewer from the worker

A persistent agent also accumulates assumptions, which is the problem addressed by the Elephant-Goldfish Model, an Apache 2.0 plugin Google released in October. One long session holds the project context and drafts a specification. Fresh reviewer sessions then read that document and its source material without the earlier conversation, and the person approves the design before anything is built. The repository lists installation for the ChatGPT and Codex desktop apps, Antigravity and Claude Code, and states that a review does not replace tests or human judgment. The built-in workflow targets software specifications, and a separate review loop accepts other document types with reviewers the user chooses.

The method applies beyond code. An agent that has held a role for weeks is poorly placed to judge its own output, and a reviewer with no shared history is more likely to notice what the worker took for granted. That matches the separation described in the eval loop guide for solo operators.

Practical steps for a one-person operation

The following steps are general guidance drawn from the sources above.

Write the assignment as a role with an end condition. Teammates keep a role until it is changed, so the role description functions as a standing instruction. It should name the recurring job, the systems involved, and when the agent must stop and ask.

Grant access per job. Perplexity's advice to select only the repositories a teammate needs applies to every connector. The approval loop pattern for small teams covers where a human decision belongs.

Audit remembered approvals on a schedule. Apiiro's recommendations, as reported, are to rotate every credential a settings file has ever held before cleaning it up, stop tracking the file in git, add it to the project's own ignore list, refer to secrets through a variable from a secrets manager, and approve command patterns in place of exact commands. Deleting the file alone does not remove it from git history or forks.

Measure credits per completed job. A monthly allowance does not show which assignment is consuming it. Recording credits used against finished work gives an operator the same comparison described in the cost routing analysis.

Run one assignment before adding a second. Background updates remove the prompt that would otherwise reveal a stalled task. Operators assembling their own version can compare these products with scheduled background checks, and readers new to the category can start with the agent fundamentals.

What to watch

Perplexity says it will expand teammate access and features in the coming weeks, and Anthropic has said it is examining prevention for the settings file problem. The measures that will matter most to small operators are not yet public: how often a persistent agent finishes an assignment without intervention, and how many credits that takes.