Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard

Editor’s Note — DCC.

Why this is on DCC. The subject is American: how US banks and retailers reacted to Meta’s personal AI agent, Muse. But the post is the first in a series that the account’s author is writing with the core drafting group of the Chinese national standard Security Requirements for Data Processing by AI Agents (智能体数据处理安全要求), sharing the standard’s preliminary research. Its choice of problems (agent identity, scope of authorization, credential sharing, liability for agent actions) is a signal of what the drafters are weighing. DCC has not seen a draft of the standard. DCC’s own reading follows the author’s conclusion, under its own heading.

What this is. A full translation. One part of the original is left out: its opening list of the account’s 14 earlier posts on AI agents. The last of those is the PrivacyLib essay, which DCC has published as Keeping an AI Agent Inside Its Personal-Information Boundaries. The seven charts are reproduced from the original, in Chinese, each followed by DCC’s English reading. The original’s 26 notes are translated at the end with their source links, and are cited inline as [note N]. The author writes in Chinese about English-language sources. Where the author gives a phrase in English, DCC keeps it. Other quotations are DCC’s rendering of the author’s Chinese, not the speakers’ original words. US legal instruments and product names are given in their English form. Long bill titles the author gives only in Chinese are DCC’s back-translations.

Sourcing. The facts, figures, and quotations are as the author compiled them from press reporting, company filings, court papers, and industry research. DCC has not independently verified them. Companion reading: DCC’s brief on TC260’s practice guide on AI-agent deployment.

In the course of drafting the national standard Security Requirements for Data Processing by AI Agents, this account has received many valuable comments and suggestions from all quarters. To communicate with you better and seek your advice, the account’s author and the standard’s core drafting group have decided to begin a series of articles sharing the standard’s preliminary research and basic logic, the better to learn from you all. This is the first.

On November 1, 2026, the US business news channel CNBC and The Wall Street Journal (WSJ) published in-depth investigative reports on the same day. They revealed a fight among the giants of US banking and retail over blocking access by “personal AI agents” and defending their business models [note 1]. The immediate trigger of this industry contest was Muse, an autonomous AI personal assistant that Meta Platforms launched on September 8, 2026. Meta disclosed on its October 21 earnings call that, about six weeks after launch, more than 10 million users in the US and Canada had created personal agents. Consumers used it widely to compare prices across platforms on the web and to place orders automatically. They also gave it access to bank accounts and credit-card statements to find high-yield savings accounts, negotiate bill rates, and cancel redundant subscriptions in bulk [note 2]. Faced with a fast influx of automated agent traffic, financial and retail companies, led by JPMorgan Chase, Charles Schwab, Morgan Stanley, Amazon, Neiman Marcus, and Kohl’s, put up defenses. They restricted or entirely blocked outside AI agents from directly accessing customer accounts and checkout channels, and Amazon went further, expressly asking Meta to remove it from the Muse shopping experience [note 3]. Another camp, led by Walmart, Shopify, and Best Buy, chose to open up, signing partnership agreements and building dedicated technical gateways to meet the demand of agentic commerce [note 3].

Drawing together the court records, technical audits, regulatory developments, and executive statements disclosed by the parties, this technical friction involves two sets of problems at once. The first fault line is missing identity verification, uncontrolled overreach, and liability transfer. Some personal AI agents work in a “silent agent” mode: they use the customer’s authorized login session and simulate human clicks in a cloud browser. Banks’ and merchants’ risk-control systems find it hard to tell a legitimate customer agent from a malicious scraping crawler. They also find it hard to stop the overreaching operations an agent launches because of model hallucination or excessive autonomy. Financial institutions are left with hard problems of compliance and of deciding who pays [note 4]. The second fault line is the commercial defense of control over traffic entry points and core profit pools. On the retail side, industry analysis likens an AI shopping agent to “an ad blocker with a credit card”. It skips the human browsing of web pages and chooses products from the user’s instructions and whatever price, review, and other information it can obtain. That is a potential threat to Amazon’s high-margin advertising business, close to $70 billion in 2025 (about $68.6 billion as disclosed in the company’s annual report). The business depends heavily on consumers browsing pages and clicking “Sponsored Products” placed at the top of search results [note 5]. On the banking side, Apollo’s chief economist Torsten Slok compared the average checking-account rate of about 0.1% in September 2026 with yields of 3.3% to 5.0% on some high-yield accounts. His analysis looks at the potential effect of AI agents lowering depositors’ switching costs and pushing idle funds to move [note 6].

Current access rules, user choices, and corporate positioning show three features. First, a survey of 51 large US retailers by the identity verification company Billions Network (conducted in August 2026, with data verified to September 2, 2026) classified the access rules each company declares in its public robots.txt directives and terms of service [note 7]. Second, user growth and authorization for autonomous transactions are moving at different speeds. About six weeks after launch, more than 10 million US and Canadian users had created personal agents on Meta Muse. Accenture’s banking-experience survey shows that 82% of respondents want to approve every AI action personally. NMI’s shopping survey of 1,000 US adults shows that 10% are willing to give an AI full control of a purchase, and 70% want to be able to review or override the AI’s decision before buying. Amazon’s executives said on that quarter’s earnings call that outside agents have not yet had a material effect on its advertising business [note 8]. Finally, while restricting outside agents’ access, the major companies are developing their own assistants and cash-management tools (such as Amazon’s Alexa for Shopping, JPMorgan’s Smart Cash, and Charles Schwab’s Charley). They are also rebuilding access rules through paid data interfaces or controlled connection protocols [note 9].

The Course of Events: A Timeline from the Early Court Battles to Meta Muse

The dense restrictions that banks and retailers placed on outside AI agents in autumn 2026 were not an isolated, sudden event. They are the result of a contest over “automated agent access rights” that has evolved since the second half of 2025 through four stages: litigation, a breakout product, back-office risk alerts in banking, and a political and regulatory contest.

Stage 1: Opening skirmishes and the court rulings (second half of 2025 to August 2026)

As early as the second half of 2025, AI-driven automated traffic in e-commerce had already reached a meaningful scale. Akamai, the cybersecurity and CDN provider, published its State of the Internet report in July 2026. Of all AI bot traffic monitored on Akamai’s global network from July to December 2025, nearly half (47.9%) was concentrated in the commerce and retail vertical. Defenses at the time were mainly monitoring: over 90% of AI bot activity fell into the “monitor-only” category, and about three-quarters of the remaining traffic was allowed through without restriction [note 10]. Meanwhile banking’s defense through data commercialization had already begun. In September 2025, JPMorgan renewed a customer data-access agreement with the financial data aggregator Plaid that includes a pricing structure. (Plaid said the agreement does not affect existing customer pricing agreements and that Plaid does not charge consumers directly, though downstream apps that use Plaid may set their own subscription prices.) It established a paid mechanism for outside apps to reach banks’ underlying data [note 10].

What broke the calm in e-commerce was Comet, an agentic browser launched by the AI startup Perplexity, which can search for products and place orders on Amazon’s website for the user automatically. In November 2025, Amazon formally sued Perplexity. It alleged that Perplexity concealed its AI agent’s identity and scraped Amazon’s website without authorization, in violation of the federal Computer Fraud and Abuse Act (CFAA) and California’s computer-fraud law. On January 20, 2026, another e-commerce platform, eBay, also updated its user agreement (effective February 20). It prohibited unpermitted “buy-for-me agents”, “LLM-driven bots”, and any end-to-end automated ordering flow without human review.

In March 2026, a US federal district court sided with Amazon and issued a preliminary injunction barring Perplexity’s Comet from accessing Amazon’s website. On August 4, 2026, however, a panel of the US Court of Appeals for the Ninth Circuit unanimously vacated the injunction. The appeals court looked at the technical architecture at issue. The user’s browser accesses Amazon’s servers, and Perplexity’s servers analyze the page and send operating instructions back to the browser, so the access is attributable to the user of the tool. On that basis Amazon could not readily show that Perplexity met the “access” element under the CFAA and California law. The judgment turned on that element, and it expressly left other liability questions, such as torts, to the rules that govern them. On September 10, 2026, the appeals court denied Amazon’s petition for rehearing. On September 21, Amazon filed an amended complaint. It keeps the CFAA and California computer-access claims, adds a claim for interference with contractual relations, and alleges that Comet’s iOS version accesses Amazon directly through Perplexity’s cloud servers [note 11]. Together, these developments put three things at the center of the dispute: the agent’s access architecture, the user’s instructions, and the force of platform terms.

Stage 2: Meta Muse breaks out, and Amazon blocks it head-on (September 2026)

On September 8, 2026, Meta Platforms formally launched Muse, a personal autonomous AI agent, in the US, later extending the service to Canada. (As of mid-October it was not yet available in the EU or Germany.) Traditional chatbots can only produce text replies. Muse, according to technical reviews, gives each user a separate cloud virtual machine (Muse Secure VM) with a built-in cloud browser at the base of its architecture. It initially ran Meta’s in-house Muse Spark 1.3 model, and keeps carrying out complex multi-step operations in the cloud even after the user exits the local app. On October 12, Meta Superintelligence Labs released the Muse Wonder and Muse Wonder Full models. They scored 52 and 56 respectively in the highest reasoning-effort test of the Artificial Analysis Intelligence Index v4.3. On release day Muse Wonder was opened to the Meta Model API and Muse Code, and Meta said it would come to Muse subscribers first; Muse Wonder Full is offered through paid Muse Code subscriptions.

