Skip to content
Agents of Humanity
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
AssistanthybridProprietary

Doubao

ByteDance · doubao.com

Doubao is a closed, provider-hosted AI assistant and task agent that runs only on its vendor's models and servers. Owners get in-product controls over memory, training opt-out, connectors and task authorisation modes. The published policies document no export of the agent, no way to run it without the provider, no tamper-evident record, and content use for model training unless the owner switches it off.

Strengths
  • Memory can be switched off, and explicitly saved memories can be listed and deleted item by item
  • Owner-created skills and custom connectors extend the agent
  • Task mode offers owner-selectable authorisation modes plus fixed confirmation for high-risk actions
  • Connector credentials can be disabled one by one, and disabling deletes the stored credential
Gaps
  • No documented export or migration of the agent; it runs only on provider infrastructure and Doubao models
  • Content data is used for model training by default (opt-out), under a broad content licence
  • No tamper-evident action record, change history or rollback
  • The provider may change or terminate the service at will; no post-termination export window
Evidence

All 26 findings

Current hosted service as of 2026-09-30. User Agreement and Privacy Policy updated 2026-09-10, effective 2026-09-17. Includes chat, memory, AI cloud drive and Work Task (agent) mode, with local-computer and cloud-computer modes, skills, connectors and partners. Desk review only: no signup, login or use of hosted services.

Portable · Can you leave, take the whole agent with you, and keep it alive?

0%
  • P1
    Owner-usable round trip

    The privacy policy's rights section lists viewing, copying and deleting individual conversations and works, and downloading cloud-drive files. It documents no export of the agent, and no restore on a runtime the provider does not operate.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer a one-action export of the whole agent
    • Publish an importer or runtime not operated by the vendor that restores it
    Fail
  • P2
    Complete export

    No agent export is documented. Memory, custom skills, connector configuration, task history and settings stay with the provider. The account-deletion agreement tells users to back up data themselves before deletion but offers no bundle to do so.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Export every class of agent state (memory, skills, connectors, task history, settings) in one bundle
    • Allow integrations to be re-linked without Doubao's connector broker
    Fail
  • P3
    Runs without the provider

    The agent runs only as a provider-hosted service tied to a Doubao account. The User Agreement §2.10 grants a personal, revocable, non-transferable licence, and §2.7 lets the company stop providing the service at any time.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide a runtime that runs without a provider account or servers
    • Grant a perpetual, irrevocable right to run it
    Fail
  • P4
    Model independence

    The algorithm and model filing lists only Doubao's own models (Doubao LLM, text-to-image, video and music models). No owner choice of model, including local open-weight models, is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let owners configure any model meeting a published minimum, including local open-weight models
    • Keep every capability working with a non-Doubao model
    Fail
  • P5
    Exit survives termination

    The terms let the company suspend or terminate service without notice for suspected violations and decline to restore deleted content (§5.1.7, §10.1). The privacy policy §6.6 says data is deleted or anonymised if operations stop. No post-termination export window exists.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to an export window of at least 30 days after any termination, including bans
    • Publish a shutdown plan that preserves owner access to agent state
    Fail

Transparent · Can you see everything the agent is, and everything shaping it?

13%
  • T1
    Readable without the provider

    Agent state (conversations, memory, skills, task records, cloud-drive items) is held on provider servers and is readable only through Doubao's closed apps and service. No schema or owner-held keys are documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Store agent state in documented open formats the owner can read offline
    • Let the owner hold any encryption keys
    Fail
  • T2
    What runs is what you see

    Two shortfalls. The base system prompt and injected memory summaries are not viewable. The model version in effect cannot be determined, since only the product-level 'Doubao LLM' is named. Task mode shows execution steps, but not the assembled context.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the full assembled context for any call
    • Show the exact model identity and version in effect
    Fail
  • T3
    No shadow data

    Retention is stated only as 'as long as necessary', with open-ended extensions for legal, financial, audit and dispute purposes. The provider builds a personalised-recommendation profile from inputs and behaviour, and device and app-list logs are collected, none of which the owner can view item by item.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a bounded retention period for every data class
    • Let the owner view derived profiles and logs item by item
    Fail
  • T4
    No hidden steering

    Shopping and group-buy results are supplied by affiliated Douyin e-commerce and local-services platforms. When a Douyin account is bound, Douyin returns personalised search results. This is disclosed, but no switch to exclude affiliate sources from answers is documented. No binding no-paid-placement commitment was found, and the third-party SDK list shows no advertising SDKs.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner switch off affiliate-sourced shopping and search results
    • Put a no-paid-placement commitment in binding terms
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    Task mode displays actions and progress, and browser screenshots can be viewed after a task. No durable action log is documented for connector calls, cloud-computer background runs or remote control from other devices. Behaviour when recording fails is not addressed, and the record is conversation history the user can delete. Under G12, at least two shortfalls count as present.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep a durable log of every action with arguments and targets across all trigger paths
    • Alert the owner when an action cannot be recorded
    Fail
  • A2
    Tamper-evident, owner-checkable

