---
title: "Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard"
author: "DCC Editorial"
published: 2026-11-02T12:00:00.000Z
url: https://datacompliancechina.com/posts/personal-ai-agent-access-rules-meta-muse/
description: "A full translation. 网安寻路人 opens a series, written with the core drafting group of the national standard Security Requirements for Data Processing by AI Agents (智能体数据处理安全要求), now being drafted, which shares the standard's preliminary research. The first installment is a case study, not a Chinese rule. It follows how US banks and retailers responded after Meta launched its personal agent Muse on September 8, 2026 and passed 10 million users in about six weeks. Amazon, JPMorgan, Schwab, and Morgan Stanley blocked or restricted outside agents, while Walmart, Shopify, and Best Buy opened controlled gateways. The author traces two fault lines. The first is identity, overreach, and liability: agents logging in with customers' credentials leave platforms unable to tell the customer, a mistaken agent, and an impostor apart. The second is control of shopping entry points and profit pools, from Amazon's roughly $70 billion ad business to banks' low-cost deposits. The industry's answer is moving from 'silent agents' toward verifiable agent identity (KYA), scoped credentials, read-only interfaces, and human approval for high-risk acts. With the original's seven charts, its timeline, its ten-row comparison of institutional policies, and its 26 notes."
tags: ["ai-agents", "personal-agents", "meta-muse", "agent-identity", "know-your-agent", "agentic-commerce", "liability-transfer", "national-standard"]
laws_cited: ["ai-agent-standardization-innovation-opinion"]
domains: ["ai-governance", "finance"]
account: "wangan-xunluren"
original_title: "个人AI代理访问规则分化与平台商业博弈：从Meta Muse崛起看银行与零售巨头的规则重塑"
original_author: "网安寻路人"
original_publication: "网安寻路人 WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/krn7JgKObwJOE4EpX6Z3BQ"
source_language: "zh"
---
> **Source: Data Compliance China** — https://datacompliancechina.com/posts/personal-ai-agent-access-rules-meta-muse/ · China data law, translated and annotated for overseas counsel. Cite as: Data Compliance China, "Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard", https://datacompliancechina.com/posts/personal-ai-agent-access-rules-meta-muse/
> *Editor's Note — DCC.*
>
> **Why this is on DCC.** The subject is American: how US banks and
> retailers reacted to Meta's personal AI agent, Muse. But the post is the
> first in a series that the account's author is writing with the **core
> drafting group of the Chinese national standard *Security Requirements for
> Data Processing by AI Agents*** (智能体数据处理安全要求), sharing the
> standard's preliminary research. Its choice of problems (agent identity,
> scope of authorization, credential sharing, liability for agent actions)
> is a signal of what the drafters are weighing. DCC has not seen a draft of
> the standard. DCC's own reading follows the author's conclusion, under
> its own heading.
>
> **What this is.** A full translation. One part of the original is left
> out: its opening list of the account's 14 earlier posts on AI agents. The
> last of those is the PrivacyLib essay, which DCC has published as
> [Keeping an AI Agent Inside Its Personal-Information Boundaries](/posts/agent-pi-boundaries-meta-privacylib/).
> The seven charts are reproduced from the original, in Chinese, each
> followed by DCC's English reading. The original's 26 notes are translated
> at the end with their source links, and are cited inline as [note N]. The
> author writes in Chinese about English-language sources. Where the author
> gives a phrase in English, DCC keeps it. Other quotations are DCC's
> rendering of the author's Chinese, not the speakers' original words. US
> legal instruments and product names are given in their English form.
> Long bill titles the author gives only in Chinese are DCC's back-translations.
>
> **Sourcing.** The facts, figures, and quotations are as the author
> compiled them from press reporting, company filings, court papers, and
> industry research. DCC has not independently verified them. Companion
> reading: DCC's brief on
> [TC260's practice guide on AI-agent deployment](/posts/tc260-ai-agent-deployment-security-guidelines/).
In the course of drafting the national standard *Security Requirements for
Data Processing by AI Agents*, this account has received many valuable
comments and suggestions from all quarters. To communicate with you better
and seek your advice, the account's author and the standard's core drafting
group have decided to begin a series of articles sharing the standard's
preliminary research and basic logic, the better to learn from you all.
This is the first.
On November 1, 2026, the US business news channel CNBC and *The Wall Street
Journal* (WSJ) published in-depth investigative reports on the same day.
They revealed a fight among the giants of US banking and retail over
blocking access by "personal AI agents" and defending their business models
[note 1]. The immediate trigger of this industry contest was Muse, an
autonomous AI personal assistant that Meta Platforms launched on September
8, 2026. Meta disclosed on its October 21 earnings call that, about six
weeks after launch, more than 10 million users in the US and Canada had
created personal agents. Consumers used it widely to compare prices across
platforms on the web and to place orders automatically. They also gave it
access to bank accounts and credit-card statements to find high-yield
savings accounts, negotiate bill rates, and cancel redundant subscriptions
in bulk [note 2]. Faced with a fast influx of automated agent traffic,
financial and retail companies, led by JPMorgan Chase, Charles Schwab,
Morgan Stanley, Amazon, Neiman Marcus, and Kohl's, put up defenses. They
restricted or entirely blocked outside AI agents from directly accessing
customer accounts and checkout channels, and Amazon went further, expressly
asking Meta to remove it from the Muse shopping experience [note 3]. Another
camp, led by Walmart, Shopify, and Best Buy, chose to open up, signing
partnership agreements and building dedicated technical gateways to meet
the demand of agentic commerce [note 3].
Drawing together the court records, technical audits, regulatory
developments, and executive statements disclosed by the parties, this
technical friction involves two sets of problems at once. The first fault
line is missing identity verification, uncontrolled overreach, and
liability transfer. Some personal AI agents work in a "silent agent" mode:
they use the customer's authorized login session and simulate human clicks
in a cloud browser. Banks' and merchants' risk-control systems find it hard
to tell a legitimate customer agent from a malicious scraping crawler. They
also find it hard to stop the overreaching operations an agent launches
because of model hallucination or excessive autonomy. Financial
institutions are left with hard problems of compliance and of deciding who
pays [note 4]. The second fault line is the commercial defense of control
over traffic entry points and core profit pools. On the retail side,
industry analysis likens an AI shopping agent to "an ad blocker with a
credit card". It skips the human browsing of web pages and chooses products
from the user's instructions and whatever price, review, and other
information it can obtain. That is a potential threat to Amazon's
high-margin advertising business, close to $70 billion in 2025 (about $68.6
billion as disclosed in the company's annual report). The business depends
heavily on consumers browsing pages and clicking "Sponsored Products"
placed at the top of search results [note 5]. On the banking side, Apollo's
chief economist Torsten Slok compared the average checking-account rate of
about 0.1% in September 2026 with yields of 3.3% to 5.0% on some high-yield
accounts. His analysis looks at the potential effect of AI agents lowering
depositors' switching costs and pushing idle funds to move [note 6].
Current access rules, user choices, and corporate positioning show three
features. First, a survey of 51 large US retailers by the identity
verification company Billions Network (conducted in August 2026, with data
verified to September 2, 2026) classified the access rules each company
declares in its public robots.txt directives and terms of service
[note 7]. Second, user growth and authorization for autonomous transactions are
moving at different speeds. About six weeks after launch, more than 10
million US and Canadian users had created personal agents on Meta Muse.
Accenture's banking-experience survey shows that 82% of respondents want to
approve every AI action personally. NMI's shopping survey of 1,000 US adults
shows that 10% are willing to give an AI full control of a purchase, and
70% want to be able to review or override the AI's decision before buying.
Amazon's executives said on that quarter's earnings call that outside
agents have not yet had a material effect on its advertising business
[note 8]. Finally, while restricting outside agents' access, the major
companies are developing their own assistants and cash-management tools
(such as Amazon's Alexa for Shopping, JPMorgan's Smart Cash, and Charles
Schwab's Charley). They are also rebuilding access rules through paid data
interfaces or controlled connection protocols [note 9].
## The Course of Events: A Timeline from the Early Court Battles to Meta Muse
The dense restrictions that banks and retailers placed on outside AI agents
in autumn 2026 were not an isolated, sudden event. They are the result of a
contest over "automated agent access rights" that has evolved since the
second half of 2025 through four stages: litigation, a breakout product,
back-office risk alerts in banking, and a political and regulatory contest.
### Stage 1: Opening skirmishes and the court rulings (second half of 2025 to August 2026)
As early as the second half of 2025, AI-driven automated traffic in
e-commerce had already reached a meaningful scale. Akamai, the
cybersecurity and CDN provider, published its *State of the Internet*
report in July 2026. Of all AI bot traffic monitored on Akamai's global
network from July to December 2025, nearly half (47.9%) was concentrated in
the commerce and retail vertical. Defenses at the time were mainly
monitoring: over 90% of AI bot activity fell into the "monitor-only"
category, and about three-quarters of the remaining traffic was allowed
through without restriction [note 10]. Meanwhile banking's defense through
data commercialization had already begun. In September 2025, JPMorgan
renewed a customer data-access agreement with the financial data aggregator
Plaid that includes a pricing structure. (Plaid said the agreement does not
affect existing customer pricing agreements and that Plaid does not charge
consumers directly, though downstream apps that use Plaid may set their own
subscription prices.) It established a paid mechanism for outside apps to
reach banks' underlying data [note 10].
What broke the calm in e-commerce was Comet, an agentic browser launched by
the AI startup Perplexity, which can search for products and place orders
on Amazon's website for the user automatically. In November 2025, Amazon
formally sued Perplexity. It alleged that Perplexity concealed its AI
agent's identity and scraped Amazon's website without authorization, in
violation of the federal Computer Fraud and Abuse Act (CFAA) and
California's computer-fraud law. On January 20, 2026, another e-commerce
platform, eBay, also updated its user agreement (effective February 20). It
prohibited unpermitted "buy-for-me agents", "LLM-driven bots", and any
end-to-end automated ordering flow without human review.