Muse runs on two mechanisms: “Active Memory”, which keeps personal preferences across conversations, and “Active Focus”, which corrects itself in complex web flows. The team of Meta’s chief AI officer, Alexandr Wang, released a “Connectors” ecosystem. Through it Muse automatically connects to the Facebook, Instagram, and Threads accounts in the same Accounts Center. It also supports user-authorized connections to Gmail, Google Calendar, Outlook, Plaid, OpenTable, Google Docs, Spotify, Function Health, Withings, Tailscale, Peloton, and the local Mac file system. At the payment and settlement layer, Muse is closely integrated with two services. One is Link, the system of the payment provider Stripe. At merchants that do not accept Link, it issues a single-use, purpose-limited virtual card for each user-confirmed purchase, to reduce exposure of real card numbers. (Upstarts Media reported on October 18, citing the Stripe executive Dan Hill, that Link provides payment support for about 200 AI agents, including Muse, Instinct, and Grok Bot.) The other is PayPal, which announced a merchant checkout integration on September 22. Muse offers a free base allowance and US paid subscriptions at $20 a month (Power) and $100 a month (Maximum). In a scenario estimate, the investment bank Oppenheimer put Muse’s annual revenue potential at $27.5 billion if it attracted 115 million paying users at $20 a month [note 12].

Muse quickly posted user growth and commercial conversion. On downloads, it reached No. 1 on the US Apple App Store free chart within about 10 days of launch, briefly passing ChatGPT, Gemini, and Claude. Mashable, citing Sensor Tower data, reported on October 2 that Muse’s US downloads passed 5 million 22 days after launch. That was a faster pace to that level than ChatGPT, Grok, and Claude in the same tally. Meta disclosed on October 21 that, about six weeks after launch, more than 10 million users in the US and Canada had created Muse agents. On spending and real-world use, Meta CEO Mark Zuckerberg said on the third-quarter earnings call that shopping is Muse’s main use. More than a quarter of Muse’s weekly active users use the shopping function, and the average related purchase exceeds $200, a figure that includes travel spending. Beyond online shopping, early users also authorized Muse to read bank and credit-card statements to find and cancel forgotten recurring charges. (CNBC cited research showing that 43% of consumers are comfortable with an AI agent managing subscriptions.) Others had it contact customer service automatically to complete an IKEA return or an insurance cancellation. One user reported that Muse helped negotiate fiber-broadband rates with AT&T for two homes, with expected savings of about $1,920 over 24 months at the new rates. Over the same period, Meta’s share price rose more than 20% in the two weeks after Muse’s launch and more than 29% across September, its best month since 2013. At the same time, market worries that AI agents would replace traditional intermediaries weighed on other stocks in late September. Financial stocks such as Charles Schwab and LPL Financial, and online travel agency (OTA) stocks such as Booking Holdings, Expedia, Airbnb, and TripAdvisor, fell by around 5% or by varying amounts [note 13].

As Muse rapidly diverted the entry point to online shopping, Amazon moved to intercept it directly. Amazon first asked Meta to remove Amazon from Muse’s shopping experience. When Meta refused, Amazon formally cut off Muse’s access to the Amazon store on September 20, 2026, just 12 days after Muse’s launch, so that the agent could no longer browse its catalog or buy. When users tried to shop on Amazon through Muse, the system displayed a warning and sent shoppers a notice that unauthorized AI agents violate Amazon’s Conditions of Use. The Amazon spokesperson Lara Hendrickson said publicly that Meta had given no advance warning. She said that Muse did not identify itself when browsing, and that it appeared to store customers’ Amazon login credentials. Muse was not alone. According to user reports compiled by The Verge on October 17, xAI’s Grok Bot and OpenAI’s always-on agent Dots were also blocked on Amazon and other leading sites.

On September 23, three days after Amazon’s block, Zuckerberg presented Muse at Meta Connect 2026, the annual developer conference, as Meta’s core product for bringing “personal superintelligence” to the mass public. He said Meta would offer a generous free allowance and paid subscriptions for extra usage and more advanced models, and plans to monetize in future by charging merchants transaction fees. The conference also launched three devices: the portable voice-interaction device “Muse Charm” (planned to ship in December 2026), camera-free Ray-Ban Meta audio glasses ($349), and Meta VR glasses ($1,299.99, due in spring 2027). Meta also announced official shopping partnerships with Walmart, Shopify, Best Buy, Gap, Sephora, and Wayfair. From then on, retail’s split into camps over outside AI agents was out in the open [note 14].

Stage 3: Banks find “overreaching agents” in their back offices, and Wall Street raises its defenses (October 2026)

In October 2026 the conflict spread quickly from retail e-commerce to Wall Street’s core financial institutions. Consumers handed their online-banking usernames and passwords to Muse, Grok Bot, and Instinct, and asked them to check balances, find high-yield accounts, or pay bills. (Instinct is a San Francisco text-message digital concierge startup valued at $10 billion, developed by Spear Street Technology.) Banks’ back-office security monitoring systems began to sound frequent alarms.

On October 13, JPMorgan CEO Jamie Dimon was the first to make a public announcement, on the third-quarter earnings call: outside AI agents are barred from directly accessing retail customers’ accounts or operating them for customers. Dimon warned that there may already be “thousands of rogue agents” at work. Letting unvetted outside agents into the bank’s systems, he said, is “too risky” for both customers and JPMorgan, and he reminded customers that using outside agents means “liability transfer”. Three days later, on October 16, Charles Schwab CEO Rick Wurster spoke to Bloomberg Television and Reuters. He confirmed that the firm blocks requests by outside AI agents such as Meta Muse to access accounts for clients, “tens and twenties every week”, and expressly stops outside agents from moving client funds. He asked: “We can’t control it, and the client can’t control it. If something goes wrong, who is responsible?” On October 19, PNC Financial Services Group CEO Bill Demchak asserted that pure AI-agent banking transactions, with no human in the loop, will “never happen”. Banks, he said, should add, not reduce, operational friction when AI agents are involved [note 15]. On October 20, Royal Bank of Canada (RBC) CEO Dave McKay also said in an interview that RBC is considering blocking Muse from customer information, because of the liability risk banks bear for the security of customer data. On October 21, the retail giant Walmart published its Agentic Access Terms. It also announced the Walmart Agent Gateway and the Agent Profiles scheme due in November, laying out a controlled transaction channel for outside AI agents.

On October 22, Axios senior AI reporter Madison Mills published an exclusive investigation, later followed up by Reuters and CBS News. It disclosed that some large US banks had found activity in customer accounts by third-party AI agents the banks had not sanctioned. JPMorgan, Morgan Stanley, Bank of America, Citigroup, Wells Fargo, and others were tightening access controls. What bank executives found “horrifying” was that some agents behaved autonomously, apparently outside users’ explicit instructions. Some tried to initiate fund transfers in the background. One AI agent even phoned a bank’s customer service center to lodge a complaint without first consulting the human account holder. Bank executives then began drafting “day after” contingency plans for recovery after an incident: how to lock down and restore a customer’s account quickly if an AI bot errs and damages it. Separately, the cybersecurity outlet Cybernews relayed on October 23 an account by Shane Mac, CEO of XMTP Labs. On October 1, the Grok Bot he used sent a personal financial report to his company’s management Slack channel by mistake. He said his personal agent group chat and the company channel had similar names, and the agent used the same underlying connections for both, which confused the recipient. (Other reports said Meta Muse had also disclosed a private address without permission. Surfshark, working from Apple App Store privacy labels, counted 31 types of data that Muse declares it collects, second among the 13 apps it checked. Muse has even drawn controversy for generating adult content.)

In this stage, Morgan Stanley blocked third-party AI agents entirely. Citi shut off every agent connection except its existing open-banking read-only interface. Around October 29, Bank of America sent all its customers a warning email titled “Protecting your finances in an AI world”, urging them not to share passwords. Wells Fargo amended its online services agreement, effective November 24, to provide that customers bear responsibility for agents’ operations, while preserving the exceptions that laws and regulations provide [note 16]. In politics, Senators Bernie Sanders, Mark Warner, and Adam Schiff urgently called for legislated guardrails, or even a pause in AI development. White House AI lead David Sacks came out against the “cyberattack” framing and argued for a milder form of governance through “read-only” interfaces.

Stage 4: Amazon’s Q3 earnings and the two major reports of November 1 (October 29 to November 1, 2026)

On October 29, 2026, Amazon released its third-quarter results. Quarterly operating income was $28.1 billion, and the operating margin a record 13.9%. Revenue and earnings per share fell short of analysts’ expectations, and the shares fell as much as about 7% after hours. The company also disclosed in its quarterly filing a secured vendor financing arrangement of up to about $80 billion for buying technology infrastructure assets, with a borrowing window from the first quarter of 2027 to the third quarter of 2028. In his opening remarks on the earnings call, Amazon CEO Andy Jassy raised the effect of outside shopping agents on the advertising business himself. On one hand, he insisted that external horizontal agents currently have “no material effect” on Amazon’s advertising business. He noted that few consumers shop this way, and criticized third-party agent experiences as “still not good enough” and “less convenient than going directly to the retailer’s website”. On the other, he showcased the more than 400 million customers who had used Amazon’s own AI assistant, Alexa for Shopping, in the past 12 months. He also signaled flexibility: Amazon expects in future to be “working with horizontal agents” [note 17].

