In September I gave Muse, Meta's personal agent, access to my inbox and asked it to find subscriptions we weren't using. It flagged Chegg and Quizlet. Nobody in the house was using either anymore, and it recommended canceling both. As I wrote in The Return of the Personal Agent, it left the cancellations to me.
What stayed with me was the direction of the recommendation. The useful outcome was a payment I could stop making. An agent working for me had just found revenue somebody else was about to lose.
On September 20, 12 days after Muse launched, Amazon blocked it. On October 22, Reuters reported that major U.S. banks were blocking third-party agents from operating inside customer accounts and making transactions.
Both companies raised security concerns, and I take them seriously; I'll come back to them. But I'm the kind of engineer who signs up for a new agent the week it ships. I've used five personal agents since the spring and built one of them myself. Putting a technology to work for me is how I understand what it does to everyone else. Five agents in, the pattern that keeps showing up is this.
A company's agent policy tells you where its margin lives. Businesses that earn from the customer's attention will block the agent. Businesses that earn a fee on each transaction will let it in, as soon as it shows identification. Banks sit between the two, and they're the case where the security argument carries the most weight on its own.
That rule explains Amazon, the banks, and the card networks, and it explains why Walmart made the opposite call from Amazon in the same week. It doesn't tell you why one particular agent got blocked, and an agent that passes every security check can still threaten a business model. The test for telling those apart comes at the end.
Amazon is defending more than the checkout
A storefront does several jobs at once. It helps me find a product, gives me reasons to trust the seller, and tries to influence what else I buy. Each of those jobs is a place to earn money. Amazon's 2025 results show $68.6 billion in advertising revenue, most of it sponsored placements inside search results, alongside the business of selling and delivering products.
If I ask an agent to compare three products against a budget and a set of requirements, the selection can happen before I reach the retailer. Amazon might still get the order and lose its influence over the choice. That mechanism is narrower than "the agent skips the ads." An agent can land on a sponsored listing and follow the same unhelpful recommendation a person would; browser automation doesn't make it immune to persuasion. And not every visit produces an impression the retailer can bill, because Amazon's Sponsored Products are priced per click. What matters is where the decision happens. When the agent decides upstream, the retailer has fewer chances to redirect the customer before checkout.
Amazon's stated objections to Muse were specific. It said the agent didn't identify itself and appeared to capture and store customer credentials. Meta says credentials go into secure storage that Muse can use without seeing the passwords. Keeping a password out of the model's view is useful, but it doesn't settle what authority the service should have inside someone else's platform. Judge Maxine Chesney put that distinction into a court order in March, when she granted Amazon a preliminary injunction against Perplexity's Comet browser. Comet accessed Amazon accounts with the user's permission, but without authorization by Amazon. I argued the same thing from the platform side in The Agent Is Wearing Your Badge. An agent acting on your credentials needs an identity of its own.
In August the Ninth Circuit vacated that injunction. On the facts before it, the court found Amazon unlikely to show that Perplexity itself had accessed Amazon's computers under the federal anti-hacking law. It treated the user as the one accessing the site, with help from the tool. That didn't establish an unrestricted right of access for every agent. On September 10 the court denied rehearing. Ten days later, Amazon blocked Muse anyway, through its Conditions of Use rather than a courtroom.
Amazon is not against agents, though. It ships Rufus and Buy For Me, two shopping agents of its own. Andy Jassy said in November that agentic commerce "has a chance to be really good for e-commerce." Amazon is against agents it doesn't operate, inside a store where it sells the shelf. The legal boundary matters, and so does the question a court can't answer: under what terms would Amazon want an independent agent to help its customers shop?
Walmart has a shelf to defend, too
At Connect, four days after Amazon's block, Meta announced more Muse connectors, including Walmart, Best Buy, and Sephora. The same agent gets a connector from one retailer and a pop-up from the other.
It's tempting to explain this as Amazon protecting advertising while Walmart pursues sales. But Walmart sells advertising too. Its global ad business reached nearly $6.4 billion in fiscal 2026, including VIZIO. The difference is the tradeoff each retailer faces. An agent can bring a merchant a customer it wouldn't otherwise reach, while moving part of the shopping experience outside that merchant's control. Walmart has more to gain from another route into the customer's decision. Amazon has more of that decision already happening inside its store.