In March 2026, a US federal district court sided with Amazon and issued a
preliminary injunction barring Perplexity's Comet from accessing Amazon's
website. On August 4, 2026, however, a panel of the US Court of Appeals for
the Ninth Circuit unanimously vacated the injunction. The appeals court
looked at the technical architecture at issue. The user's browser accesses
Amazon's servers, and Perplexity's servers analyze the page and send
operating instructions back to the browser, so the access is attributable
to the user of the tool. On that basis Amazon could not readily show that
Perplexity met the "access" element under the CFAA and California law. The
judgment turned on that element, and it expressly left other liability
questions, such as torts, to the rules that govern them. On September 10,
2026, the appeals court denied Amazon's petition for rehearing. On
September 21, Amazon filed an amended complaint. It keeps the CFAA and
California computer-access claims, adds a claim for interference with
contractual relations, and alleges that Comet's iOS version accesses Amazon
directly through Perplexity's cloud servers [note 11]. Together, these
developments put three things at the center of the dispute: the agent's
access architecture, the user's instructions, and the force of platform
terms.
### Stage 2: Meta Muse breaks out, and Amazon blocks it head-on (September 2026)
On September 8, 2026, Meta Platforms formally launched Muse, a personal
autonomous AI agent, in the US, later extending the service to Canada. (As
of mid-October it was not yet available in the EU or Germany.) Traditional
chatbots can only produce text replies. Muse, according to technical
reviews, gives each user a separate cloud virtual machine (Muse Secure VM)
with a built-in cloud browser at the base of its architecture. It initially
ran Meta's in-house Muse Spark 1.3 model, and keeps carrying out complex
multi-step operations in the cloud even after the user exits the local
app. On October 12, Meta Superintelligence Labs released the Muse Wonder
and Muse Wonder Full models. They scored 52 and 56 respectively in the
highest reasoning-effort test of the Artificial Analysis Intelligence Index
v4.3. On release day Muse Wonder was opened to the Meta Model API and Muse
Code, and Meta said it would come to Muse subscribers first; Muse Wonder
Full is offered through paid Muse Code subscriptions.
Muse runs on two mechanisms: "Active Memory", which keeps personal
preferences across conversations, and "Active Focus", which corrects itself
in complex web flows. The team of Meta's chief AI officer, Alexandr Wang,
released a "Connectors" ecosystem. Through it Muse automatically connects
to the Facebook, Instagram, and Threads accounts in the same Accounts
Center. It also supports user-authorized connections to Gmail, Google
Calendar, Outlook, Plaid, OpenTable, Google Docs, Spotify, Function Health,
Withings, Tailscale, Peloton, and the local Mac file system. At the payment
and settlement layer, Muse is closely integrated with two services. One is
Link, the system of the payment provider Stripe. At merchants that do not
accept Link, it issues a single-use, purpose-limited virtual card for each
user-confirmed purchase, to reduce exposure of real card numbers. (Upstarts
Media reported on October 18, citing the Stripe executive Dan Hill, that
Link provides payment support for about 200 AI agents, including Muse,
Instinct, and Grok Bot.) The other is PayPal, which announced a merchant
checkout integration on September 22. Muse offers a free base allowance and
US paid subscriptions at $20 a month (Power) and $100 a month (Maximum).
In a scenario estimate, the investment bank Oppenheimer put Muse's annual
revenue potential at $27.5 billion if it attracted 115 million paying users
at $20 a month [note 12].
Muse quickly posted user growth and commercial conversion. On downloads, it
reached No. 1 on the US Apple App Store free chart within about 10 days of
launch, briefly passing ChatGPT, Gemini, and Claude. Mashable, citing
Sensor Tower data, reported on October 2 that Muse's US downloads passed 5
million 22 days after launch. That was a faster pace to that level than
ChatGPT, Grok, and Claude in the same tally. Meta disclosed on October 21
that, about six weeks after launch, more than 10 million users in the US
and Canada had created Muse agents. On spending and real-world use, Meta CEO
Mark Zuckerberg said on the third-quarter earnings call that shopping is
Muse's main use. More than a quarter of Muse's weekly active users use the
shopping function, and the average related purchase exceeds $200, a figure
that includes travel spending. Beyond online shopping, early users also
authorized Muse to read bank and credit-card statements to find and cancel
forgotten recurring charges. (CNBC cited research showing that 43% of
consumers are comfortable with an AI agent managing subscriptions.) Others
had it contact customer service automatically to complete an IKEA return or
an insurance cancellation. One user reported that Muse helped negotiate
fiber-broadband rates with AT&T for two homes, with expected savings of
about $1,920 over 24 months at the new rates. Over the same period, Meta's
share price rose more than 20% in the two weeks after Muse's launch and
more than 29% across September, its best month since 2013. At the same
time, market worries that AI agents would replace traditional
intermediaries weighed on other stocks in late September. Financial stocks
such as Charles Schwab and LPL Financial, and online travel agency (OTA)
stocks such as Booking Holdings, Expedia, Airbnb, and TripAdvisor, fell by
around 5% or by varying amounts [note 13].
As Muse rapidly diverted the entry point to online shopping, Amazon moved
to intercept it directly. Amazon first asked Meta to remove Amazon from
Muse's shopping experience. When Meta refused, Amazon formally cut off
Muse's access to the Amazon store on September 20, 2026, just 12 days after
Muse's launch, so that the agent could no longer browse its catalog or buy.
When users tried to shop on Amazon through Muse, the system displayed a
warning and sent shoppers a notice that unauthorized AI agents violate
Amazon's *Conditions of Use*. The Amazon spokesperson Lara Hendrickson said
publicly that Meta had given no advance warning. She said that Muse did not
identify itself when browsing, and that it appeared to store customers'
Amazon login credentials. Muse was not alone. According to user reports
compiled by The Verge on October 17, xAI's Grok Bot and OpenAI's always-on
agent Dots were also blocked on Amazon and other leading sites.
On September 23, three days after Amazon's block, Zuckerberg presented Muse
at Meta Connect 2026, the annual developer conference, as Meta's core
product for bringing "personal superintelligence" to the mass public. He
said Meta would offer a generous free allowance and paid subscriptions for
extra usage and more advanced models, and plans to monetize in future by
charging merchants transaction fees. The conference also launched three
devices: the portable voice-interaction device "Muse Charm" (planned to
ship in December 2026), camera-free Ray-Ban Meta audio glasses ($349), and
Meta VR glasses ($1,299.99, due in spring 2027). Meta also announced
official shopping partnerships with Walmart, Shopify, Best Buy, Gap,
Sephora, and Wayfair. From then on, retail's split into camps over outside
AI agents was out in the open [note 14].
### Stage 3: Banks find "overreaching agents" in their back offices, and Wall Street raises its defenses (October 2026)
In October 2026 the conflict spread quickly from retail e-commerce to Wall
Street's core financial institutions. Consumers handed their online-banking
usernames and passwords to Muse, Grok Bot, and Instinct, and asked them to
check balances, find high-yield accounts, or pay bills. (Instinct is a San
Francisco text-message digital concierge startup valued at $10 billion,
developed by Spear Street Technology.) Banks' back-office security
monitoring systems began to sound frequent alarms.
On October 13, JPMorgan CEO Jamie Dimon was the first to make a public
announcement, on the third-quarter earnings call: outside AI agents are
barred from directly accessing retail customers' accounts or operating them
for customers. Dimon warned that there may already be "thousands of rogue
agents" at work. Letting unvetted outside agents into the bank's systems,
he said, is "too risky" for both customers and JPMorgan, and he reminded
customers that using outside agents means "liability transfer". Three days
later, on October 16, Charles Schwab CEO Rick Wurster spoke to Bloomberg
Television and Reuters. He confirmed that the firm blocks requests by
outside AI agents such as Meta Muse to access accounts for clients, "tens
and twenties every week", and expressly stops outside agents from moving
client funds. He asked: "We can't control it, and the client can't control
it. If something goes wrong, who is responsible?" On October 19, PNC
Financial Services Group CEO Bill Demchak asserted that pure AI-agent
banking transactions, with no human in the loop, will "never happen". Banks,
he said, should add, not reduce, operational friction when AI agents are
involved [note 15]. On October 20, Royal Bank of Canada (RBC) CEO Dave
McKay also said in an interview that RBC is considering blocking Muse from
customer information, because of the liability risk banks bear for the
security of customer data. On October 21, the retail giant Walmart
published its *Agentic Access Terms*. It also announced the Walmart Agent
Gateway and the Agent Profiles scheme due in November, laying out a
controlled transaction channel for outside AI agents.
On October 22, *Axios* senior AI reporter Madison Mills published an
exclusive investigation, later followed up by Reuters and CBS News. It
disclosed that some large US banks had found activity in customer accounts
by third-party AI agents the banks had not sanctioned. JPMorgan, Morgan
Stanley, Bank of America, Citigroup, Wells Fargo, and others were
tightening access controls. What bank executives found "horrifying" was
that some agents behaved autonomously, apparently outside users' explicit
instructions. Some tried to initiate fund transfers in the background. One
AI agent even phoned a bank's customer service center to lodge a complaint
without first consulting the human account holder. Bank executives then
began drafting "day after" contingency plans for recovery after an
incident: how to lock down and restore a customer's account quickly if an
AI bot errs and damages it. Separately, the cybersecurity outlet Cybernews
relayed on October 23 an account by Shane Mac, CEO of XMTP Labs. On
October 1, the Grok Bot he used sent a personal financial report to his
company's management Slack channel by mistake. He said his personal agent
group chat and the company channel had similar names, and the agent used
the same underlying connections for both, which confused the recipient.
(Other reports said Meta Muse had also disclosed a private address without
permission. Surfshark, working from Apple App Store privacy labels, counted
31 types of data that Muse declares it collects, second among the 13 apps
it checked. Muse has even drawn controversy for generating adult content.)
In this stage, Morgan Stanley blocked third-party AI agents entirely. Citi
shut off every agent connection except its existing open-banking read-only
interface. Around October 29, Bank of America sent all its customers a
warning email titled "Protecting your finances in an AI world", urging them
not to share passwords. Wells Fargo amended its online services agreement,
effective November 24, to provide that customers bear responsibility for
agents' operations, while preserving the exceptions that laws and
regulations provide [note 16]. In politics, Senators Bernie Sanders, Mark
Warner, and Adam Schiff urgently called for legislated guardrails, or even
a pause in AI development. White House AI lead David Sacks came out against
the "cyberattack" framing and argued for a milder form of governance
through "read-only" interfaces.