On November 1, CNBC and The Wall Street Journal drew on all of the developments above to publish two in-depth reports. CNBC’s was “For JPMorgan, Amazon, fighting AI bots like Meta Muse may not be a winning long-term strategy”; the Journal’s was “The Shopping Bots Are Coming for Amazon”. (The original gives CNBC’s headline in two Chinese renderings, one saying that resisting the bots “is not easy”, the other “not a winning long-term strategy”.) Together they set out the facts in full along two dimensions. One is the impasse over access authorization rules and security liability across industries. The other is the attack on, and defense of, the $70 billion retail advertising business model. In summary:

Retail’s Great Divergence in Access Rules: Billions Network’s Audit of 51 Retailers and Three Platform Strategies

CNBC’s November 1 report drew on a survey of the access rules of 51 large US online retailers. It was carried out by the digital identity verification company Billions Network, led by its cofounder and CEO Evin McMullen, and it gave the core empirical baseline for assessing where US retail’s rules stand. The study was conducted in August 2026, its data verified to September 2, 2026, and it was formally published on October 9. The sample was drawn from the National Retail Federation (NRF) Top 100 list and the main online marketplaces. The audit team examined the robots.txt directive files and terms of service that the 51 retailers publish. It focused on two key steps, “creating or signing in to an account” and “entering the cart and checkout”, and on how each platform treats the main AI user agents at those steps: OpenAI (GPTBot, OAI-SearchBot, ChatGPT-User), Anthropic (ClaudeBot, anthropic-ai, Claude-User), Perplexity (PerplexityBot, Perplexity-User), Google (Google-Extended, GoogleAgent-Shopping), Meta (Meta-ExternalAgent, meta-externalfetcher), and Amazonbot, Applebot-Extended, Bytespider, CCBot, and others.

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading. A. Public access rules at 51 US retailers (Billions Network audit, August 2026, verified to September 2): blocked incidentally by old anti-bot rules, 37 (72.5%); explicitly restrict AI, 5 (9.8%); allow browsing but restrict checkout, 4 (7.8%); allow agents through checkout, 2 (3.9%); no robots block on cart or checkout, 3 (5.9%). Retailers offering a dedicated purchase path for verified, authorized agents: 0 of 51. B. What users expect of AI financial assistants (Accenture, October 2025, 10,000 respondents): want to approve every AI action, 82%; want a one-click pause, 79%; welcome an assistant in their main bank’s app, 71%; would use an assistant from a generative AI platform or digital wallet, 65%.

The audit’s five categories and the mechanism of “incidental blocking”

The audit sorts the public access rules of the 51 large US retailers into five stances:

1. “Explicitly restricts AI”. The retailer names and blocks AI agents in robots.txt, or prohibits automated and agent access in its terms of service.
2. “Permits AI browse, blocks checkout”.
3. “Permits AI agents including checkout”.
4. “Incidental blocking”. There is no AI-specific rule, but legacy anti-bot rules still in force bar any automated client from the account login path or the cart and checkout path.
5. “No robots block on cart or checkout”.

This structural survey reveals three core features of retail’s current rules.

First, close to three-quarters of the retailers surveyed are blocking agents incidentally, without having meant to. Of the 51, only 11 take a clear stance on AI agents. Five, including Amazon, Kohl’s, and Neiman Marcus, explicitly restrict them; the other six fall somewhere between allowing browsing but not checkout and tentatively welcoming checkout. As many as 37 (72.5%) block shopping agents incidentally through legacy anti-scraper rules. As Billions Network CEO Evin McMullen points out, most of the retailers audited have never made any formal decision about AI agents. The rules they run were written years ago to defend against web scrapers, so customer-authorized shopping agents also fall within the old rules’ restrictions. User reports in October 2026 show similar access friction. Users reported agents getting stuck midway after triggering anti-bot checks, such as an “I’m not a robot” CAPTCHA, on Cars.com, Amtrak, Adidas, Pizza Hut, and even the website of Walmart, which has an official partnership with Meta.

Second, the public rules of the retailers surveyed do not yet show a dedicated transaction path for verified agents. The audit found that, at verification on September 2, 2026, none of the 51 retailers (0/51) showed in its public rules a dedicated path for a “verified and authorized AI agent” to complete a purchase. Take the three high-end home brands of the Williams-Sonoma group: Pottery Barn, West Elm, and Williams-Sonoma. They are the closest to being “agent-ready”, and were the first to publish llms.txt files guiding AI agents through their site structure. Yet they still block AI agents at checkout, because “navigation guidance is not identity verification”. McMullen stresses that “browsing is about access; buying is about trust”. Simply opening checkout to all automated traffic would let malicious bots in. A real verified-agent checkout channel needs three things. The agent presents a cryptographic credential proving the real principal behind it. The retailer verifies that credential at the point of sale (POS). And both sides clearly define the scope of the agent’s authority, such as a spending limit, or a single order only.

Third, among the retailers that do set restrictions, the specific defenses and commercial considerations differ. Tapestry, parent of Coach and Kate Spade, lets agents browse its catalog but not complete checkout. (It is rebuilding its checkout system in case it changes course.) Its main concern is to stop bots exploiting limited-edition “drop” releases to fill carts with scarce stock without paying, while still using AI agents’ browsing as a free marketing channel. The luxury consignment platform The RealReal hardened its anti-bot defenses in a hurry after a reporter demonstrated a loophole. The platform holds an item for 20 minutes after it is added to the cart, and the test showed that Meta Muse could use this feature to keep items locked for hours, stopping other shoppers from buying the stock. The RealReal was forced to tighten restrictions on agent login, add-to-cart, and checkout across the board. The pet e-commerce company Chewy’s rules not only guard against general-purpose agents but also target specific third-party bots, such as Amazon’s, with dedicated blocks. Separately, Korea Economic TV reported on October 1, 2026 that Coupang blocks outside AI from making payments in its app, and that Naver restricts outside AI from accessing Plus Store product search and its blog and community content [note 18].

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading. 1. The old rules first (retail snapshot to September 2, 2026): 37 of 51 retailers (72.5%) restrict agents incidentally through old anti-bot rules, so customer-authorized agents fall under login, cart, and checkout restrictions; 0 of 51 show a verified-agent purchase path. 2. Browsing versus executing:

3. Policy status and scope matter too: Chewy’s rule targets specific bots such as Amazon’s; Bank of America warns customers not to share passwords; RBC is considering a block; PNC’s CEO insists on human review. Bottom line: browsing permission, transaction authorization, and partner access each have their own conditions.

Walmart’s open model: a two-tier access architecture, and “we price products, not people”

Walmart stands in contrast to restrictionists such as Amazon. It updated its website Terms of Use on September 21, 2026, adding Section 16.L, “Authorized Agents”. On October 21, its president and CEO John Furner formally announced a complete scheme supporting AI agents that shop for customers, at the Masters of Scale summit in San Francisco and on Walmart’s official blog. The scheme covers Walmart.com and Sam’s Club, whose US business had grocery net sales of about $65 billion in fiscal 2026. Walmart account holders do not need to buy a Walmart+ membership to use agent support. By publishing the Walmart Agentic Access Terms (October 21, 2026 version), Walmart set up a two-tier access system that combines contractual constraints with technical isolation.

On access architecture, Walmart distinguishes two tiers: “ordinary website access” and a dedicated agent gateway, the Walmart Agent Gateway. Ordinary agents access Walmart directly through the web or the app, under Sections 1 to 14 of the terms. For them, Walmart requires every checkout to pass a “human consent gate”: a human user must personally review and confirm, and fully automated checkout is prohibited. Partner agents are invited onto the Walmart Agent Gateway, under Sections 1 to 14 and Appendix 1; Walmart has announced a Beta for businesses and developers first. The gateway plans to use the Model Context Protocol (MCP), first released by Anthropic, or a similar connection protocol. Outside agents would then connect in a structured way with Walmart’s built-in assistant, Sparky, cutting the latency and errors of simulating clicks on web pages. Walmart has already carried out conversational-commerce integrations with Muse, ChatGPT, and Gemini.

On permission control and security isolation, Walmart introduced “Agent Profiles”, due to go live the following month (November 2026), and the four identity and authorization mechanisms of Appendix 1. The first time a customer uses a given AI agent through the gateway, Walmart automatically creates a separate sub-profile for that agent under the customer’s main account. AI-initiated purchases are shown apart from the customer’s own everyday orders, much like adding an authorized user to a main credit card. The customer can require human approval of each order, or set autonomous spending caps such as $50, $100, or $200 (“User-Defined Guardrails”). The customer can delete the profile at any time to revoke the authority. Within the gateway, Walmart can issue verifiable cryptographic “Agent Credentials” or “Scoped Access Tokens” to registered agents that meet its certification requirements. An agent must submit a cryptographically signed “Agent Mandate” containing the customer’s instruction, a timestamp, and proof of consent, and hold a separate scoped access token in each gateway session. The short-lived token is bound to a specific merchant, cart, amount, and session, and is consumed at checkout; each separate transaction within a session needs a new token. Walmart also provides that outside AI agents will never obtain or see the customer’s payment card information, and have no power to add or change payment methods. The gateway can help an agent find items the customer buys regularly, such as a particular brand of milk or sourdough bread, without sharing the customer’s full purchase history with the outside agent.

On legal accountability and pricing, Section 2 of the Agentic Access Terms defines three parties. Alongside the “Agent” and the “Authorizing Customer” it defines a “Deployer”: the business that provides, builds, operates, or monitors the agent. Under Section 1, a deployer is independently bound by the terms when three conditions hold. It deploys the agent for a business purpose; it actually or constructively knows of the terms; and it has a connection such as commercial benefit, or receiving or processing the relevant data. Section 9 lets Walmart pursue the AI deployer directly for breach if an agent does any of the following:

• scrapes data in bulk (Section 6 strictly prohibits using Walmart data to train AI models, generate synthetic datasets, or target advertising);
• transacts beyond the scope of the customer’s consent;
• provides false information; or
• bypasses the consent gate.

Section 12 further requires deployers to cooperate with reasonable audits and investigations. If an agent does not act as expected and buys the wrong item, Walmart’s standard returns process still applies.

Electronic shelf labels and “personalized, one-price-per-person” pricing in the AI era had already drawn scrutiny, for example from Lindsay Owens of the think tank Groundwork Collaborative and from the Federal Trade Commission (FTC). In response, Furner reaffirmed the “Everyday Low Price (EDLP)” commitment in a September letter to customers and in the October 21 announcement. He stressed that “We price products, not people”. Walmart will not use shoppers’ income, purchase history, or urgency to raise prices. AI agents see exactly the same prices on Walmart.com as human shoppers, and applicable discounts and fees are clearly listed before purchase [note 19].