That's an explanation to test rather than a disclosed calculation from either company, and it predicts that access will change as the economics change. A retailer can welcome discovery through an agent while insisting on its own checkout, data, and payment arrangements. Google's Universal Commerce Protocol, which Walmart, Target, and Wayfair helped develop, makes that negotiation concrete: the retailer keeps its business logic and stays the merchant of record. A negotiated connector is a different proposition from an unidentified browser operating inside a customer account. What a retailer is deciding is how much control it keeps when it lets the agent in.
Demand is pushing from the other side. Muse reached No. 1 on Apple's App Store about a week after launch, and Adobe Analytics measured a 393% year-over-year rise in AI referral traffic to U.S. retail sites in the first quarter. Blocking an agent that popular is a bet that customers keep coming anyway, and Amazon is the only retailer with the position to make it.
At the bank, the security case is the strongest of the four
A bank account makes the risk harder to dismiss. Reading a balance and moving the money are different grants of authority. An agent needs to know what the customer permitted, what cash has to stay available, and when to ask again. A mistaken transfer creates problems that an unwanted product recommendation doesn't. Sharing credentials complicates responsibility when an agent does something the customer didn't intend; the consumer-protection rules turn on actual authority and its exceptions, so account access alone doesn't settle liability.
The banks' line follows that distinction. JPMorgan allows view-only access through Plaid, and Citi allows it through approved open-banking providers; what both block is logging in and moving money. On JPMorgan's third-quarter call, Jamie Dimon said the firm is "not against agents or for agents," that it uses them internally, and that it won't let just any outside agent inside the company. Part of his reason was that there could be thousands of them going rogue. Of the four companies in this essay, that's the most reasonable position on an unidentified agent, and the one with the most at stake if it's wrong.
The economics are no secret, because JPMorgan stated them on the same call. Dimon described net interest income on idle balances as one of the ways the bank pays for banking services. If that income went away, he said, the firm would do something different over time, such as subscriptions or accounts that bundle investments with checking. CFO Jeremy Barnum went further: a bank shouldn't be hoping its deposits are stable because the money is difficult to move. Amazon never said anything that plain about its shelf.
That candor points at the consequence I find more interesting than a story about banks protecting their spread. An agent that regularly finds surplus cash and compares alternatives will make low-cost deposits less dependable. When that revenue goes, the cost of providing the service doesn't go with it. Some of it becomes a fee the customer can finally see and compare, which is the outcome Dimon described and the one I'd prefer. I'd welcome an agent that helps me make that comparison. I'd also expect it to understand why the money is in the account. Optimizing a balance without understanding the bills it has to cover would be an efficient way to create a new problem.
The payment networks want a trusted transaction
Visa and Mastercard start somewhere else. A transaction that runs on their network supports their business whether a person or an agent initiated it. They have every reason to make delegated payments work, provided they can manage the risk. Visa's Trusted Agent Protocol, developed with Cloudflare, helps merchants recognize approved agents and receive information about their intent; Visa cited a 4,700% surge in AI-driven traffic to U.S. retail sites as the reason to build it. Mastercard's September expansion of Agent Pay combines agent identity with intent, behavioral, and fraud signals to support authorization decisions, with a Know Your Agent layer built with Skyfire.
These are efforts to make the transaction acceptable to everyone involved. Identifying the agent is one part of the work; establishing what the customer authorized, enforcing limits, and handling failures are separate parts. The contrast with the banks is useful without being the whole explanation. Banks earn transaction revenue too, and the networks also have to contain fraud. What differs is each company's exposure to a particular agent action, and that exposure follows the margin.
Some of what the agent skips still needs funding
Tailwind is the case that brings this closest to my own work. This site runs on it, and I've shipped hundreds of Tailwind pages since January. I benefit from a framework whose usefulness and commercial success turned out to be different things.
In January, Adam Wathan reported that traffic to the documentation had fallen about 40% from early 2023 and revenue was down close to 80%. He had laid off three of the company's four engineers. The docs had been the route into the paid products, and AI coding tools now write Tailwind classes without anyone opening tailwindcss.com. Wathan disclosed the layoffs while declining a pull request that would have packaged the docs as a single file for AI consumption. Making them easier for agents to read would have made the storefront emptier. His numbers don't separate the docs effect from other changes in demand, but they show why growing adoption wasn't enough to sustain the business.
On September 9, Tailwind Labs joined Shopify. The framework had passed 110 million weekly installs. The open-source projects stay MIT-licensed, the team keeps maintaining them, and new sign-ups for Tailwind Plus and ui.sh closed. In March I wrote Dark Fiber, Bright Future about cable that outlived the companies that laid it. Tailwind's docs outlived Tailwind Labs the same way: the framework got an institutional home, and the independent business around it stopped.