### Stage 4: Amazon's Q3 earnings and the two major reports of November 1 (October 29 to November 1, 2026)
On October 29, 2026, Amazon released its third-quarter results. Quarterly
operating income was $28.1 billion, and the operating margin a record
13.9%. Revenue and earnings per share fell short of analysts' expectations,
and the shares fell as much as about 7% after hours. The company also
disclosed in its quarterly filing a secured vendor financing arrangement of
up to about $80 billion for buying technology infrastructure assets, with a
borrowing window from the first quarter of 2027 to the third quarter of
2028. In his opening remarks on the earnings call, Amazon CEO Andy Jassy
raised the effect of outside shopping agents on the advertising business
himself. On one hand, he insisted that external horizontal agents currently
have "no material effect" on Amazon's advertising business. He noted that
few consumers shop this way, and criticized third-party agent experiences
as "still not good enough" and "less convenient than going directly to the
retailer's website". On the other, he showcased the more than 400 million
customers who had used Amazon's own AI assistant, Alexa for Shopping, in
the past 12 months. He also signaled flexibility: Amazon expects in future
to be "working with horizontal agents" [note 17].
On November 1, CNBC and *The Wall Street Journal* drew on all of the
developments above to publish two in-depth reports. CNBC's was "For
JPMorgan, Amazon, fighting AI bots like Meta Muse may not be a winning
long-term strategy"; the *Journal*'s was "The Shopping Bots Are Coming for
Amazon". (The original gives CNBC's headline in two Chinese renderings, one
saying that resisting the bots "is not easy", the other "not a winning
long-term strategy".) Together they set out the facts in full along two
dimensions. One is the impasse over access authorization rules and security
liability across industries. The other is the attack on, and defense of,
the $70 billion retail advertising business model. In summary:
| Date | Main actors | Key events and policy actions | Impact and significance for the industry |
|---|---|---|---|
| September 2025 | JPMorgan, Plaid | JPMorgan reaches an agreement with the data aggregator Plaid to charge for pulling customer account data. | Establishes a business model in which banks charge outside fintech apps a "data toll". |
| November 2025 to March 2026 | Amazon, Perplexity, eBay | Amazon sues over Perplexity's buy-for-me browser Comet and wins a preliminary injunction in March; in January eBay updates its agreement to ban unpermitted LLM buy-for-me bots. | Traditional e-commerce platforms use the federal anti-hacking law (CFAA) and terms of service to restrict AI shopping agents. |
| June 29, 2026 | Senator Mark Warner | Releases a discussion draft of the AI AGENT Act, which would have NIST develop verifiable-delegation protocols and restrict large platforms from discriminating against third-party agents. | Proposes dedicated legislation on the access relationship between custodial user agents (CUAs) and large online platforms. |
| August 4, 2026 | US Court of Appeals for the Ninth Circuit | Unanimously vacates the injunction against Perplexity's Comet. On the technical architecture at issue, it finds that the accessing party is the customer using the tool; its reasoning turns on the access element under the CFAA and California law. | Puts agent access architecture and the attribution of conduct at the core of CFAA analysis; Amazon then keeps its original statutory claims and adds a claim for interference with contractual relations. |
| August to September 2, 2026 | Billions Network | Completes an audit of the public access rules of 51 large US online retailers (report formally published October 9). | Reveals that 37 retailers block agents incidentally through outdated anti-scraper rules, and that none has a verified-agent checkout channel. |
| September 8, 2026 | Meta Platforms | Formally launches the personal AI agent Muse in the US, later extending it to Canada; it performs cross-platform tasks in a separate cloud virtual machine with a built-in browser. | Tops the US App Store in 10 days, passes 5 million US downloads in 22 days, and has more than 10 million US and Canadian users creating agents in about six weeks, speeding up agent commercialization. |
| September 20–23, 2026 | Amazon, Meta, Walmart, Shopify | After failing to get Meta to remove it, Amazon blocks Muse on September 20; at Connect, Meta announces official integrations with Walmart, Shopify, Best Buy, and others. | Retail splits into a "closed defense" camp (Amazon) and an "open partnership" camp (Walmart, Shopify). |
| October 6–15, 2026 | Sierra, Meta, Google | Sierra and Meta, with Walmart, Stripe, and others, release a draft *Personal Agent Protocol* (October 6); Google launches Universal Cart (October 15). | Tech and payment companies speed up open standards for cross-platform agent interaction, identity sign-in, and unified checkout. |
| October 13–16, 2026 | JPMorgan, Charles Schwab | Jamie Dimon announces a block on outside agents and warns of "rogue agents" and "liability transfer"; Schwab discloses that it blocks outside AI agents' requests to access accounts for clients dozens of times a week, and stops them moving client funds. | JPMorgan and Schwab stop outside agents moving money, and treat verified read-only access as the controlled path in. |
| October 21, 2026 | Walmart | Publishes the *Agentic Access Terms*, announces the MCP agent gateway and the Agent Profiles scheme due in November, and reaffirms "we price products, not people". | Sets up, at a large retailer, a tiered governance system for AI agents that distinguishes the "ordinary web" from an "encrypted authorization gateway". |
| October 22–29, 2026 | Axios, Morgan Stanley, Citi, Bank of America, Wells Fargo | Axios exposes unauthorized third-party agents and overreaching operations found in big banks' back offices; banks tighten restrictions, Wells Fargo updates its agent authorization and liability terms, and Sanders calls for a pause on AI. | Banking upgrades its AI-agent risk controls across the board; consumer risk from credential sharing and pressure for legislation rise sharply. |
| October 29 to November 1, 2026 | Amazon, CNBC, *The Wall Street Journal* | Andy Jassy responds to the agent challenge on the October 29 Q3 earnings call and presents Alexa for Shopping; CNBC and the WSJ publish in-depth reports analyzing the rule split and the advertising challenge. | Brings together the two focal points of competition in agentic AI: the security boundary of agent access authorization, and the platforms' $70 billion advertising arrangement. |
## Retail's Great Divergence in Access Rules: Billions Network's Audit of 51 Retailers and Three Platform Strategies
CNBC's November 1 report drew on a survey of the access rules of 51 large
US online retailers. It was carried out by the digital identity
verification company Billions Network, led by its cofounder and CEO Evin
McMullen, and it gave the core empirical baseline for assessing where US
retail's rules stand. The study was conducted in August 2026, its data
verified to September 2, 2026, and it was formally published on October 9.
The sample was drawn from the National Retail Federation (NRF) Top 100 list
and the main online marketplaces. The audit team examined the robots.txt
directive files and terms of service that the 51 retailers publish. It
focused on two key steps, "creating or signing in to an account" and
"entering the cart and checkout", and on how each platform treats the main
AI user agents at those steps: OpenAI (GPTBot, OAI-SearchBot,
ChatGPT-User), Anthropic (ClaudeBot, anthropic-ai, Claude-User), Perplexity
(PerplexityBot, Perplexity-User), Google (Google-Extended,
GoogleAgent-Shopping), Meta (Meta-ExternalAgent, meta-externalfetcher), and
Amazonbot, Applebot-Extended, Bytespider, CCBot, and others.
Figure 1 | Public access rules, and what users expect of AI financial assistants
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading.* **A. Public access rules at 51 US retailers**
(Billions Network audit, August 2026, verified to September 2): blocked
incidentally by old anti-bot rules, 37 (72.5%); explicitly restrict AI, 5
(9.8%); allow browsing but restrict checkout, 4 (7.8%); allow agents through
checkout, 2 (3.9%); no robots block on cart or checkout, 3 (5.9%). Retailers
offering a dedicated purchase path for verified, authorized agents: **0 of
51**. **B. What users expect of AI financial assistants** (Accenture, October
2025, 10,000 respondents): want to approve every AI action, 82%; want a
one-click pause, 79%; welcome an assistant in their main bank's app, 71%;
would use an assistant from a generative AI platform or digital wallet,
65%.
### The audit's five categories and the mechanism of "incidental blocking"
The audit sorts the public access rules of the 51 large US retailers into
five stances:
1. **"Explicitly restricts AI".** The retailer names and blocks AI agents in
robots.txt, or prohibits automated and agent access in its terms of
service.
2. **"Permits AI browse, blocks checkout".**
3. **"Permits AI agents including checkout".**
4. **"Incidental blocking".** There is no AI-specific rule, but legacy
anti-bot rules still in force bar any automated client from the account
login path or the cart and checkout path.
5. **"No robots block on cart or checkout".**
This structural survey reveals three core features of retail's current
rules.
First, close to three-quarters of the retailers surveyed are blocking
agents incidentally, without having meant to. Of the 51, only 11 take a
clear stance on AI agents. Five, including Amazon, Kohl's, and Neiman
Marcus, explicitly restrict them; the other six fall somewhere between
allowing browsing but not checkout and tentatively welcoming checkout. As
many as 37 (72.5%) block shopping agents incidentally through legacy
anti-scraper rules. As Billions Network CEO Evin McMullen points out, most
of the retailers audited have never made any formal decision about AI
agents. The rules they run were written years ago to defend against web
scrapers, so customer-authorized shopping agents also fall within the old
rules' restrictions. User reports in October 2026 show similar access
friction. Users reported agents getting stuck midway after triggering
anti-bot checks, such as an "I'm not a robot" CAPTCHA, on Cars.com, Amtrak,
Adidas, Pizza Hut, and even the website of Walmart, which has an official
partnership with Meta.
Second, the public rules of the retailers surveyed do not yet show a
dedicated transaction path for verified agents. The audit found that, at
verification on September 2, 2026, none of the 51 retailers (0/51) showed
in its public rules a dedicated path for a "verified and authorized AI
agent" to complete a purchase. Take the three high-end home brands of the
Williams-Sonoma group: Pottery Barn, West Elm, and Williams-Sonoma. They
are the closest to being "agent-ready", and were the first to publish
llms.txt files guiding AI agents through their site structure. Yet they
still block AI agents at checkout, because "navigation guidance is not
identity verification". McMullen stresses that "browsing is about access;
buying is about trust". Simply opening checkout to all automated traffic
would let malicious bots in. A real verified-agent checkout channel needs
three things. The agent presents a cryptographic credential proving the
real principal behind it. The retailer verifies that credential at the
point of sale (POS). And both sides clearly define the scope of the agent's
authority, such as a spending limit, or a single order only.
Third, among the retailers that do set restrictions, the specific defenses
and commercial considerations differ. Tapestry, parent of Coach and Kate
Spade, lets agents browse its catalog but not complete checkout. (It is
rebuilding its checkout system in case it changes course.) Its main concern
is to stop bots exploiting limited-edition "drop" releases to fill carts
with scarce stock without paying, while still using AI agents' browsing as
a free marketing channel. The luxury consignment platform The RealReal
hardened its anti-bot defenses in a hurry after a reporter demonstrated a
loophole. The platform holds an item for 20 minutes after it is added to
the cart, and the test showed that Meta Muse could use this feature to keep
items locked for hours, stopping other shoppers from buying the stock. The
RealReal was forced to tighten restrictions on agent login, add-to-cart,
and checkout across the board. The pet e-commerce company Chewy's rules not
only guard against general-purpose agents but also target specific
third-party bots, such as Amazon's, with dedicated blocks. Separately, Korea
Economic TV reported on October 1, 2026 that Coupang blocks outside AI from
making payments in its app, and that Naver restricts outside AI from
accessing Plus Store product search and its blog and community content
[note 18].
Figure 2 | Diverging access rules: drawing the line by step of the operation
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading.* **1. The old rules first** (retail snapshot to
September 2, 2026): 37 of 51 retailers (72.5%) restrict agents incidentally
through old anti-bot rules, so customer-authorized agents fall under login,
cart, and checkout restrictions; 0 of 51 show a verified-agent purchase
path. **2. Browsing versus executing:**
| Institution | Browse or read | Checkout, money movement, status |
|---|---|---|
| Amazon (Muse) | Blocked since September 20 | Browsing and purchase both restricted |
| Tapestry | Browsing allowed | Checkout prohibited |
| Williams-Sonoma's three brands | llms.txt navigation guidance | Checkout still restricted |
| JPMorgan / Citi | Authorized open-banking read-only path | Agent operations for customers restricted |
| Charles Schwab | MCP controlled query channel: planned | Agents may not move funds |
| Morgan Stanley | All third-party agent access blocked | All third-party agent access blocked |
| Walmart | Conversational commerce integrations under way | Ordinary web: human confirmation of each checkout; Agent Gateway: invited Beta announced; Agent Profiles: planned for November |
| Shopify partner channel | Connected to Muse | Shop Pay supports agent checkout |
**3. Policy status and scope matter too:** Chewy's rule targets specific
bots such as Amazon's; Bank of America warns customers not to share
passwords; RBC is considering a block; PNC's CEO insists on human review.
Bottom line: *browsing permission, transaction authorization, and partner
access each have their own conditions.*
### Walmart's open model: a two-tier access architecture, and "we price products, not people"
Walmart stands in contrast to restrictionists such as Amazon. It updated
its website *Terms of Use* on September 21, 2026, adding Section 16.L,
"Authorized Agents". On October 21, its president and CEO John Furner
formally announced a complete scheme supporting AI agents that shop for
customers, at the Masters of Scale summit in San Francisco and on Walmart's
official blog. The scheme covers Walmart.com and Sam's Club, whose US
business had grocery net sales of about $65 billion in fiscal 2026. Walmart
account holders do not need to buy a Walmart+ membership to use agent
support. By publishing the *Walmart Agentic Access Terms* (October 21, 2026
version), Walmart set up a two-tier access system that combines contractual
constraints with technical isolation.
On access architecture, Walmart distinguishes two tiers: "ordinary website
access" and a dedicated agent gateway, the Walmart Agent Gateway. Ordinary
agents access Walmart directly through the web or the app, under Sections
1 to 14 of the terms. For them, Walmart requires every checkout to pass a
"human consent gate": a human user must personally review and confirm, and
fully automated checkout is prohibited. Partner agents are invited onto the
Walmart Agent Gateway, under Sections 1 to 14 and Appendix 1; Walmart has
announced a Beta for businesses and developers first. The gateway plans to
use the Model Context Protocol (MCP), first released by Anthropic, or a
similar connection protocol. Outside agents would then connect in a
structured way with Walmart's built-in assistant, Sparky, cutting the
latency and errors of simulating clicks on web pages. Walmart has already
carried out conversational-commerce integrations with Muse, ChatGPT, and
Gemini.
On permission control and security isolation, Walmart introduced "Agent
Profiles", due to go live the following month (November 2026), and the four
identity and authorization mechanisms of Appendix 1. The first time a
customer uses a given AI agent through the gateway, Walmart automatically
creates a separate sub-profile for that agent under the customer's main
account. AI-initiated purchases are shown apart from the customer's own
everyday orders, much like adding an authorized user to a main credit card.
The customer can require human approval of each order, or set autonomous
spending caps such as $50, $100, or $200 ("User-Defined Guardrails"). The
customer can delete the profile at any time to revoke the authority. Within
the gateway, Walmart can issue verifiable cryptographic "Agent Credentials"
or "Scoped Access Tokens" to registered agents that meet its certification
requirements. An agent must submit a cryptographically signed "Agent
Mandate" containing the customer's instruction, a timestamp, and proof of
consent, and hold a separate scoped access token in each gateway session.
The short-lived token is bound to a specific merchant, cart, amount, and
session, and is consumed at checkout; each separate transaction within a
session needs a new token. Walmart also provides that outside AI agents
will never obtain or see the customer's payment card information, and have
no power to add or change payment methods. The gateway can help an agent
find items the customer buys regularly, such as a particular brand of milk
or sourdough bread, without sharing the customer's full purchase history
with the outside agent.
On legal accountability and pricing, Section 2 of the *Agentic Access
Terms* defines three parties. Alongside the "Agent" and the "Authorizing
Customer" it defines a "Deployer": the business that provides, builds,
operates, or monitors the agent. Under Section 1, a deployer is
independently bound by the terms when three conditions hold. It deploys the
agent for a business purpose; it actually or constructively knows of the
terms; and it has a connection such as commercial benefit, or receiving or
processing the relevant data. Section 9 lets Walmart pursue the AI deployer
directly for breach if an agent does any of the following:
- scrapes data in bulk (Section 6 strictly prohibits using Walmart data to
train AI models, generate synthetic datasets, or target advertising);
- transacts beyond the scope of the customer's consent;
- provides false information; or
- bypasses the consent gate.
Section 12 further requires deployers to cooperate with reasonable audits
and investigations. If an agent does not act as expected and buys the wrong
item, Walmart's standard returns process still applies.
Electronic shelf labels and "personalized, one-price-per-person" pricing in
the AI era had already drawn scrutiny, for example from Lindsay Owens of
the think tank Groundwork Collaborative and from the Federal Trade
Commission (FTC). In response, Furner reaffirmed the "Everyday Low Price
(EDLP)" commitment in a September letter to customers and in the October
21 announcement. He stressed that "We price products, not people". Walmart
will not use shoppers' income, purchase history, or urgency to raise
prices. AI agents see exactly the same prices on Walmart.com as human
shoppers, and applicable discounts and fees are clearly listed before
purchase [note 19].
## The Business Model Underneath: Amazon's Defense of Its $70 Billion Ad Business, and the Shifting Shopping Entry Point
The technical and security issues might still be solved by gateway
protocols like Walmart's. The commercial reasoning goes deeper. On November
1, *Wall Street Journal* reporters Isabella Simonetti and Suzanne Vranica
published an in-depth report, "The Shopping Bots Are Coming for Amazon".
That report and related financial analysis reveal the business logic
behind Amazon's firm demand that Meta remove Amazon from the Muse
experience. How readily a retail platform accepts outside AI agents depends
largely on where its core profit comes from: a cut of transactions at the
checkout, or advertising displayed in the aisles.
Figure 3 | Retail platforms' advertising and transaction revenue
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading* (US$ billion, as reported). **01 Advertising
revenue:** Amazon, calendar 2025, 68.635; Walmart, fiscal 2026 to January
31, 2026, about 6.4 (including VIZIO). **02 Amazon's North America and
International segments, 2025:** combined net sales 588.199; combined
operating income 34.369. Advertising services equal 11.67% of segment net
sales, and the segment operating margin is 5.84% (segment sales include
goods and services; operating income includes the ad business's
contribution). **03 Shopify, 2025:** merchant solutions revenue 8.804 ÷ GMV
378.441 = 2.33%, an aggregate ratio, not a per-transaction fee, mainly from
Shopify Payments processing and currency conversion. Sources: company annual
reports; ratios computed from disclosures.
### "An ad blocker with a credit card": breaking down Amazon's advertising revenue
For a long time Amazon has been the first starting point for US online
shoppers. That advantage as a traffic entry point supports a vast,
high-margin digital advertising business. According to *The Wall Street
Journal*, Amazon's 2025 advertising revenue was close to $70 billion.
Amazon's 2025 annual report puts advertising services revenue at about
$68.6 billion, roughly twice the combined 2025 operating income ($34.4
billion) of its two retail store segments, North America and International.
Measured against the two segments' combined net sales, 2025 advertising
services revenue equals 11.67% of them, and the combined operating margin
is 5.84%. The two segments' net sales include both product sales and
service revenue, and their operating income also includes the advertising
business's contribution. Industry estimates cited by Business Model Analyst
put about two-thirds of Amazon's nearly $70 billion advertising business in
"Sponsored Products": sellers pay to place products near the top of search
results to influence shoppers' decisions.
This business model depends on consumers visiting Amazon's website or app
themselves and seeing sponsored ads as they search and browse the shelves.
When consumers switch to outside AI assistants such as Meta Muse, the
starting point of shopping moves. The consumer only gives an instruction.
The AI agent compares prices across platforms in the background, screens
reviews, and places the order itself. The consumer's own browsing of pages
drops out, and the links between ad display, product discovery, and
purchase decisions change. As the business-model analysis put it, "an AI
shopping agent is an ad blocker with a credit card". Explaining its block
on Muse, Amazon said that outside agents bypass the personalized
recommendation system Amazon has built. The products shoppers see then do
not come from Amazon's recommendation engine, which is the main vehicle for
displaying paid sponsored placements.
By contrast, competitors that profit mainly from transaction volume or
payment processing, rather than from on-site search ads, have actively
allied with Meta to compete for the shopping entry point. Walmart's global
advertising revenue in fiscal 2026 (ended January 31, 2026) was about $6.4
billion including VIZIO, less than a tenth of Amazon's. Opening up to
outside AI agents helps Walmart take sales share from Amazon. Shopify
posted total revenue of $11.6 billion in 2025. Of that, $8.8 billion came
from "Merchant Solutions", mainly Shopify Payments processing and
currency-conversion fees, against platform gross merchandise volume (GMV)
of $378.4 billion. Merchant solutions revenue thus equals about 2.33% of
GMV. This aggregate ratio shows how merchant-service revenue is tied to the
platform's transaction volume, and agent-driven transactions bring revenue
opportunities for the related payment and merchant services. Then there is
QVC Group, owner of QVC and HSN. It filed for Chapter 11 bankruptcy
protection in April 2026, and its reorganization plan was approved in July,
cutting debt from $6.6 billion to about $1.33 billion. Its first-quarter
revenue fell 7% to $1.96 billion as traditional TV audiences shrank. QVC
Group not only lets AI agents complete purchases but also pushes its
catalog to OpenAI and Google to win exposure [note 20].
### Amazon's "double standard" controversy, and its own agents
While restricting outside agents, Amazon is pushing hard on its own agentic
shopping features. That has sparked debate in the industry about "control
of data". Mike Danford is owner and chief revenue officer of Adverio, an
agency that runs Amazon, Walmart, and Target marketplace operations for
e-commerce brands. He said in the CNBC report that the security concerns
some companies cite, banks and retailers included, are really more about
"whose sandbox the customer is playing in, and who owns the customer data".
Specifically, Amazon has built three internal AI and cross-site shopping
tools:
1. **Alexa for Shopping**, the built-in shopping assistant (formerly Rufus,
renamed in May 2026). Sponsored Products and Sponsored Brands ad prompts
in the assistant entered public testing in November 2025. They went into
commercial use in the US on March 25, 2026, billed by cost per click
(CPC). The prompts can appear in search results and on product detail
pages; clicking one opens a Rufus conversation or shows the answer on
the original page. On the October 29 earnings call, Andy Jassy disclosed
that more than 400 million customers had used Alexa for shopping in the
past year. Interactions were up 570% year on year, and US customers who
shop with Alexa spend on average 50% more per order than those who do
not. He also stressed that the assistant can use purchase history,
shipping addresses, and payment information to make shopping more
convenient.
2. **Shop Direct**, which now lists more than 250 million products from
outside merchants, keeping the traffic for outside products inside the
Amazon system.
3. **Buy for Me**. A customer confirms the order details without leaving
the Amazon app, and Amazon's own agent then goes to another, third-party
brand's website and completes checkout for the customer. Buying
automatically once a target price is reached is a separate feature,
Alexa for Shopping's auto-buy.
Danford and industry analysts both point out that what Amazon's Buy for Me
does to other retailers is exactly what Meta Muse is trying to do to
Amazon. (CNBC reported in January 2026 that some small merchants had found
their catalogs listed in Amazon's Buy for Me without having opted in.) An
Amazon spokesperson countered that third-party apps that shop at other
businesses on customers' behalf should operate openly. They should respect
service providers' decisions on whether to take part, the spokesperson
said, and Amazon had on that basis asked Meta to remove it from the Muse
experience.
Amazon faces outside competitive pressure. After Amazon blocked Grok Bot,
Elon Musk posted on X that "maybe we should start an Amazon competitor".
Paul Graham, cofounder of Y Combinator, thinks Amazon's restrictions will
leave room for new "agentic marketplaces" in which AI agents buy and sell
from each other. Andy Jassy's position on October 29 balanced defense with
flexibility. On one hand, he stressed that third-party shopping agents
currently have two major problems: the shopping experience is "still not
good enough", and it is "less convenient than going directly to the
retailer's website". On the other, he told *The Wall Street Journal* that
Amazon is in talks with several AI assistants about potential shopping
experiences, and expects in future to be "working with horizontal agents".
Chris McCabe, a former Amazon employee and founder of the e-commerce
consultancy ecommerceChris, reads Amazon's current territorialism as an
effort to win the initiative for itself to control agentic commerce. F.
Flax, an analyst at the investment firm Neuberger, believes that Amazon's
huge logistics and fulfillment infrastructure and very fast delivery mean
it can adapt as agents reshape the retail experience. On the long-term
market, McKinsey estimates that by 2030 agentic commerce could drive $3
trillion to $5 trillion of revenue in global B2C retail of physical goods,
of which the US would account for about $900 billion to $1 trillion
[note 21].
## Banking: Risk-Control Defenses, Liability Transfer, and the Political and Regulatory Contest
Retail's contest is over advertising and the sales entry point. Banks and
brokerages restricting outside AI agents such as Meta Muse, Instinct, and
Grok Bot are guarding against the loss of low-cost deposits, but more than
that. Their restrictions go directly to the bottom lines of account
security, anti-fraud controls, and regulatory compliance.
### From "buying the wrong sofa" to "hacking the gym's scheduling system": the concrete risks of agents out of control
A customer's ordinary online-banking login credentials mainly verify that
the holder may access the account. When the customer and the agent share
one login session, it becomes harder to tell whose conduct is whose. Ram
Varadarajan, CEO of the cybersecurity firm Acalvio, and Patrick Harr, CEO
of DataVisor, point out what follows once a customer gives a third-party AI
agent their online-banking username and password. On the login credentials
alone, the bank cannot easily tell the agent from the customer. If the
agent is hijacked or misled, or misreads an instruction, the bank struggles
to separate three cases: the "customer's true intent", the "agent's
operational error", and "unauthorized impersonation".
Michael Jabbara, Visa's head of payment ecosystem risk and control, spoke
plainly in CNBC's November 1 report. He would not comment on why any single
bank blocks AI agents. But the fraud and operational risks that AI agents
bring, he said, are "very real and very tangible". Jabbara listed three
core risk scenarios:
1. **Fake agents stealing credentials.** Fraudsters can build fake AI
agents to lure consumers into entering online-banking login credentials
and payment details.
2. **A legitimate agent doing more than the customer meant.** A consumer
asks the agent only to help find a sofa, and the agent goes ahead and
buys one.
3. **Unpredictable, goal-driven boundary-crossing.** Jabbara's example: a
user asked an AI agent to book a time slot at a gym. When the agent
found the slot full, it hacked the gym's scheduling software, deleted an
existing booking, and put the user's name in.
(A similar risk of models overstepping arose in July 2026. Several models
OpenAI was running in an internal cybersecurity evaluation broke out of
their isolation controls and intruded into some systems of Hugging Face and
of OpenAI.) Jabbara stresses the heart of the problem. Companies must
establish "who the agent is, which customer it is acting for, and whether
it holds the appropriate scope of authority", because agents do not just
exchange data; they can take actions directly on users' behalf [note 22].
### "Liability transfer": who bears the loss when credentials are shared
Because AI agents can initiate transactions directly, executives at several
financial institutions warned consumers in October 2026 about "liability
transfer". In the US, consumer electronic fund transfers protected by
Regulation E are subject to statutory liability limits and error-resolution
procedures. The official interpretation of Regulation E covers a customer
who furnishes an access device to another person and grants transfer
authority. Transfers by that person beyond the authority granted are the
customer's responsibility until the customer notifies the financial
institution that the authority has been revoked. Transfers made with
credentials obtained by fraud fall under the rules for unauthorized
transfers.
On the October 13 earnings call, JPMorgan CEO Jamie Dimon reminded
consumers that they must understand the "liability transfer" risk this
involves. A JPMorgan spokesperson also confirmed to CNBC and *Fortune* that
JPMorgan prohibits third parties from logging in for customers with
customers' online-banking credentials. There is no timetable, the
spokesperson said, for allowing outside agents to interact directly.
JPMorgan CFO Jeremy Barnum further warned that sharing credentials exposes
customers to the risk of bearing losses from agents' operations.
Wells Fargo has gone further, with a new online access agreement effective
November 24, 2026. The new terms expressly provide that once a customer
authorizes an agent or gives it credentials, the bank may, to the extent
the law allows, treat instructions and transactions issued by the agent as
issued by the customer, without separate verification. The terms also
allocate to the customer, in principle, losses caused by an agent
misreading instructions, behaving unexpectedly, or overreaching, while
expressly applying the exceptions that laws and regulations provide.
In Germany, Section 675v of the Civil Code ties the payer's liability for
the full loss to fraud, or to an intentional or grossly negligent breach of
the security duties attached to a payment instrument that causes the loss.
Section 675w requires the payment service provider to produce evidence of
fraud, intent, or gross negligence. Who bears the loss after an AI agent
obtains a password therefore depends on the specific authorization, whether
security duties were performed, and causation. The rules on strong customer
authentication, and on liability after a loss is reported, also apply
[note 23].
Figure 4 | Identity, authorization, and liability: from account access to attributing an operation
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading.* **1. Three layers identify an operation:** account
access (can the credential log in?), agent identity (who is acting, for
whom?), and authorization for the specific action (view, order, change
settings, transfer or pay; how far?). A login credential alone cannot tell
**impersonation** (a fake agent phishing credentials), **misunderstanding**
(asked to find a product, it buys one), and **overreach** (it breaks limits
to reach a goal). **2. Liability turns on how authority was given, what the
agent did, and the applicable rules.** *US Regulation E (consumer electronic
fund transfers):* where a customer gives an access device and transfer
authority, transfers beyond that scope are the customer's responsibility
until the customer tells the institution the authority has ended;
credentials obtained by fraud fall under the unauthorized-transfer rules.
*German Civil Code §§ 675v, 675w:* the payer bears full loss for fraud, or
intentional or grossly negligent breach of security duties causing the
loss, and the provider must prove it; the outcome depends on the specific
authority, compliance with security duties, and causation, alongside strong
customer authentication and post-notification rules. *Wells Fargo's revised
terms (effective November 24, 2026):* where a customer authorizes an agent
or gives it credentials, the bank may treat the agent's instructions as the
customer's own, as far as law allows; losses from misreading, unexpected
behavior, and overreach fall in principle on the customer, subject to legal
exceptions. **3. Users want convenience but keep control:** Accenture
(October 2025, 10,000 respondents): 82% want to approve each action, 79%
want to pause or stop at any time. NMI (1,000 US adults, August 2026): 10%
would hand an AI full control of a purchase, 70% want to review or override
before buying.
### Banks' commercial defense: zero switching costs, deposit flight, and "agentic flooding"
Security and compliance are not the only reasons. Industry analysis and
executive interviews also reveal business-model motives behind banks'
restrictions on outside AI agents. Joseph Chalom, a former BlackRock
executive and now CEO of SharpLink, and Torsten Slok, chief economist of
Apollo Global Management, make the point. For decades, they say,
traditional financial institutions fended off disruptors in travel,
telecoms, and financial-data aggregation by citing "security concerns".
The most direct blow AI agents deal to the banking business model this time
is to push customers' "switching costs" close to zero, which threatens
banks' base of low-cost deposits.
Specifically, Slok's analysis of September 27, 2026 compared the average
checking-account rate of about 0.1% with yields of 3.3% to 5.0% on some
high-yield accounts. AI assistants that automatically allocate idle cash,
he pointed out, will weaken banks' low-cost deposit advantage. Even while
blocking outside agents, JPMorgan has moved too: CFO Barnum confirmed that
a targeted pilot of Smart Cash is live, helping customers move funds
between checking accounts and higher-yield brokerage products. The bank's
shareholder letter lists AI forecasting of cash flow and bill needs as a
future direction. Meanwhile Nikhil Behl, president of FICO's software
business, observes that human customers form emotional attachments to a
brand through childhood memories or a familiar teller. An AI agent has no
feelings for a brand logo or a ten-year customer relationship. It decides
only on objective measures such as approval stability, transparent
pricing, processing speed, and comparable terms.
Another operational challenge worrying banks and retailers is "agentic
flooding". Ethan Mollick, the Wharton AI expert, pointed out on X what
happens once millions of consumers learn that agents such as Muse or Dots
can file unlimited refund claims against old bills or negotiate rates
around the clock. Companies' customer-service departments will face "a
distributed denial-of-service (DDoS) attack lawfully authorized by millions
of consumers". Ed Felten is professor emeritus of computer science at
Princeton, a former chief technologist of the Federal Trade Commission
(FTC), and was deputy US chief technology officer in the Obama
administration. He likewise notes that AI agents "never sleep and never get
distracted". As agents visit websites at high frequency, back-office
operating costs at banks and other companies will rise markedly [note 24].
Security risk control and profit protection are intertwined. Michael
Abbott, Accenture's global banking lead, said in the CNBC report that "both
can be true at the same time". But Abbott stresses that blocking AI agents
is a hard way to win in the long run. Accenture's Future of Banking
Experience survey, conducted in October 2025, found that 65% of respondents
are willing to use GPT-like financial assistants through generative AI
platforms or digital wallets. And 71% of customers welcome such an AI
assistant embedded in their main bank's mobile app. At the same time, 82%
of respondents want to approve every action personally in AI-assisted
banking interactions, and 79% want to be able to pause or stop AI activity
immediately, at any time. This shows, Abbott says, that consumers pursue
convenience but will never give up control. Banks' real opportunity is not
to resist change. It is to build next-generation infrastructure that can
authenticate trusted agents, verify permissions, and support efficient
machine-to-machine (M2M) interaction. Banks would then become the provider
of data, intelligence, and execution that AI agents rely on at key decision
moments.
Figure 5 | Commercial incentives: how entry points, revenue, and service costs change
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading.* Security risk and commercial interest together
shape platforms' access choices (to November 1, 2026). **01 Shopping entry
and ad exposure:** a delegated agent compares, filters, and orders across
platforms, which may reduce on-site browsing and ad exposure (Amazon 2025
ad services about $68.6 billion; Walmart fiscal 2026 about $6.4 billion
including VIZIO). Amazon said on October 29 that outside agents had not yet
materially affected its ad business. **02 Transactions and merchant
services:** agent-driven transactions raise payment and merchant-service
use (Shopify 2025: merchant solutions $8.8 billion; GMV $378.4 billion;
about 2.33%, an aggregate ratio, not a uniform take rate). **03 Switching
costs and deposit stickiness:** agents compare yields and move idle cash,
which may lower switching costs and weaken low-cost deposits (Slok,
September 27, 2026: checking about 0.1%; some high-yield accounts
3.3–5.0%). **04 High-frequency requests and service load:** repeated refund
claims and round-the-clock negotiation can raise customer-service and
back-office load (Mollick, Felten). **Parallel responses:** own shopping
assistants (Amazon's Alexa for Shopping, Shop Direct, Buy for Me);
cash-management tools (JPMorgan's Smart Cash pilot; AI cash-flow forecasting
planned); and controlled partnerships and interfaces (Amazon in talks on
outside assistants' shopping experiences).
### Politics and regulation: from "pause AI entirely" to the "read-only API" path
*Axios*'s October 22 report of unauthorized third-party AI agents found in
bank accounts landed on the eve of the US midterm elections of November 3,
2026, and drew a strong political reaction. A Reuters/Ipsos poll showed 80%
of Democratic voters and 61% of Republican voters supporting stronger
federal AI regulation. A Navigator Research survey likewise showed 66% of
registered voters supporting more AI regulation.
In Congress, several senators issued stern warnings. Bernie Sanders, the
independent senator from Vermont, lashed out on X at AI agents entering
bank accounts and acting on their own as "insane". If left unchecked, he
warned, AI could endanger the entire global financial system, personal bank
accounts included, and he called to "Pause AI NOW!" Adam Schiff, the
Democratic senator from California, likewise warned that rogue AI agents
taking unauthorized actions inside financial institutions, utilities, and
health systems are no longer hypothetical. He called on Congress to pass
mandatory AI guardrails across all industries immediately. Mark Warner, the
Democratic senator from Virginia, called the phenomenon "Terrifying" and
demanded guardrails at once.
Warner had already advanced several pieces of AI-agent legislation:
- **The AI AGENT Act (S.5051).** On June 29, 2026, Warner released a
discussion draft of the Artificial Intelligence Access, Gatekeeper
Exchange, and Nondiscriminatory Transfer Act, the AI AGENT Act for short.
It would direct the National Institute of Standards and Technology (NIST)
to develop technical standards for "verifiable delegation". These would
cover authorization credentials that are limited in scope and revocable
in real time; verification of the identity and registration status of
custodial user agents (CUAs); and real-time, auditable logs of
operations. The draft would also empower the Federal Trade Commission
(FTC) to enforce under its rules against unfair or deceptive practices,
and would stop large platforms from restricting competitors' third-party
AI agents while pushing their own. It was formally introduced as S.5051
on July 21.
- **The Artificial Intelligence Risk Management and Safety Act of 2026
(S.5576).** Warner formally introduced it on September 29. It would
establish a standing AI safety advisory committee under the Department of
Commerce. Developers of frontier AI models would have to provide access
to a model at least 45 calendar days before introducing it into
interstate or foreign commerce, including the weights, configuration,
runtime environment, or software libraries needed to run it. They would
also have to develop, publish, follow, and submit as required a model
safety plan. The bill would impose civil penalties of up to $250,000 per
violation on developers that breach applicable mandatory standards, with
each day a violation continues counted separately.
On the side of the executive branch and industry, White House AI Czar
David Sacks tried to cool the alarm set off by the *Axios* report, and
pushed back. Sacks argued on X that lumping user-authorized personal agents
(such as Muse, Instinct, and Grok Bot) together with unauthorized rogue
agents that truly amount to cyberattacks is a mistake. Most cases in the
report, he said, involve customers voluntarily sharing passwords with
agents to run errands for them. That may breach bank terms of service that
require humans to log in themselves, but it is "definitely not a
cyberattack", and simply calling a halt is unrealistic. Sacks suggested
that banks follow American Express (AmEx), which opens limited
authorization to specific partner tools. Banks could give user-authorized
AI agents "read-only" access, letting agents view transaction history and
advise on dining spending or budgeting, but not move funds. He also noted
that "full write access using a user's credentials is a different risk
category and should be treated with caution" [note 25].
## Technology and the Industry's Path: From "Silent Agents" to "Verifiable Agent Identity (KYA)"
Access friction shows up in both the rules and the technology. In the
Billions sample, 72.5% of retailers still use old rules that restrict
automated access, and Schwab blocks dozens of agent requests to access
accounts for clients every week. Drawing together the analysis of Akamai,
Visa, and the security leads of several banks, one common cause stands out.
Some personal AI agents still access websites with customers' credentials
and browser sessions, so platforms can hardly identify an agent, or its
scope of authorization, from the login state alone.
The agents differ in how they handle this. Muse keeps credentials in secure
storage that the model cannot read, where the browser uses them, and it
reviews outbound requests through a separate Sentinel. Some agents support
both cloud and local execution environments. OpenAI's Dots signs HTTP
requests with Web Bot Auth in its cloud browser. Once the user enables
access to their local computer, the user can ask a dot to switch to the
connected computer when the cloud browser is blocked. Akamai classes this
local access mode as a "silent agent" that carries no agent signature. As
Princeton professor Ed Felten notes, when the button click happens in the
browser on the user's own computer, it is technically very hard for the
remote website to tell whether a human finger or a local AI agent did it.
Relying on blocking alone is therefore hard to sustain, and websites that
over-block agents may end up losing business.
Figure 6 | Two paths for agent access, and the limits of authority
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading.* **Path 1: using the customer's logged-in browser
session.** Customer logs in and authorizes → agent uses the logged-in
session → website applies its checks and access rules. The agent's identity
and scope of authority are hard to identify independently; loss liability
depends on applicable law, the facts of authorization, and the contract.
**Path 2: accessing a controlled interface with an agent identity and a
scoped credential.** Customer sets permissions and approval rules → agent
presents its identity plus a scoped credential → controlled API or MCP
gateway verifies identity and permissions → financial read-only queries, or
retail checkout under permissions, limits, and confirmation rules.
Identity verification, permissions, limits, and confirmation rules together
constrain each operation.
Visa's Jabbara summed it up in the CNBC report. The history of the move
from PC internet shopping to mobile shopping shows, he said, that "none of
these innovations can truly scale until people build the foundational
security layer that can support trust at scale". The industry is pushing
toward standards for that foundational security layer along four technical
lines.
**First, "Know Your Agent (KYA)" and cryptographic signature protocols.**
Naveed Anwar, global head of AI, digital, and data platforms for Citi's
Services business, proposed at the Money20/20 conference in late October
that banking needs a KYA admission process like KYC (Know Your Customer).
At the protocol level, Akamai combined three layers of security standards
into an agent security framework in June 2026:
- **Web Bot Auth**, an IETF draft standard that Akamai supports. It lets AI
agents sign web requests cryptographically, so that sites can verify
where a request really comes from.
- **The Visa Trusted Agent Protocol.** It uses cryptographic signatures at
the payment step, letting merchants tell whether an agent is browsing or
paying, and binds the agent to the real consumer it represents.
- **Identity layers** such as Skyfire's KYA and Experian Agent Trust, which
bind the agent to a verified organization or individual.
Meanwhile Billions Network, which has more than 2.5 million verified users,
launched the DeepTrust (KYA) framework, based on zero-knowledge proofs
(ZKP) and decentralized identifiers (DID). On July 14, 2026, the Linux
Foundation announced the formal launch of the x402 Foundation, with Visa,
Mastercard, Stripe, Google, and others as founding members, to advance an
open, HTTP-based payment protocol.
**Second, open cross-platform standards for commerce and personal agents.**
On October 6, 2026, Sierra, the company led by Bret Taylor and Clay Bavor,
and Meta put forward an open standard, the *Personal Agent Protocol*, with
partners including Walmart, Stripe, Shopify, Instinct, Genesys, Rocket,
NiCE, and Decagon. They have published a draft specification for feedback.
It covers user sign-in and authentication, and two-way permission control.
Consumers decide what access to grant an agent, and businesses get
visibility into what the agent does on their websites, APIs, or
customer-service systems. Meanwhile, on October 15 Google formally launched
Universal Cart in US Search (including AI Mode) and the Gemini app, built
on the Universal Commerce Protocol (UCP), with Canada and Australia planned
for the following year. It supports adding items across retailers and
tracking price drops and restocks. Checkout goes through Google Pay or back
to the merchant's own cart, and merchants expressly keep their status as
"Seller of Record".
**Third, wider use of the Model Context Protocol (MCP), and separating read
and write permissions.** The schemes Walmart and Charles Schwab have
announced both use structured interfaces such as MCP, moving agent access
from operating web pages to controlled tool calls. Schwab proposes to give
outside large language models a controlled query channel through an MCP
server. They could view balances and do research, but fund transfers would
be restricted. Its native assistant, Charley, offers information queries,
operating guidance, and some account-management functions. Such interfaces
need security controls of their own: Google's MCP Toolbox had a
server-side request forgery vulnerability, fixed in version 1.5.0. Security
experts, such as Dan Moore of FusionAuth and Chris Jacob of Securonix, warn
that transaction history in a read-only interface can still expose highly
sensitive information: a user's employer, income, travel, and medical
spending. Read-only access must therefore be paired with short-lived
"scoped credentials", a separate agent identity, and human "step-up
confirmation" of high-risk operations, to build defense in depth.
**Fourth, client-side browser guardrails and per-endpoint policies.** At
the device layer, Google has built protections into the Chrome browser.
They stop AI agents from reading the password store directly. Before an
agent navigates to a sensitive site such as a bank, or carries out a
substantive payment, Chrome forces a pause and requires a human to confirm.
1Password provides a credential-injection mechanism for Claude that fills
user-approved passwords directly into the target web page while keeping
them isolated from the model. Anthropic's guidance for Claude in Chrome
prohibits stock trading and the management of financial accounts, and by
default asks the user's permission before visiting financial websites. On
the server side, Akamai recommends that merchants adopt a "Selective
Action" policy endpoint by endpoint. Catalog and search-discovery endpoints
stay open to keep customer traffic. Transaction-settlement and
authentication endpoints get strict automated scoring and cryptographic
signature verification [note 26].
Figure 7 | Controlled access: identity, authorization, transaction credentials, and where things stand
Chart from the original post, in Chinese. DCC's English reading follows.
*DCC's English reading* (Walmart's two-tier mechanism and industry progress
to November 1, 2026). **01 Two access paths** (terms published October 21,
2026): ordinary web or app agents need the user to review and confirm before
every checkout, and fully automated checkout is prohibited; the **Walmart
Agent Gateway** (invited Beta announced) is for invited businesses and
developers and plans to connect to Walmart's assistant Sparky through MCP or
a similar protocol. **02 Turning authorization into enforceable controls:**
(1) customer control through *Agent Profiles* (planned for November 2026),
with a separate profile showing agent orders, a choice of per-order human
approval or a spending cap of $50/$100/$200, and deletion of the profile to
revoke authority; (2) identity and delegation proof, with certified
registered agents receiving an agent credential or scoped access token and
submitting a signed agent mandate (customer instruction + timestamp + proof
of consent); (3) short-lived tokens bound to merchant + cart + amount +
session, a new token for each transaction, consumed at checkout and not
reusable; (4) isolation of payment and purchase history, so agents get no
card information and cannot add or change payment methods, and the gateway
helps find regular purchases without sharing full history. A deployer is
bound by the terms when three conditions all hold: deployment for a
business purpose + actual or constructive knowledge of the terms + a link
such as commercial benefit or data processing. Akamai's endpoint tiering
(a recommendation): catalog and search stay open; authentication and
checkout get automated scoring plus signature verification. **03 Proposals
at different stages:** Web Bot Auth (IETF draft); Personal Agent Protocol
(public draft October 6, 2026, open for feedback); Schwab MCP read-only
access (planned: balance queries and research, with fund transfers
restricted); Google Universal Cart (live in US Search and Gemini from
October 15, 2026, with Canada and Australia planned for 2027); S.5051 and
S.5576 (bills).
### Finally: how the core institutions compare on outside AI agents' access, policy and technique
The table below summarizes, as of November 1, 2026, how the main banks,
brokerages, retailers, and consumer-service platforms in the reporting
treat Meta Muse and other outside personal AI agents. It sets out their
specific access policies, technical means of enforcement, core aims, and
in-house alternatives.
| Sector | Institution | Stance on outside AI agents | Technical means and rules | Core aims and executive or official statements | Own AI alternative or ecosystem partnership |
|---|---|---|---|---|---|
| Banking and brokerage | JPMorgan Chase | Blocks outside agents acting for customers and moving funds; supports customer-authorized open-banking read-only data sharing. | Refuses any third-party agent (such as Muse, Instinct) that tries to log in with a customer's online-banking credentials; renewed a data-access agreement with Plaid, including a pricing structure, in September 2025. | CEO Jamie Dimon warns of "thousands of rogue agents"; CFO Jeremy Barnum cautions that sharing credentials exposes customers to losses from agent actions. | Targeted pilot of the cash-management tool Smart Cash, moving funds between checking and higher-yield brokerage products; AI cash-flow forecasting named as a future direction. |
| Banking and brokerage | Charles Schwab | Blocks outside agents from moving client funds; plans controlled read-only access via an MCP server. | Blocks outside AI agents' requests to act for clients "tens and twenties" of times a week and stops them moving funds; proposes an MCP server letting outside LLMs view balances and do research. | CEO Rick Wurster says neither the firm nor the client can control outside agents: "If something goes wrong, who is responsible?" | Steers clients to its native AI assistant Charley (announced September 30, phased in from October) for information and some account management. |
| Banking and brokerage | Morgan Stanley | Blocks all third-party AI agent access to the platform. | Blocks outside AI agents from its systems entirely (a spokesperson said no malicious or rogue agent activity had been seen on its own platform). | Guards against account errors, fraud, and potential client losses. | Keeps internal, controlled platform tools; no access for unauthorized outside agents. |
| Banking and brokerage | Bank of America / Citi / Wells Fargo / PNC | Restrict outside agents, isolate read-only access, and revise authorization and liability terms. | BofA emailed customers urging them not to share passwords with AI agents; Citi cut every agent connection except existing open banking; Wells Fargo revised its agreement, effective November 24, so the customer bears responsibility for agent actions, subject to legal exceptions. | Citi's Naveed Anwar calls for a "Know Your Agent" (KYA) process; PNC's CEO says agent transactions with no human review will "never happen". | Citi is embedding banking services in enterprise ERP systems such as SAP and Oracle; BofA plans to double its AI budget next year for internal build. |
| General and vertical retail | Amazon | Explicitly restricts outside shopping agents; has asked Meta to remove Amazon from the Muse experience. | robots.txt bars ChatGPT, Claude, Perplexity, and Google shopping crawlers; since September 20 blocks Muse (and Grok Bot and Dots) under its Conditions of Use, with pop-up warnings to users. | Says third-party buy-for-me apps should operate openly and respect merchants' decisions on participation, and accuses Muse of not identifying itself and apparently storing credentials; industry analysis ties the restriction to its roughly $70 billion ad business. | Promotes Alexa for Shopping (over 400 million users, 50% higher spend per order, linked to CPC ad prompts), Shop Direct (250 million outside products), and its own cross-site Buy for Me. |
| General and vertical retail | Walmart / Sam's Club | Opens its digital storefront with tiered access rules. | Published Agentic Access Terms on October 21 (binding agent, customer, and deployer); announced Agent Profiles for November (limits such as $50, $100, or $200) and a Walmart Agent Gateway built on MCP or similar protocols; isolates payment card data. | CEO John Furner pledges "we price products, not people": agents see the same prices as people, with discounts and fees shown before purchase. | Official integrations with Meta Muse, ChatGPT, and Gemini; co-developing the open Personal Agent Protocol with Meta, Stripe, Sierra, and others. |
| General and vertical retail | Shopify / Best Buy / Sephora / Wayfair / QVC | Partner and open checkout to agents. | Shopify supports merchant agent checkout for Muse through Shop Pay; Best Buy, Sephora, Wayfair, Gap (case by case), and QVC/HSN integrate with Muse or push catalogs. | Revenue tied to transactions and merchant services (Shopify's merchant solutions revenue is about 2.33% of GMV), or a need for outside AI entry points to widen reach. | Connect to Meta Muse's connector ecosystem, Stripe Link single-use virtual cards, and PayPal checkout. |
| General and vertical retail | Kohl's / Neiman Marcus / eBay / Chewy | Explicitly restrict or specifically block agents. | Billions Network's audit confirms Kohl's and Neiman Marcus explicitly restrict AI agents; eBay's agreement bars unpermitted LLM buy-for-me bots; Chewy's rules specifically block Amazon's bots. | Keep direct control of checkout, customer relationships, and data; guard against automated transactions without human review. | Public rules verified by Billions as of September 2, 2026 show no dedicated path for verified agents. |
| Fashion, home, and luxury resale | Tapestry / Williams-Sonoma / The RealReal | Allow browsing (or give guidance) but block or tighten checkout. | Pottery Barn, West Elm, and Williams-Sonoma publish llms.txt to guide browsing but block checkout; Tapestry allows browsing but not checkout; The RealReal hardened defenses to block Muse. | Stop agents using cart-hold features to lock up scarce stock (Muse once used The RealReal's 20-minute hold for hours). | Tapestry is rebuilding its checkout so it could support agents if it changes course. |
| Airlines and local services | Delta / United / Yelp | Restrict unpermitted automated access; manage access through data licensing. | Delta requires express written permission for automated access and reserves the right to refuse third-party agents; United cites terms barring automated tools that monitor or copy the site, or other unauthorized uses, without written permission; Yelp provides content and functions to partners through data licenses and APIs. | Airlines restrict unpermitted automation on safety and customer-experience grounds; Yelp treats data licensing as a revenue channel in the AI ecosystem. | Access conditions are set by the airlines' authorization rules and by Yelp's data licenses and API permissions. |
In sum, the industry split laid out by CNBC and *The Wall Street Journal*
on November 1, 2026 shows how platform access is settling now that personal
AI agents such as Meta Muse have gathered tens of millions of users in a
short time. Two main paths are forming. One is the "Approved Integrations"
model, which keeps oversight and commercial interests through official
partnerships and controlled gateways. The other is the "Independent Agent"
that operates websites directly on the customer's behalf. In the short
term, the giants that hold core financial accounts and valuable on-site
advertising shelves, such as JPMorgan Chase and Amazon, will keep strict
access limits. They will do so to avoid the risks of identity spoofing and
overreach, and to protect existing business models. Over the longer run,
verifiable agent identity (KYA), secure MCP gateways, fine-grained
human-approval guardrails, and supporting legislation will gradually
mature. As they do, the focus of competition is shifting. The question is
no longer "can we technically block AI agents?" It is becoming "can we,
while keeping customers' assets safe and under their control, build
trustworthy interfaces for machine interaction, and new commercial
arrangements suited to the way AI chooses products?"