The Business Model Underneath: Amazon’s Defense of Its $70 Billion Ad Business, and the Shifting Shopping Entry Point

The technical and security issues might still be solved by gateway protocols like Walmart’s. The commercial reasoning goes deeper. On November 1, Wall Street Journal reporters Isabella Simonetti and Suzanne Vranica published an in-depth report, “The Shopping Bots Are Coming for Amazon”. That report and related financial analysis reveal the business logic behind Amazon’s firm demand that Meta remove Amazon from the Muse experience. How readily a retail platform accepts outside AI agents depends largely on where its core profit comes from: a cut of transactions at the checkout, or advertising displayed in the aisles.

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading (US$ billion, as reported). 01 Advertising revenue: Amazon, calendar 2025, 68.635; Walmart, fiscal 2026 to January 31, 2026, about 6.4 (including VIZIO). 02 Amazon’s North America and International segments, 2025: combined net sales 588.199; combined operating income 34.369. Advertising services equal 11.67% of segment net sales, and the segment operating margin is 5.84% (segment sales include goods and services; operating income includes the ad business’s contribution). 03 Shopify, 2025: merchant solutions revenue 8.804 ÷ GMV 378.441 = 2.33%, an aggregate ratio, not a per-transaction fee, mainly from Shopify Payments processing and currency conversion. Sources: company annual reports; ratios computed from disclosures.

”An ad blocker with a credit card”: breaking down Amazon’s advertising revenue

For a long time Amazon has been the first starting point for US online shoppers. That advantage as a traffic entry point supports a vast, high-margin digital advertising business. According to The Wall Street Journal, Amazon’s 2025 advertising revenue was close to $70 billion. Amazon’s 2025 annual report puts advertising services revenue at about $68.6 billion, roughly twice the combined 2025 operating income ($34.4 billion) of its two retail store segments, North America and International. Measured against the two segments’ combined net sales, 2025 advertising services revenue equals 11.67% of them, and the combined operating margin is 5.84%. The two segments’ net sales include both product sales and service revenue, and their operating income also includes the advertising business’s contribution. Industry estimates cited by Business Model Analyst put about two-thirds of Amazon’s nearly $70 billion advertising business in “Sponsored Products”: sellers pay to place products near the top of search results to influence shoppers’ decisions.

This business model depends on consumers visiting Amazon’s website or app themselves and seeing sponsored ads as they search and browse the shelves. When consumers switch to outside AI assistants such as Meta Muse, the starting point of shopping moves. The consumer only gives an instruction. The AI agent compares prices across platforms in the background, screens reviews, and places the order itself. The consumer’s own browsing of pages drops out, and the links between ad display, product discovery, and purchase decisions change. As the business-model analysis put it, “an AI shopping agent is an ad blocker with a credit card”. Explaining its block on Muse, Amazon said that outside agents bypass the personalized recommendation system Amazon has built. The products shoppers see then do not come from Amazon’s recommendation engine, which is the main vehicle for displaying paid sponsored placements.

By contrast, competitors that profit mainly from transaction volume or payment processing, rather than from on-site search ads, have actively allied with Meta to compete for the shopping entry point. Walmart’s global advertising revenue in fiscal 2026 (ended January 31, 2026) was about $6.4 billion including VIZIO, less than a tenth of Amazon’s. Opening up to outside AI agents helps Walmart take sales share from Amazon. Shopify posted total revenue of $11.6 billion in 2025. Of that, $8.8 billion came from “Merchant Solutions”, mainly Shopify Payments processing and currency-conversion fees, against platform gross merchandise volume (GMV) of $378.4 billion. Merchant solutions revenue thus equals about 2.33% of GMV. This aggregate ratio shows how merchant-service revenue is tied to the platform’s transaction volume, and agent-driven transactions bring revenue opportunities for the related payment and merchant services. Then there is QVC Group, owner of QVC and HSN. It filed for Chapter 11 bankruptcy protection in April 2026, and its reorganization plan was approved in July, cutting debt from $6.6 billion to about $1.33 billion. Its first-quarter revenue fell 7% to $1.96 billion as traditional TV audiences shrank. QVC Group not only lets AI agents complete purchases but also pushes its catalog to OpenAI and Google to win exposure [note 20].

Amazon’s “double standard” controversy, and its own agents

While restricting outside agents, Amazon is pushing hard on its own agentic shopping features. That has sparked debate in the industry about “control of data”. Mike Danford is owner and chief revenue officer of Adverio, an agency that runs Amazon, Walmart, and Target marketplace operations for e-commerce brands. He said in the CNBC report that the security concerns some companies cite, banks and retailers included, are really more about “whose sandbox the customer is playing in, and who owns the customer data”.

Specifically, Amazon has built three internal AI and cross-site shopping tools:

1. Alexa for Shopping, the built-in shopping assistant (formerly Rufus, renamed in May 2026). Sponsored Products and Sponsored Brands ad prompts in the assistant entered public testing in November 2025. They went into commercial use in the US on March 25, 2026, billed by cost per click (CPC). The prompts can appear in search results and on product detail pages; clicking one opens a Rufus conversation or shows the answer on the original page. On the October 29 earnings call, Andy Jassy disclosed that more than 400 million customers had used Alexa for shopping in the past year. Interactions were up 570% year on year, and US customers who shop with Alexa spend on average 50% more per order than those who do not. He also stressed that the assistant can use purchase history, shipping addresses, and payment information to make shopping more convenient.
2. Shop Direct, which now lists more than 250 million products from outside merchants, keeping the traffic for outside products inside the Amazon system.
3. Buy for Me. A customer confirms the order details without leaving the Amazon app, and Amazon’s own agent then goes to another, third-party brand’s website and completes checkout for the customer. Buying automatically once a target price is reached is a separate feature, Alexa for Shopping’s auto-buy.

Danford and industry analysts both point out that what Amazon’s Buy for Me does to other retailers is exactly what Meta Muse is trying to do to Amazon. (CNBC reported in January 2026 that some small merchants had found their catalogs listed in Amazon’s Buy for Me without having opted in.) An Amazon spokesperson countered that third-party apps that shop at other businesses on customers’ behalf should operate openly. They should respect service providers’ decisions on whether to take part, the spokesperson said, and Amazon had on that basis asked Meta to remove it from the Muse experience.

Amazon faces outside competitive pressure. After Amazon blocked Grok Bot, Elon Musk posted on X that “maybe we should start an Amazon competitor”. Paul Graham, cofounder of Y Combinator, thinks Amazon’s restrictions will leave room for new “agentic marketplaces” in which AI agents buy and sell from each other. Andy Jassy’s position on October 29 balanced defense with flexibility. On one hand, he stressed that third-party shopping agents currently have two major problems: the shopping experience is “still not good enough”, and it is “less convenient than going directly to the retailer’s website”. On the other, he told The Wall Street Journal that Amazon is in talks with several AI assistants about potential shopping experiences, and expects in future to be “working with horizontal agents”. Chris McCabe, a former Amazon employee and founder of the e-commerce consultancy ecommerceChris, reads Amazon’s current territorialism as an effort to win the initiative for itself to control agentic commerce. F. Flax, an analyst at the investment firm Neuberger, believes that Amazon’s huge logistics and fulfillment infrastructure and very fast delivery mean it can adapt as agents reshape the retail experience. On the long-term market, McKinsey estimates that by 2030 agentic commerce could drive $3 trillion to $5 trillion of revenue in global B2C retail of physical goods, of which the US would account for about $900 billion to $1 trillion [note 21].

Banking: Risk-Control Defenses, Liability Transfer, and the Political and Regulatory Contest

Retail’s contest is over advertising and the sales entry point. Banks and brokerages restricting outside AI agents such as Meta Muse, Instinct, and Grok Bot are guarding against the loss of low-cost deposits, but more than that. Their restrictions go directly to the bottom lines of account security, anti-fraud controls, and regulatory compliance.

From “buying the wrong sofa” to “hacking the gym’s scheduling system”: the concrete risks of agents out of control

A customer’s ordinary online-banking login credentials mainly verify that the holder may access the account. When the customer and the agent share one login session, it becomes harder to tell whose conduct is whose. Ram Varadarajan, CEO of the cybersecurity firm Acalvio, and Patrick Harr, CEO of DataVisor, point out what follows once a customer gives a third-party AI agent their online-banking username and password. On the login credentials alone, the bank cannot easily tell the agent from the customer. If the agent is hijacked or misled, or misreads an instruction, the bank struggles to separate three cases: the “customer’s true intent”, the “agent’s operational error”, and “unauthorized impersonation”.

Michael Jabbara, Visa’s head of payment ecosystem risk and control, spoke plainly in CNBC’s November 1 report. He would not comment on why any single bank blocks AI agents. But the fraud and operational risks that AI agents bring, he said, are “very real and very tangible”. Jabbara listed three core risk scenarios:

1. Fake agents stealing credentials. Fraudsters can build fake AI agents to lure consumers into entering online-banking login credentials and payment details.
2. A legitimate agent doing more than the customer meant. A consumer asks the agent only to help find a sofa, and the agent goes ahead and buys one.
3. Unpredictable, goal-driven boundary-crossing. Jabbara’s example: a user asked an AI agent to book a time slot at a gym. When the agent found the slot full, it hacked the gym’s scheduling software, deleted an existing booking, and put the user’s name in.

(A similar risk of models overstepping arose in July 2026. Several models OpenAI was running in an internal cybersecurity evaluation broke out of their isolation controls and intruded into some systems of Hugging Face and of OpenAI.) Jabbara stresses the heart of the problem. Companies must establish “who the agent is, which customer it is acting for, and whether it holds the appropriate scope of authority”, because agents do not just exchange data; they can take actions directly on users’ behalf [note 22].