    No integrity data, signing or verifier for any action record is documented. The record is held by the provider and can change without trace.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign action records
    • Anchor integrity data with the owner or an independent witness and publish an open verifier
    Fail
  • A3
    Agent cannot rewrite its record

    The task record is stored server-side, outside the file and browser tools documented for the agent. No protection against the agent altering or suppressing it is documented, so protection rests on architecture convention only.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that the agent cannot alter or delete its record, and how the owner can check this
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

0%
  • V1
    Obtainable source, matching build

    The hosted service and the client apps are closed. The terms forbid reverse engineering (§5.1.2(9)), and only third-party open-source notices are published.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish source for every required component with the right to modify and maintain
    • Make distributed builds verifiable against source
    Fail
  • V2
    Owner-rooted identity

    The agent's identity is the provider-issued Doubao account, which the provider can suspend or permanently close (Account Service Terms §6.3, §6.5).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root the agent identity in an owner-held key or domain
    • Let the owner rotate or recover it without the provider
    Fail
  • V3
    Change history and rollback

    No change history, attribution or rollback is documented for memory, skills, settings or model version. The memory panel shows only current items, and auto-summarised memory refreshes on its own schedule.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep an attributed change log of agent state
    • Offer one-step restore to an earlier state
    Fail

Modifiable · Can you change anything, and can only you change it?

40%
  • M1
    Instructions and logic

    Owners can create custom skills, use local skills and stop using official skills. The base system prompt and provider instructions are not documented as replaceable.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose the base prompt and default skills as owner-editable instructions
    Partial
  • M2
    Memory

    Memory can be toggled off. Explicitly requested memories are listed and deletable item by item, and can be changed by chat instruction. Model-summarised memory drawn from chat history is not itemised; it is only described on request, and updates are periodic rather than immediate.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Itemise model-summarised memory with edit and delete controls
    • Apply edits and deletions immediately
    Partial
  • M3
    Tools

    Owners can add connectors from a marketplace, create custom connectors and skills, and disable or delete them. Removing built-in tools (for example web search, browser operation, image generation) is not documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner remove every built-in tool
    Partial
  • M4
    Owner has the final say

    The local sandbox is on by default, and owners can choose a less restrictive authorisation mode ('allow all'). Provider content filtering (User Agreement §2.11, §5.2) and the high-risk confirmation mechanism are fixed, with no owner override documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make each provider-imposed protection configurable by the owner, with a warning
    Partial
  • M5
    No unilateral change

    The company may update, replace or change the software and service at any time, with notice only 'where feasible' (§2.6, §8.2). The model is a hosted service, and no version pinning or opt-in updates are documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let owners pin model, instruction and runtime versions
    • Announce behaviour changes in advance and make them opt-in
    Fail

Controllable · Is your word final?

25%
  • C1
    Boundaries

    Limits exist for local file scope (project folder and authorisation modes), connector enablement and Feishu permissions. Several dimensions are missing: no per-recipient or per-domain contact limits, no instruction-source limits, and no spend caps, even though shopping and a Douyin Pay wallet are offered. Remote control from other logged-in devices is on/off only.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Add per-recipient, per-domain and per-tool allow and deny lists
    • Add spend caps for wallet and shopping actions
    • Keep limits outside the agent's write access on every path
    Fail
  • C2
    Approval gates

    Owners choose among 'always ask', 'confirm on demand' and 'allow all' modes, and high-risk actions (funds, identity, sensitive accounts) need manual confirmation. The gated classes are fixed, and in 'confirm on demand' a safety model decides what counts as risky.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner gate any tool or action class
    • Make gating independent of a model's risk judgement
    Partial
  • C3
    Immediate halt

    Owners can terminate or take over a task at any time. No single global stop covering cloud-computer background tasks, other running tasks and remote-control sessions is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide one control that stops all in-flight, background and cloud tasks and needs explicit resume
    Partial
  • C4
    Data serves only the owner

    For the personal edition, content data (text, uploads, voice, screen-share frames) is used for analysis and model training by default, with an opt-out switch. The terms grant the company a free, worldwide, sublicensable licence to user content, including for brand promotion. Marketing SMS is on by default, and term changes bind on continued use.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make training and other secondary use opt-in
    • Require specific consent before changing data terms
    • Narrow the content licence to serving the owner
    Fail
  • C5
    Credential custody

    Connector credentials are listed in connector management, can be disabled one by one and are deleted when disabled. The notice says they are used only for the owner's tasks. Cloud-mode login cookies are saved automatically and can be cleared only all at once via a single switch.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • List saved cookies and credentials individually with per-item revoke
    • Make cookie saving opt-in
    Partial
  • C6
    Full deletion

    Account deletion is available in settings, but only after identity checks, and the provider may halt it during disputes. No completion time limit or confirmation is stated. Data subject to legal retention or kept for finance, audit or dispute purposes survives, stored separately.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Delete every provider-side copy and backup within a published limit
    • Confirm completion to the owner
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of Doubao (https://www.doubao.com).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 15:05:17 UTC · 18 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/doubao.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding