Rabbit's OS3 promises to work out on its own which files, apps and models a task needs. In my experience, that's the part of any automated system most likely to go wrong quietly, in small ways nobody notices until it's repeated a hundred times. Reliable automation comes from deciding exactly what happens and when, not from a system guessing well.
Rabbit just launched OS3, an 'agentic operating system' that runs across Windows, Mac and Linux and, according to the company, works out on its own which devices, files, apps and AI models a task needs. No R1 hardware required anymore. That single phrase, that it automatically determines what it needs, is the part I'd want to poke at before I trusted it with anything that mattered.
I build automated systems for a living. WhatsApp flows, document pipelines, reminder systems, a content site that writes and publishes without a person touching it. The thing I've learned, slowly and sometimes expensively, is that the failures in an automated system are almost never in the clever part. They're in the boring part nobody thought to check.
What 'figuring it out' actually looks like when it goes wrong
I run BabyJunctions, a site that publishes content without anyone writing it. Early on it did two things I hadn't anticipated. It wrote about the same topic twice, because nothing in the pipeline remembered what it had already covered, until I added a duplicate check myself. And product images broke or didn't match the product sitting next to them. Neither of those is a hard problem. A person glancing at the page would catch both in seconds. But the system wasn't glancing at anything, it was just running, and it ran happily into the same mistake as many times as I let it.
That's the pattern with unattended systems generally. They don't fail at the hard, interesting decisions. They fail at the obvious ones, because nobody built a check for the obvious, on the assumption that something so basic wouldn't need one. An agent that's supposed to work out on its own which files and apps a task needs is making dozens of those small, boring decisions every time it runs. The promise is that it gets them right by inference. My experience says you don't get to skip building the checks just because the system is smarter.
The decisions I don't let a system guess at
At Arham Clinic, the vaccine reminder goes out the day before the vaccine is due. Not two days before, not on the day. That timing isn't an AI inference, it's a decision I made because it's close enough that parents remember and early enough that they can still plan the visit. And if the child doesn't come, a follow-up message goes out automatically. That second message used to be the one a busy front desk dropped most often, because chasing a missed visit always came after everything else in the day. Now it happens every time, because I told the system exactly when to send it and exactly what condition triggers the follow-up.
None of that required the system to figure out what it needed. It required me to figure out what it needed, once, carefully, and then let the system execute that decision reliably forever. That's a completely different kind of automation from one that infers its own plan of action on the fly. Both can look impressive in a demo. Only one of them I'd trust with a clinic's patient list.
Where I do want a system deciding things for itself
I'm not against agents that make their own choices. There's plenty of automation work where letting the system decide is exactly right, usually anything where the cost of a wrong guess is low and easily reversed. Sorting a support enquiry into the right category. Picking which of five templates to use for a reply. Choosing which API to call for a lookup. These are places where flexibility is worth more than certainty, because getting it wrong costs almost nothing.
The line I draw is around anything that touches money, health, or something that's expensive to undo. Rabbit's own privacy language is a good example of the tension. It says OS3 won't store, copy, use or sell your data, but it will keep your chats and memories on its servers, and any other AI providers it hands work off to handle your data under their own rules. That's a lot of hops for a business to reason about when it's deciding whether to let an agent touch its files and accounts on its own initiative.
The other thing nobody mentions in the demo: cost at volume
There's a second reason I lean towards systems I control closely rather than ones that run in someone else's cloud and decide things for me. Zapier and Make charge per task, and that's fine for something that fires a few times a day. It falls apart once an automation handles every enquiry, every order, every message a business gets. Per-task pricing turns success into a growing bill, right when a business most wants the automation to scale for free. I use self-hosted tools for a lot of my automation work partly for privacy and partly for that reason: the cost of running it stays flat while the business grows around it, instead of climbing with every extra thing it does well.
That's the practical version of the same point. An agent that decides for itself which model or app to call in the moment is also, usually, an agent whose running cost you don't fully control, because you're not the one who decided which service gets used and how often.
What I'd actually check before touching something like this
- Whether the system's key decisions, like timing, sequencing and what counts as a duplicate, are ones I've explicitly set, or ones it's inferring on the fly each time
- Whether a wrong guess is cheap and reversible, or expensive and visible to a customer
- Whether the pricing model rewards the automation for running more, or punishes me for it
- Whether I can see exactly what it did after the fact, not just what it says it's going to do
Rabbit's pitch is that OS3 is smart enough to work out what it needs without you specifying it. That's a genuinely useful property in the right place, and a genuinely risky one in the wrong place. The demo never tells you which one you're getting until it's already running in your business, on your data, at your volume.