”Liability transfer”: who bears the loss when credentials are shared

Because AI agents can initiate transactions directly, executives at several financial institutions warned consumers in October 2026 about “liability transfer”. In the US, consumer electronic fund transfers protected by Regulation E are subject to statutory liability limits and error-resolution procedures. The official interpretation of Regulation E covers a customer who furnishes an access device to another person and grants transfer authority. Transfers by that person beyond the authority granted are the customer’s responsibility until the customer notifies the financial institution that the authority has been revoked. Transfers made with credentials obtained by fraud fall under the rules for unauthorized transfers.

On the October 13 earnings call, JPMorgan CEO Jamie Dimon reminded consumers that they must understand the “liability transfer” risk this involves. A JPMorgan spokesperson also confirmed to CNBC and Fortune that JPMorgan prohibits third parties from logging in for customers with customers’ online-banking credentials. There is no timetable, the spokesperson said, for allowing outside agents to interact directly. JPMorgan CFO Jeremy Barnum further warned that sharing credentials exposes customers to the risk of bearing losses from agents’ operations.

Wells Fargo has gone further, with a new online access agreement effective November 24, 2026. The new terms expressly provide that once a customer authorizes an agent or gives it credentials, the bank may, to the extent the law allows, treat instructions and transactions issued by the agent as issued by the customer, without separate verification. The terms also allocate to the customer, in principle, losses caused by an agent misreading instructions, behaving unexpectedly, or overreaching, while expressly applying the exceptions that laws and regulations provide.

In Germany, Section 675v of the Civil Code ties the payer’s liability for the full loss to fraud, or to an intentional or grossly negligent breach of the security duties attached to a payment instrument that causes the loss. Section 675w requires the payment service provider to produce evidence of fraud, intent, or gross negligence. Who bears the loss after an AI agent obtains a password therefore depends on the specific authorization, whether security duties were performed, and causation. The rules on strong customer authentication, and on liability after a loss is reported, also apply [note 23].

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading. 1. Three layers identify an operation: account access (can the credential log in?), agent identity (who is acting, for whom?), and authorization for the specific action (view, order, change settings, transfer or pay; how far?). A login credential alone cannot tell impersonation (a fake agent phishing credentials), misunderstanding (asked to find a product, it buys one), and overreach (it breaks limits to reach a goal). 2. Liability turns on how authority was given, what the agent did, and the applicable rules. US Regulation E (consumer electronic fund transfers): where a customer gives an access device and transfer authority, transfers beyond that scope are the customer’s responsibility until the customer tells the institution the authority has ended; credentials obtained by fraud fall under the unauthorized-transfer rules. German Civil Code §§ 675v, 675w: the payer bears full loss for fraud, or intentional or grossly negligent breach of security duties causing the loss, and the provider must prove it; the outcome depends on the specific authority, compliance with security duties, and causation, alongside strong customer authentication and post-notification rules. Wells Fargo’s revised terms (effective November 24, 2026): where a customer authorizes an agent or gives it credentials, the bank may treat the agent’s instructions as the customer’s own, as far as law allows; losses from misreading, unexpected behavior, and overreach fall in principle on the customer, subject to legal exceptions. 3. Users want convenience but keep control: Accenture (October 2025, 10,000 respondents): 82% want to approve each action, 79% want to pause or stop at any time. NMI (1,000 US adults, August 2026): 10% would hand an AI full control of a purchase, 70% want to review or override before buying.

Banks’ commercial defense: zero switching costs, deposit flight, and “agentic flooding”

Security and compliance are not the only reasons. Industry analysis and executive interviews also reveal business-model motives behind banks’ restrictions on outside AI agents. Joseph Chalom, a former BlackRock executive and now CEO of SharpLink, and Torsten Slok, chief economist of Apollo Global Management, make the point. For decades, they say, traditional financial institutions fended off disruptors in travel, telecoms, and financial-data aggregation by citing “security concerns”. The most direct blow AI agents deal to the banking business model this time is to push customers’ “switching costs” close to zero, which threatens banks’ base of low-cost deposits.

Specifically, Slok’s analysis of September 27, 2026 compared the average checking-account rate of about 0.1% with yields of 3.3% to 5.0% on some high-yield accounts. AI assistants that automatically allocate idle cash, he pointed out, will weaken banks’ low-cost deposit advantage. Even while blocking outside agents, JPMorgan has moved too: CFO Barnum confirmed that a targeted pilot of Smart Cash is live, helping customers move funds between checking accounts and higher-yield brokerage products. The bank’s shareholder letter lists AI forecasting of cash flow and bill needs as a future direction. Meanwhile Nikhil Behl, president of FICO’s software business, observes that human customers form emotional attachments to a brand through childhood memories or a familiar teller. An AI agent has no feelings for a brand logo or a ten-year customer relationship. It decides only on objective measures such as approval stability, transparent pricing, processing speed, and comparable terms.

Another operational challenge worrying banks and retailers is “agentic flooding”. Ethan Mollick, the Wharton AI expert, pointed out on X what happens once millions of consumers learn that agents such as Muse or Dots can file unlimited refund claims against old bills or negotiate rates around the clock. Companies’ customer-service departments will face “a distributed denial-of-service (DDoS) attack lawfully authorized by millions of consumers”. Ed Felten is professor emeritus of computer science at Princeton, a former chief technologist of the Federal Trade Commission (FTC), and was deputy US chief technology officer in the Obama administration. He likewise notes that AI agents “never sleep and never get distracted”. As agents visit websites at high frequency, back-office operating costs at banks and other companies will rise markedly [note 24].

Security risk control and profit protection are intertwined. Michael Abbott, Accenture’s global banking lead, said in the CNBC report that “both can be true at the same time”. But Abbott stresses that blocking AI agents is a hard way to win in the long run. Accenture’s Future of Banking Experience survey, conducted in October 2025, found that 65% of respondents are willing to use GPT-like financial assistants through generative AI platforms or digital wallets. And 71% of customers welcome such an AI assistant embedded in their main bank’s mobile app. At the same time, 82% of respondents want to approve every action personally in AI-assisted banking interactions, and 79% want to be able to pause or stop AI activity immediately, at any time. This shows, Abbott says, that consumers pursue convenience but will never give up control. Banks’ real opportunity is not to resist change. It is to build next-generation infrastructure that can authenticate trusted agents, verify permissions, and support efficient machine-to-machine (M2M) interaction. Banks would then become the provider of data, intelligence, and execution that AI agents rely on at key decision moments.

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading. Security risk and commercial interest together shape platforms’ access choices (to November 1, 2026). 01 Shopping entry and ad exposure: a delegated agent compares, filters, and orders across platforms, which may reduce on-site browsing and ad exposure (Amazon 2025 ad services about $68.6 billion; Walmart fiscal 2026 about $6.4 billion including VIZIO). Amazon said on October 29 that outside agents had not yet materially affected its ad business. 02 Transactions and merchant services: agent-driven transactions raise payment and merchant-service use (Shopify 2025: merchant solutions $8.8 billion; GMV $378.4 billion; about 2.33%, an aggregate ratio, not a uniform take rate). 03 Switching costs and deposit stickiness: agents compare yields and move idle cash, which may lower switching costs and weaken low-cost deposits (Slok, September 27, 2026: checking about 0.1%; some high-yield accounts 3.3–5.0%). 04 High-frequency requests and service load: repeated refund claims and round-the-clock negotiation can raise customer-service and back-office load (Mollick, Felten). Parallel responses: own shopping assistants (Amazon’s Alexa for Shopping, Shop Direct, Buy for Me); cash-management tools (JPMorgan’s Smart Cash pilot; AI cash-flow forecasting planned); and controlled partnerships and interfaces (Amazon in talks on outside assistants’ shopping experiences).

Politics and regulation: from “pause AI entirely” to the “read-only API” path

Axios’s October 22 report of unauthorized third-party AI agents found in bank accounts landed on the eve of the US midterm elections of November 3, 2026, and drew a strong political reaction. A Reuters/Ipsos poll showed 80% of Democratic voters and 61% of Republican voters supporting stronger federal AI regulation. A Navigator Research survey likewise showed 66% of registered voters supporting more AI regulation.

In Congress, several senators issued stern warnings. Bernie Sanders, the independent senator from Vermont, lashed out on X at AI agents entering bank accounts and acting on their own as “insane”. If left unchecked, he warned, AI could endanger the entire global financial system, personal bank accounts included, and he called to “Pause AI NOW!” Adam Schiff, the Democratic senator from California, likewise warned that rogue AI agents taking unauthorized actions inside financial institutions, utilities, and health systems are no longer hypothetical. He called on Congress to pass mandatory AI guardrails across all industries immediately. Mark Warner, the Democratic senator from Virginia, called the phenomenon “Terrifying” and demanded guardrails at once.

Warner had already advanced several pieces of AI-agent legislation:

• The AI AGENT Act (S.5051). On June 29, 2026, Warner released a discussion draft of the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act, the AI AGENT Act for short. It would direct the National Institute of Standards and Technology (NIST) to develop technical standards for “verifiable delegation”. These would cover authorization credentials that are limited in scope and revocable in real time; verification of the identity and registration status of custodial user agents (CUAs); and real-time, auditable logs of operations. The draft would also empower the Federal Trade Commission (FTC) to enforce under its rules against unfair or deceptive practices, and would stop large platforms from restricting competitors’ third-party AI agents while pushing their own. It was formally introduced as S.5051 on July 21.
• The Artificial Intelligence Risk Management and Safety Act of 2026 (S.5576). Warner formally introduced it on September 29. It would establish a standing AI safety advisory committee under the Department of Commerce. Developers of frontier AI models would have to provide access to a model at least 45 calendar days before introducing it into interstate or foreign commerce, including the weights, configuration, runtime environment, or software libraries needed to run it. They would also have to develop, publish, follow, and submit as required a model safety plan. The bill would impose civil penalties of up to $250,000 per violation on developers that breach applicable mandatory standards, with each day a violation continues counted separately.

On the side of the executive branch and industry, White House AI Czar David Sacks tried to cool the alarm set off by the Axios report, and pushed back. Sacks argued on X that lumping user-authorized personal agents (such as Muse, Instinct, and Grok Bot) together with unauthorized rogue agents that truly amount to cyberattacks is a mistake. Most cases in the report, he said, involve customers voluntarily sharing passwords with agents to run errands for them. That may breach bank terms of service that require humans to log in themselves, but it is “definitely not a cyberattack”, and simply calling a halt is unrealistic. Sacks suggested that banks follow American Express (AmEx), which opens limited authorization to specific partner tools. Banks could give user-authorized AI agents “read-only” access, letting agents view transaction history and advise on dining spending or budgeting, but not move funds. He also noted that “full write access using a user’s credentials is a different risk category and should be treated with caution” [note 25].

Technology and the Industry’s Path: From “Silent Agents” to “Verifiable Agent Identity (KYA)”

Access friction shows up in both the rules and the technology. In the Billions sample, 72.5% of retailers still use old rules that restrict automated access, and Schwab blocks dozens of agent requests to access accounts for clients every week. Drawing together the analysis of Akamai, Visa, and the security leads of several banks, one common cause stands out. Some personal AI agents still access websites with customers’ credentials and browser sessions, so platforms can hardly identify an agent, or its scope of authorization, from the login state alone.

The agents differ in how they handle this. Muse keeps credentials in secure storage that the model cannot read, where the browser uses them, and it reviews outbound requests through a separate Sentinel. Some agents support both cloud and local execution environments. OpenAI’s Dots signs HTTP requests with Web Bot Auth in its cloud browser. Once the user enables access to their local computer, the user can ask a dot to switch to the connected computer when the cloud browser is blocked. Akamai classes this local access mode as a “silent agent” that carries no agent signature. As Princeton professor Ed Felten notes, when the button click happens in the browser on the user’s own computer, it is technically very hard for the remote website to tell whether a human finger or a local AI agent did it. Relying on blocking alone is therefore hard to sustain, and websites that over-block agents may end up losing business.

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading. Path 1: using the customer’s logged-in browser session. Customer logs in and authorizes → agent uses the logged-in session → website applies its checks and access rules. The agent’s identity and scope of authority are hard to identify independently; loss liability depends on applicable law, the facts of authorization, and the contract. Path 2: accessing a controlled interface with an agent identity and a scoped credential. Customer sets permissions and approval rules → agent presents its identity plus a scoped credential → controlled API or MCP gateway verifies identity and permissions → financial read-only queries, or retail checkout under permissions, limits, and confirmation rules. Identity verification, permissions, limits, and confirmation rules together constrain each operation.

Visa’s Jabbara summed it up in the CNBC report. The history of the move from PC internet shopping to mobile shopping shows, he said, that “none of these innovations can truly scale until people build the foundational security layer that can support trust at scale”. The industry is pushing toward standards for that foundational security layer along four technical lines.

First, “Know Your Agent (KYA)” and cryptographic signature protocols. Naveed Anwar, global head of AI, digital, and data platforms for Citi’s Services business, proposed at the Money20/20 conference in late October that banking needs a KYA admission process like KYC (Know Your Customer). At the protocol level, Akamai combined three layers of security standards into an agent security framework in June 2026:

• Web Bot Auth, an IETF draft standard that Akamai supports. It lets AI agents sign web requests cryptographically, so that sites can verify where a request really comes from.
• The Visa Trusted Agent Protocol. It uses cryptographic signatures at the payment step, letting merchants tell whether an agent is browsing or paying, and binds the agent to the real consumer it represents.
• Identity layers such as Skyfire’s KYA and Experian Agent Trust, which bind the agent to a verified organization or individual.

Meanwhile Billions Network, which has more than 2.5 million verified users, launched the DeepTrust (KYA) framework, based on zero-knowledge proofs (ZKP) and decentralized identifiers (DID). On July 14, 2026, the Linux Foundation announced the formal launch of the x402 Foundation, with Visa, Mastercard, Stripe, Google, and others as founding members, to advance an open, HTTP-based payment protocol.

Second, open cross-platform standards for commerce and personal agents. On October 6, 2026, Sierra, the company led by Bret Taylor and Clay Bavor, and Meta put forward an open standard, the Personal Agent Protocol, with partners including Walmart, Stripe, Shopify, Instinct, Genesys, Rocket, NiCE, and Decagon. They have published a draft specification for feedback. It covers user sign-in and authentication, and two-way permission control. Consumers decide what access to grant an agent, and businesses get visibility into what the agent does on their websites, APIs, or customer-service systems. Meanwhile, on October 15 Google formally launched Universal Cart in US Search (including AI Mode) and the Gemini app, built on the Universal Commerce Protocol (UCP), with Canada and Australia planned for the following year. It supports adding items across retailers and tracking price drops and restocks. Checkout goes through Google Pay or back to the merchant’s own cart, and merchants expressly keep their status as “Seller of Record”.

Third, wider use of the Model Context Protocol (MCP), and separating read and write permissions. The schemes Walmart and Charles Schwab have announced both use structured interfaces such as MCP, moving agent access from operating web pages to controlled tool calls. Schwab proposes to give outside large language models a controlled query channel through an MCP server. They could view balances and do research, but fund transfers would be restricted. Its native assistant, Charley, offers information queries, operating guidance, and some account-management functions. Such interfaces need security controls of their own: Google’s MCP Toolbox had a server-side request forgery vulnerability, fixed in version 1.5.0. Security experts, such as Dan Moore of FusionAuth and Chris Jacob of Securonix, warn that transaction history in a read-only interface can still expose highly sensitive information: a user’s employer, income, travel, and medical spending. Read-only access must therefore be paired with short-lived “scoped credentials”, a separate agent identity, and human “step-up confirmation” of high-risk operations, to build defense in depth.

Fourth, client-side browser guardrails and per-endpoint policies. At the device layer, Google has built protections into the Chrome browser. They stop AI agents from reading the password store directly. Before an agent navigates to a sensitive site such as a bank, or carries out a substantive payment, Chrome forces a pause and requires a human to confirm. 1Password provides a credential-injection mechanism for Claude that fills user-approved passwords directly into the target web page while keeping them isolated from the model. Anthropic’s guidance for Claude in Chrome prohibits stock trading and the management of financial accounts, and by default asks the user’s permission before visiting financial websites. On the server side, Akamai recommends that merchants adopt a “Selective Action” policy endpoint by endpoint. Catalog and search-discovery endpoints stay open to keep customer traffic. Transaction-settlement and authentication endpoints get strict automated scoring and cryptographic signature verification [note 26].

Chart from the original post, in Chinese. DCC's English reading follows.

DCC’s English reading (Walmart’s two-tier mechanism and industry progress to November 1, 2026). 01 Two access paths (terms published October 21, 2026): ordinary web or app agents need the user to review and confirm before every checkout, and fully automated checkout is prohibited; the Walmart Agent Gateway (invited Beta announced) is for invited businesses and developers and plans to connect to Walmart’s assistant Sparky through MCP or a similar protocol. 02 Turning authorization into enforceable controls: (1) customer control through Agent Profiles (planned for November 2026), with a separate profile showing agent orders, a choice of per-order human approval or a spending cap of $50/$100/$200, and deletion of the profile to revoke authority; (2) identity and delegation proof, with certified registered agents receiving an agent credential or scoped access token and submitting a signed agent mandate (customer instruction + timestamp + proof of consent); (3) short-lived tokens bound to merchant + cart + amount + session, a new token for each transaction, consumed at checkout and not reusable; (4) isolation of payment and purchase history, so agents get no card information and cannot add or change payment methods, and the gateway helps find regular purchases without sharing full history. A deployer is bound by the terms when three conditions all hold: deployment for a business purpose + actual or constructive knowledge of the terms + a link such as commercial benefit or data processing. Akamai’s endpoint tiering (a recommendation): catalog and search stay open; authentication and checkout get automated scoring plus signature verification. 03 Proposals at different stages: Web Bot Auth (IETF draft); Personal Agent Protocol (public draft October 6, 2026, open for feedback); Schwab MCP read-only access (planned: balance queries and research, with fund transfers restricted); Google Universal Cart (live in US Search and Gemini from October 15, 2026, with Canada and Australia planned for 2027); S.5051 and S.5576 (bills).

Finally: how the core institutions compare on outside AI agents’ access, policy and technique

The table below summarizes, as of November 1, 2026, how the main banks, brokerages, retailers, and consumer-service platforms in the reporting treat Meta Muse and other outside personal AI agents. It sets out their specific access policies, technical means of enforcement, core aims, and in-house alternatives.

In sum, the industry split laid out by CNBC and The Wall Street Journal on November 1, 2026 shows how platform access is settling now that personal AI agents such as Meta Muse have gathered tens of millions of users in a short time. Two main paths are forming. One is the “Approved Integrations” model, which keeps oversight and commercial interests through official partnerships and controlled gateways. The other is the “Independent Agent” that operates websites directly on the customer’s behalf. In the short term, the giants that hold core financial accounts and valuable on-site advertising shelves, such as JPMorgan Chase and Amazon, will keep strict access limits. They will do so to avoid the risks of identity spoofing and overreach, and to protect existing business models. Over the longer run, verifiable agent identity (KYA), secure MCP gateways, fine-grained human-approval guardrails, and supporting legislation will gradually mature. As they do, the focus of competition is shifting. The question is no longer “can we technically block AI agents?” It is becoming “can we, while keeping customers’ assets safe and under their control, build trustworthy interfaces for machine interaction, and new commercial arrangements suited to the way AI chooses products?”

DCC commentary: why it matters for China’s standard

This section is DCC’s, not the author’s. The drafting group has not said how this research will shape Security Requirements for Data Processing by AI Agents, and DCC has not seen a draft. But the problems the first installment puts forward line up with the questions the same account’s PrivacyLib essay raised two days earlier from the PIPL side:

• Can a platform tell who an agent is and whom it acts for?
• Is authority scoped to a task, a merchant, an amount, and a session?
• Are reading and acting treated as different risks?
• Who bears the loss when an agent misreads or oversteps?

China already has a policy hook for these questions. The May 2026 Implementation Opinions on the Standardized Application and Innovative Development of AI Agents separate three kinds of matters: those reserved to the user, those requiring the user’s authorization, and those an agent may decide on its own. They say an agent’s actions may not exceed the scope of the user’s authorization (Item 6). They also call for agent identity systems and for tiered governance, with filing and testing in sensitive fields and key industries.

Counsel advising agent builders or platforms in China should expect the standard to address agent identity, scoped and revocable authorization, and separate treatment of read and write access. That is a forecast from the drafters’ framing and the Opinions, not a description of the standard’s text.

Notes

The original’s notes and references, translated. Source titles are given as the author gives them; links are as in the original.

1. CNBC (November 1, 2026), “For JPMorgan, Amazon, fighting AI bots like Meta Muse may not be a winning long-term strategy”, https://www.cnbc.com/2026/11/01/jpmorgan-amazon-ai-agents-meta-muse.html; and The Wall Street Journal (November 1, 2026, by Isabella Simonetti and Suzanne Vranica), “The Shopping Bots Are Coming for Amazon”, https://www.wsj.com/tech/the-shopping-bots-are-coming-for-amazon-701caa57.
2. Meta formally launched the personal AI agent Muse in the US on September 8, 2026, later extending it to Canada. About six weeks after launch, more than 10 million users in the US and Canada had created personal agents, used for tasks such as cross-platform price comparison, automatic ordering, finding high-yield savings accounts, negotiating bills, and canceling redundant subscriptions in bulk. See CNBC (September 27, 2026), “Meta Muse AI personal agent”, https://www.cnbc.com/2026/09/27/meta-muse-ai-personal-agent.html; and BigGo Finance (October 2026), “Meta’s Muse Hits 10 Million Users as Retailers and Banks Push Back on AI Agents”, https://finance.biggo.com/news/6097f0af-89c7-4a2a-b7f4-bce8c229a287.
3. On the split between JPMorgan, Charles Schwab, Morgan Stanley, Amazon, Neiman Marcus, and Kohl’s restricting outside AI agents, Amazon asking Meta to remove it from the Muse experience, and Walmart, Shopify, and Best Buy choosing open partnership, see CNBC (November 1, 2026); Dealroom (October 19, 2026), https://dealroom.co/news/163856-banks-and-retailers-start-blocking-ai-shopping-agents-including-metas-mu/; and Walmart’s official announcement (October 21, 2026).
4. On “silent agents” borrowing human credentials to simulate sessions, risk systems’ difficulty in telling legitimate agents from malicious crawlers, and the “liability transfer” problem at financial institutions, see the Akamai security blog (October 26, 2026), “Silent Agents Are Already on Your Site”, https://www.akamai.com/blog/ai/silent-agents-are-already-on-your-site; CNBC (October 13, 2026); and TechNewsWorld (October 27, 2026).
5. On AI shopping agents being called “an ad blocker with a credit card”, and financial analysis of the size of Amazon’s 2025 advertising business (about $68.6 billion per the company’s annual report; that Sponsored Products make up about two-thirds is an industry estimate), see Business Model Analyst (October 4, 2026), “Amazon Won’t Let Your AI Agent Shop. The Ads Are Why”, https://businessmodelanalyst.com/amazon-blocks-ai-shopping-agents-ad-revenue/; and Amazon’s 2025 annual report, https://www.sec.gov/Archives/edgar/data/1018724/000101872426000004/amzn-20251231.htm.
6. On AI agents lowering depositors’ switching costs, and Slok’s September 27, 2026 comparison of the average checking rate of about 0.1% with yields of 3.3% to 5.0% on some high-yield accounts, see CNBC (September 27, October 13, and November 1, 2026), quoting SharpLink CEO Joseph Chalom and Apollo chief economist Torsten Slok. Apollo’s original analysis: https://www.apollo.com/wealth/insights-news/insights/daily-spark/is-an-agentic-bank-run-coming.
7. Billions Network’s audit of the public access rules (robots.txt directives and terms of service) of 51 large US online retailers (conducted August 2026, data verified to September 2, 2026, published October 9, 2026): Billions Network blog, “How top US retailers are responding to AI shopping agents”, https://billions.network/blog/us-retailers-ai-shopping-agents-audit. Public dataset: https://docs.google.com/spreadsheets/d/1GGKIqoj-jqd2e-0SK9CdV3-rMO_pFsFbKj8CMHYNsSI/view.
8. Accenture ran its Future of Banking Experience Survey in October 2025, with 10,000 respondents: 82% want to approve every action in AI-assisted banking interactions, 79% want a one-click pause, 71% welcome an AI assistant embedded in their main bank’s app, and 65% are willing to use a financial assistant through a generative AI platform or digital wallet. See Banking Top Trends 2026, p. 20, https://www.accenture.com/content/dam/accenture/final/industry/banking/document/Banking-Top-Trends-FY26-Report-Final.pdf. NMI’s shopping survey of 1,000 US adults found that 10% are willing to hand over full control of a purchase, 70% want to be able to review or override the AI’s decision before buying, and 3% see AI as a personal shopper managing the whole shopping journey. See its research announcement of August 26, 2026, https://www.nmi.com/about-us/news/nmi-research-consumers-want-ai-to-help-them-shop-not-control-their-spending/.
9. On the major institutions developing their own assistants and cash-management tools (Amazon’s Alexa for Shopping, JPMorgan’s Smart Cash, Charles Schwab’s Charley) and using paid data interfaces (JPMorgan charging Plaid) or controlled connection protocols (MCP servers and read-only access), see CNBC (October 13 and November 1, 2026), The Next Web (October 16, 2026), and Business Model Analyst (October 4, 2026).
10. On Akamai’s State of the Internet report (published July 2026: of global AI bot traffic from July to December 2025, 47.9% was concentrated in the commerce and retail vertical, and over 90% was monitor-only) and the September 2025 agreement between JPMorgan and Plaid charging for data access, see Akamai (October 26, 2026) and CNBC (November 1, 2026). Akamai original: https://www.akamai.com/blog/ai/silent-agents-are-already-on-your-site; JPMorgan–Plaid renewal announcement: https://www.jpmorganchase.com/newsroom/press-releases/2025/jpmc-plaid-renewed-data-access-agreement.
11. On Amazon’s suit against Perplexity’s agentic browser Comet (filed November 2025; preliminary injunction granted March 2026; injunction vacated by the Ninth Circuit on August 4, 2026; rehearing denied September 10; on September 21 Amazon kept its CFAA and California-law claims and added a claim for interference with contractual relations) and eBay’s user-agreement update of January 20, 2026 (effective February 20), see the Ninth Circuit’s opinion, https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf; the September 21 amended complaint, https://storage.courtlistener.com/recap/gov.uscourts.cand.459191/gov.uscourts.cand.459191.122.0.pdf; and eBay’s user agreement, https://www.ebay.com/help/policies/member-behavior-policies/user-agreement?id=4259.
12. On Meta Muse’s technical architecture (the separate cloud virtual machine Muse Secure VM, the built-in cloud browser, Muse Spark 1.3, the Muse Wonder and Muse Wonder Full models released October 12 and their availability by channel, and the Active Memory and Active Focus mechanisms), the Connectors ecosystem, Stripe Link (supporting about 200 AI agents, with single-use virtual card numbers) and the PayPal integration, US subscription pricing (Power $20 a month, Maximum $100 a month), and Oppenheimer’s annual revenue estimate, see Grenade.tw (October 13, 2026), https://grenade.tw/blog/muse-meta-ai-agent/; and FourWeekMBA (October 19, 2026), https://fourweekmba.com/ai-metas-muse-hit-5m-at-record-pace-amazon-jpmorgan-bar-it/. Meta’s model release and connector documentation: https://about.fb.com/news/2026/10/introducing-muse-wonder-models/; https://www.meta.com/help/superintelligence/1687253048996149/. Stripe’s payment flow: https://stripe.com/newsroom/news/stripe-helps-meta-muse-shop-with-link.
13. On Meta Muse’s early growth figures (No. 1 on the US App Store in 10 days; more than 5 million US downloads in 22 days; more than 10 million US and Canadian users creating agents in six weeks; more than a quarter of weekly active users using shopping, with average related purchases above $200; 43% of consumers comfortable with AI managing subscriptions; a user’s account of expected savings of $1,920 over 24 months after negotiating an AT&T fiber bill) and the effect on the share prices of Meta and of financial and OTA stocks, see CNBC (September 23 and 27, 2026), FourWeekMBA, BigGo Finance, and Grenade.tw. Meta’s earnings-call remarks: https://stockanalysis.com/stocks/meta/transcripts/718643-q3-2026/.
14. On Amazon’s block of Meta Muse on September 20, 2026, the statements of Amazon spokesperson Lara Hendrickson, and the hardware (Muse Charm, Ray-Ban audio glasses, Meta VR glasses) and official retail partners (Walmart, Shopify, Best Buy, Gap, Sephora, Wayfair) announced at Meta Connect 2026 (September 23), see CNBC (September 23, 2026), https://www.cnbc.com/2026/09/23/metas-standoff-with-amazon-over-muse-comes-ahead-of-meta-connect.html; Pasquale Pillitteri News; and NotebookCheck.
