Tether’s 0.8B BotPsy fits a tool-calling agent on a phone, and says keep it away from your money

Most agent talk assumes a giant cloud model doing the work. Tether AI Research is betting the other way: a tiny model, built on Qwen3.5-0.8B, that runs on-device and calls tools for everyday tasks like calendar, email, search, travel and device settings, keeping personal data local. If small models can reliably handle routine agent work, assistants get cheaper, more private and less dependent on providers that can change pricing or cut access. Nvidia’s Nemotron 3.5 Bolt E4B made a similar on-device case (coverage), and cheap execution models are a theme across the industry (Gemini Decisions API).

BotPsy will ship open weights under Apache 2.0 for research and educational use, in bf16, Q8 and Q4 versions for Hugging Face and llama.cpp (llama.cpp 1.0). Tether says future work will tie it to its Hypersearch peer-to-peer search and QVAC local fine-tuning tools.

With the caveat that these are the developer’s own numbers, BotPsy roughly doubles its base model’s agentic scores and beats Qwen3.5-2B-Think, a model 2.5 times larger, on five of six tool-use benchmarks. The most practical gain may be restraint: it scored highest of the models tested on declining when no suitable tool exists. An agent that knows when not to act is worth more than one that acts confidently and wrongly, a lesson larger labs have learned the hard way (OpenAI’s misalignment reports).

The training recipe: fine-tuning, then distillation from three specialist teacher models, then two rounds of reinforcement learning. The distillation step recovered the knowledge and instruction-following that the first stage degraded. That is a useful, reproducible lesson about how specialization can quietly break general skills.

Multi-step research remains weak, performance drops as instructions pile up, and Hindi and Russian lag far behind English. Under prompt-injection attacks, unsafe responses fell from 46% to 31%, better but still high for an agent that reads untrusted web content. And the developers say it isn’t intended for money, personal information, health or other sensitive uses, even though the pitch lists email, finance and shopping as domains.

On-device agents are a good direction for privacy and cost. But the gap between marketing domains and fine print is where harm happens at scale. A phone assistant that can send messages and make purchases with a roughly one-in-three injection failure rate needs tight permissions and human confirmation, not autonomy. More in our agents coverage and tools coverage.