Scale that up and you get Cloudflare's numbers. In June its CEO, Matthew Prince, said bots had passed humans for the first time, at 57.5% of HTML traffic. Cloudflare Radar's crawl-to-refer ratio counts how many pages a platform crawls for every visitor it sends back. For July, Google sat at 4.7 to 1, OpenAI at 251 to 1, Perplexity at 289 to 1, and Anthropic at 1,917 to 1, down from roughly 24,000 to 1 in the first quarter. I use Claude every day, so I'll note that its crawler has the worst exchange rate on the list even after improving by an order of magnitude. Search was an exchange: Google crawled your page and sent you a reader. An AI platform answers the reader itself.
A crawler reading public documentation and an agent moving money carry different authority and risk. The shared economic question is who pays for useful work when the old route to the customer weakens. Cloudflare is trying one answer. Its Pay Per Use beta, launched September 30, lets publishers accept offers for specified downstream uses of their content, alongside Pay Per Crawl, which charges for access. The arrangements still have to prove they produce returns worth accepting. Documentation, reporting, and product information need continuing work. If agents help people bypass the visits that funded that work, somebody has to pay for its replacement. Better access today is a poor bargain if the information stops being maintained tomorrow.
The agent can become the new shelf
This is where my enthusiasm for personal agents needs its own scrutiny. I want an agent that compares options according to my preferences. I'm also relying on a company to decide which options it can see, which merchants it can reach, and how recommendations get ranked. Moving the decision out of Amazon doesn't guarantee it belongs to me. It can move into the agent provider's product, where another set of defaults and commercial relationships shapes it.
Look at who is building the agents. Meta reported $200.97 billion in revenue for 2025, and $196.18 billion of it was advertising. Alphabet's revenue passed $400 billion, and the company guided to $195 billion to $205 billion in capital spending for 2026, more than double the year before. Gemini Spark is one of the things that money buys. The companies that built the attention economy are the ones shipping agents that promise to route around it, and none of these products is a charity. Meta, for its part, says Muse doesn't share conversations or the data in its virtual machine with Meta's advertising systems. That's a useful privacy commitment. How the agent selects and ranks recommendations is a separate question.
I still want to know how the agent is funded and how that shapes the work. Can it recommend a merchant that has no agreement with its provider? Will it consider an option that earns the provider nothing? Can I see why it chose one offer over another? A signed request tells a merchant who sent it. It can't tell anyone whose interests shaped the recommendation.
The subscription audit is useful here. Helping me stop spending is a revealing test of whether the agent serves my intent. A service optimized around completed purchases could be excellent at checkout and much less useful at telling me to keep what I already own.
What I would require from a platform
For engineering leaders, these choices become access rules, APIs, contracts, and operational responsibilities. A business has to decide what it's willing to support, and the platform has to make that decision enforceable. I'd ask three questions before calling a service ready for independent agents.
What proves the customer authorized this action? The agent needs an identity distinguishable from the customer's, plus authority limited to the task. Reading, buying, canceling, and transferring require different permissions, and the system has to enforce those limits outside the agent's instructions, as I argued in The Agent Is Wearing Your Badge.
Who handles the consequences? There should be an accountable operator, evidence of what was requested and done, and a way to stop the agent without disabling the customer. Rate limits and recovery procedures matter too. An agent can save my attention while consuming a business's capacity or repeatedly interrupting its staff.
What commercial terms remain after those requirements are met? If access depends on a distribution agreement, a fee, or use of a preferred checkout, that should be an explicit business decision. An engineering team needs to know which requirement controls a risk and which implements a commercial agreement.
That third question is also the test for my own argument, and it's where the hedge on the rule belongs. If platforms admit independent agents once they satisfy published safety and operational requirements, even when those agents reduce advertising opportunities or make switching easier, I'd put less weight on margin as the explanation for the blocks. If agents with comparable authority, controls, and operational risk get different access depending on who owns them or what commercial terms they accept, I'd put more weight on it. The comparison has to account for who carries the liability and the cost; a partner that accepts those obligations may deserve different access from a service that doesn't.
Watch what the agent would have skipped
I still want the agent that found those subscriptions. I also want a service worth using after the easy savings are gone, and an ecosystem that keeps producing the information it relies on. When a company blocks my agent, I'll look at the risk it identified and what it would take to resolve it. Then I'll ask what the agent would have skipped, who earned money from that step, and whether the company's own agent gets to skip it. The same scrutiny belongs on the agent provider. I want an agent that serves my intent even when the right outcome is no transaction at all.