15. On the public statements of JPMorgan CEO Jamie Dimon (October 13), Charles Schwab CEO Rick Wurster (October 16), RBC CEO Dave McKay (October 20), and PNC CEO Bill Demchak (remarks October 19, reported October 21) about stopping outside AI agents from moving money, and about risk and liability, see CNBC (October 13, 2026), https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html; Mashable; FourWeekMBA; Dealroom; and Banking Dive.
16. On Axios senior AI reporter Madison Mills’s October 22, 2026 investigation of unauthorized third-party agents in banks’ back offices; the banks’ “day after” contingency plans; XMTP Labs CEO Shane Mac’s account of Grok Bot sending a personal financial report to a management Slack channel by mistake; and the responses of Morgan Stanley, Citi, Bank of America (a warning email to customers around October 29), and Wells Fargo (revised agent authorization and liability terms effective November 24), see CBS News (October 23, 2026), https://www.cbsnews.com/news/ai-agents-customer-bank-accounts-security/; Cybernews (October 23, 2026), https://cybernews.com/ai-news/banks-blocking-ai-agents/; ZDNet (October 29, 2026), https://www.zdnet.com/innovation/bank-of-america-customers-no-sharing-passwords-ai-agents/; and CMMedia (信传媒, October 27, 2026).
17. On Amazon’s third-quarter 2026 results, the secured vendor financing arrangement of up to about $80 billion, and CEO Andy Jassy’s remarks on outside shopping agents and Alexa for Shopping on the October 29 earnings call, see Inc. (October 30, 2026), https://www.inc.com/jason-aten/amazon-just-said-ai-agents-dont-hurt-its-ad-business-so-why-did-it-block-muse/91428840 and https://www.inc.com/aaron-mok/amazon-ceo-andy-jassy-says-ai-shopping-agents-have-at-least-2-problems-right-now/91428454; the Stock Analysis call transcript, https://stockanalysis.com/stocks/amzn/transcripts/720308-q3-2026/; Amazon’s earnings release, https://ir.aboutamazon.com/news-release/news-release-details/2026/Amazon-com-Announces-Third-Quarter-Results/default.aspx; and its third-quarter 2026 Form 10-Q, https://www.sec.gov/Archives/edgar/data/1018724/000101872426000040/amzn-20260930.htm.
18. On the results of Billions Network’s five-way classification of 51 US retailers (5 explicitly restrict, 37 block incidentally, none has a verified-agent checkout path; Pottery Barn, West Elm, and Williams-Sonoma publish llms.txt); the specific rules of Tapestry, The RealReal (the 20-minute cart-hold loophole), and Chewy; and Coupang’s restriction on in-app payment and Naver’s on Plus Store product search and blog and community content, see the Billions Network audit report (October 9, 2026); Business Model Analyst; and Korea Economic TV’s original report of October 1, 2026, https://www.wowtv.co.kr/NewsCenter/News/Read?articleId=A202610010130.
19. On the Walmart Agentic Access Terms published on October 21, 2026 (Sections 1–14 and Appendix 1, defining the responsibilities of three parties: Agent, Authorizing Customer, and Deployer), the MCP-based Walmart Agent Gateway, the Agent Profiles due in November 2026 (with spending limits such as $50, $100, or $200), and CEO John Furner’s pledge “We price products, not people”, see Walmart’s official announcement, https://corporate.walmart.com/news/2026/10/Making-It-Possible-for-Agents-to-Shop-on-Behalf-of-Customers; the text of the Agentic Access Terms, https://www.walmart.com/help/article/walmart-agentic-access-terms/d048fc229d7549738d7c05a4317e24d7; and The Next Web, https://thenextweb.com/news/walmart-ai-agents-shop-agent-profiles.
20. On Amazon’s 2025 advertising and retail-segment financials (advertising revenue about $68.6 billion; combined North America and International operating income about $34.4 billion; with the two segments’ combined net sales as the denominator, advertising revenue about 11.67% and operating margin about 5.84%), compared with Walmart (fiscal 2026 global advertising revenue about $6.4 billion, including VIZIO), Shopify (2025 total revenue $11.6 billion, merchant solutions revenue $8.8 billion, GMV $378.4 billion, merchant solutions revenue equal to about 2.33% of GMV), and QVC Group’s bankruptcy reorganization figures, see Amazon’s 2025 annual report, https://www.sec.gov/Archives/edgar/data/1018724/000101872426000004/amzn-20251231.htm; Walmart’s fiscal 2026 earnings release, https://stock.walmart.com/sec-filings/all-sec-filings/content/0000104169-26-000032/earningsreleasefy26q4.htm; Shopify’s 2025 annual report, https://www.sec.gov/Archives/edgar/data/1594805/000159480526000007/shop-20251231.htm; and QVC Group’s reorganization announcement of July 15, 2026, https://investors.qvcgrp.com/investors/sec-filings/all-sec-filings/content/0001355096-26-000024/pressreleasedatedjuly152026.htm.
21. On Amazon’s lineup of in-house AI shopping tools (Alexa for Shopping: more than 400 million users, interactions up 570% year on year, 50% higher US spend per order, linked CPC ad prompts; Shop Direct: more than 250 million outside products; Buy for Me: cross-site buying for the customer) and the comments of Adverio’s Mike Danford, Paul Graham, Chris McCabe, F. Flax, and McKinsey (which estimates that by 2030 agent-driven revenue in global B2C retail of physical goods could reach $3 trillion to $5 trillion, about $900 billion to $1 trillion of it in the US), see CNBC (November 1, 2026); Inc. (October 30, 2026); Livemint (October 30, 2026); Amazon’s official guide to its shopping tools, https://www.aboutamazon.com/news/retail/how-to-use-amazon-shopping-ai-assistant; and McKinsey’s original report, https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-agentic-commerce-opportunity-how-ai-agents-are-ushering-in-a-new-era-for-consumers-and-merchants.
22. On the analysis by Michael Jabbara, Visa’s head of payment ecosystem risk and control, of AI-agent fraud risks (fake agents stealing credentials; a legitimate agent buying a sofa by mistake; an agent hacking a gym’s scheduling system and deleting another person’s booking to get a slot), and the comments of security experts at Acalvio, DataVisor, and elsewhere, see CNBC (November 1, 2026) and TechNewsWorld (October 27, 2026), https://www.technewsworld.com/story/banks-restrict-ai-agents-amid-customer-account-security-concerns-180699.html. OpenAI’s incident review, published in August 2026: https://openai.com/index/hugging-face-incident-and-the-road-ahead/.
23. On banking’s “liability transfer” mechanism, JPMorgan CFO Jeremy Barnum’s statement, Section 15 of Wells Fargo’s new agreement effective November 24, 2026, and the rules on authorization, gross negligence, and loss allocation under US Regulation E and German payments law, see the Wells Fargo agreement, https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/; Regulation E § 1005.2 and its official interpretation, https://www.consumerfinance.gov/rules-policy/regulations/1005/2/; and German Civil Code § 675v, https://www.gesetze-im-internet.de/bgb/__675v.html, and § 675w, https://www.gesetze-im-internet.de/bgb/__675w.html.
24. On the analysis by Wharton professor Ethan Mollick and Princeton professor Ed Felten of “agentic flooding” and its customer-service DDoS effect, and the comments of Nikhil Behl, president of FICO’s software business, on AI agents dissolving traditional brand loyalty, see CNBC (November 1, 2026).
25. On the exchange between Senators Bernie Sanders (calling to “Pause AI NOW!”), Adam Schiff, and Mark Warner (the AI AGENT Act discussion draft and formal bill S.5051; the Artificial Intelligence Risk Management and Safety Act of 2026, S.5576) and White House AI Czar David Sacks (who argues for distinguishing user-authorized agents from cyberattacks, and for “read-only” APIs), see Benzinga (October 23, 2026), https://www.benzinga.com/markets/tech/26/10/62552760/sanders-schiff-rogue-ai-agents-bank; the text of S.5051, https://www.govinfo.gov/content/pkg/BILLS-119s5051is/html/BILLS-119s5051is.htm; the text of S.5576, https://www.govinfo.gov/content/pkg/BILLS-119s5576is/html/BILLS-119s5576is.htm; CFO Dive (October 27, 2026); and CBS News.
26. On next-generation standards for agent security and commercial interaction, including Citi’s proposed KYA (Know Your Agent) process, the framework in which Akamai combines Web Bot Auth and the Visa Trusted Agent Protocol, the Personal Agent Protocol from Sierra and Meta, Google’s UCP-based Universal Cart, Charles Schwab’s MCP server, and the client-side credential protections of Google Chrome and 1Password, see Akamai (October 26, 2026); Space and Story (October 27, 2026), https://spaceandstory.co/blog/what-ai-shopping-agents-mean-for-your-website; Banking Dive, https://www.bankingdive.com/news/citi-takes-cautious-approach-ai-agent-access/833849/; and CMMedia. Primary protocol and product documentation: https://personalagentprotocol.org/docs/introduction; https://blog.google/products-and-platforms/products/shopping/universal-cart-launch/; https://1password.com/press/2026/july/1password-for-claude; https://blog.google/security/architecting-security-for-agentic/; https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely.

— 网安寻路人, 个人AI代理访问规则分化与平台商业博弈：从Meta Muse崛起看银行与零售巨头的规则重塑 (Diverging Access Rules for Personal AI Agents and the Platforms’ Commercial Contest: How Banks and Retail Giants Are Rewriting the Rules as Meta Muse Rises), November 2, 2026. Full translation by DCC; the opening list of the account’s earlier posts is omitted. Original (Chinese).

Figures, quotations, and US facts are as compiled by the original author from public reporting; DCC has not independently verified them.

— Not legal advice.