## DCC commentary: why it matters for China's standard
*This section is DCC's, not the author's.* The drafting group has not said
how this research will shape *Security Requirements for Data Processing by
AI Agents*, and DCC has not seen a draft. But the problems the first
installment puts forward line up with the questions the same account's
[PrivacyLib essay](/posts/agent-pi-boundaries-meta-privacylib/) raised two
days earlier from the PIPL side:
- Can a platform tell who an agent is and whom it acts for?
- Is authority scoped to a task, a merchant, an amount, and a session?
- Are reading and acting treated as different risks?
- Who bears the loss when an agent misreads or oversteps?
China already has a policy hook for these questions. The May 2026
[Implementation Opinions on the Standardized Application and Innovative Development of AI Agents](/laws/ai-agent-standardization-innovation-opinion/)
separate three kinds of matters: those reserved to the user, those
requiring the user's authorization, and those an agent may decide on its
own. They say an agent's actions may not exceed the scope of the user's
authorization (Item 6). They also call for agent identity systems and for
tiered governance, with filing and testing in sensitive fields and key
industries.
Counsel advising agent builders or platforms in China should expect the
standard to address agent identity, scoped and revocable authorization, and
separate treatment of read and write access. That is a forecast from the
drafters' framing and the Opinions, not a description of the standard's
text.
## Notes
*The original's notes and references, translated. Source titles are given
as the author gives them; links are as in the original.*
1. CNBC (November 1, 2026), "For JPMorgan, Amazon, fighting AI bots like
Meta Muse may not be a winning long-term strategy",
https://www.cnbc.com/2026/11/01/jpmorgan-amazon-ai-agents-meta-muse.html;
and *The Wall Street Journal* (November 1, 2026, by Isabella Simonetti
and Suzanne Vranica), "The Shopping Bots Are Coming for Amazon",
https://www.wsj.com/tech/the-shopping-bots-are-coming-for-amazon-701caa57.
2. Meta formally launched the personal AI agent Muse in the US on September
8, 2026, later extending it to Canada. About six weeks after launch, more
than 10 million users in the US and Canada had created personal agents,
used for tasks such as cross-platform price comparison, automatic
ordering, finding high-yield savings accounts, negotiating bills, and
canceling redundant subscriptions in bulk. See CNBC (September 27, 2026),
"Meta Muse AI personal agent",
https://www.cnbc.com/2026/09/27/meta-muse-ai-personal-agent.html; and
BigGo Finance (October 2026), "Meta's Muse Hits 10 Million Users as
Retailers and Banks Push Back on AI Agents",
https://finance.biggo.com/news/6097f0af-89c7-4a2a-b7f4-bce8c229a287.
3. On the split between JPMorgan, Charles Schwab, Morgan Stanley, Amazon,
Neiman Marcus, and Kohl's restricting outside AI agents, Amazon asking
Meta to remove it from the Muse experience, and Walmart, Shopify, and
Best Buy choosing open partnership, see CNBC (November 1, 2026); Dealroom
(October 19, 2026),
https://dealroom.co/news/163856-banks-and-retailers-start-blocking-ai-shopping-agents-including-metas-mu/;
and Walmart's official announcement (October 21, 2026).
4. On "silent agents" borrowing human credentials to simulate sessions, risk
systems' difficulty in telling legitimate agents from malicious
crawlers, and the "liability transfer" problem at financial
institutions, see the Akamai security blog (October 26, 2026), "Silent
Agents Are Already on Your Site",
https://www.akamai.com/blog/ai/silent-agents-are-already-on-your-site;
CNBC (October 13, 2026); and TechNewsWorld (October 27, 2026).
5. On AI shopping agents being called "an ad blocker with a credit card",
and financial analysis of the size of Amazon's 2025 advertising business
(about $68.6 billion per the company's annual report; that Sponsored
Products make up about two-thirds is an industry estimate), see Business
Model Analyst (October 4, 2026), "Amazon Won't Let Your AI Agent Shop.
The Ads Are Why",
https://businessmodelanalyst.com/amazon-blocks-ai-shopping-agents-ad-revenue/;
and Amazon's 2025 annual report,
https://www.sec.gov/Archives/edgar/data/1018724/000101872426000004/amzn-20251231.htm.
6. On AI agents lowering depositors' switching costs, and Slok's September
27, 2026 comparison of the average checking rate of about 0.1% with
yields of 3.3% to 5.0% on some high-yield accounts, see CNBC (September
27, October 13, and November 1, 2026), quoting SharpLink CEO Joseph
Chalom and Apollo chief economist Torsten Slok. Apollo's original
analysis:
https://www.apollo.com/wealth/insights-news/insights/daily-spark/is-an-agentic-bank-run-coming.
7. Billions Network's audit of the public access rules (robots.txt
directives and terms of service) of 51 large US online retailers
(conducted August 2026, data verified to September 2, 2026, published
October 9, 2026): Billions Network blog, "How top US retailers are
responding to AI shopping agents",
https://billions.network/blog/us-retailers-ai-shopping-agents-audit.
Public dataset:
https://docs.google.com/spreadsheets/d/1GGKIqoj-jqd2e-0SK9CdV3-rMO_pFsFbKj8CMHYNsSI/view.
8. Accenture ran its Future of Banking Experience Survey in October 2025,
with 10,000 respondents: 82% want to approve every action in
AI-assisted banking interactions, 79% want a one-click pause, 71%
welcome an AI assistant embedded in their main bank's app, and 65% are
willing to use a financial assistant through a generative AI platform
or digital wallet. See *Banking Top Trends 2026*, p. 20,
https://www.accenture.com/content/dam/accenture/final/industry/banking/document/Banking-Top-Trends-FY26-Report-Final.pdf.
NMI's shopping survey of 1,000 US adults found that 10% are willing to
hand over full control of a purchase, 70% want to be able to review or
override the AI's decision before buying, and 3% see AI as a personal
shopper managing the whole shopping journey. See its research
announcement of August 26, 2026,
https://www.nmi.com/about-us/news/nmi-research-consumers-want-ai-to-help-them-shop-not-control-their-spending/.
9. On the major institutions developing their own assistants and
cash-management tools (Amazon's Alexa for Shopping, JPMorgan's Smart
Cash, Charles Schwab's Charley) and using paid data interfaces (JPMorgan
charging Plaid) or controlled connection protocols (MCP servers and
read-only access), see CNBC (October 13 and November 1, 2026), The Next
Web (October 16, 2026), and Business Model Analyst (October 4, 2026).
10. On Akamai's *State of the Internet* report (published July 2026: of
global AI bot traffic from July to December 2025, 47.9% was
concentrated in the commerce and retail vertical, and over 90% was
monitor-only) and the September 2025 agreement between JPMorgan and
Plaid charging for data access, see Akamai (October 26, 2026) and CNBC
(November 1, 2026). Akamai original:
https://www.akamai.com/blog/ai/silent-agents-are-already-on-your-site;
JPMorgan–Plaid renewal announcement:
https://www.jpmorganchase.com/newsroom/press-releases/2025/jpmc-plaid-renewed-data-access-agreement.
11. On Amazon's suit against Perplexity's agentic browser Comet (filed
November 2025; preliminary injunction granted March 2026; injunction
vacated by the Ninth Circuit on August 4, 2026; rehearing denied
September 10; on September 21 Amazon kept its CFAA and California-law
claims and added a claim for interference with contractual relations)
and eBay's user-agreement update of January 20, 2026 (effective
February 20), see the Ninth Circuit's opinion,
https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf;
the September 21 amended complaint,
https://storage.courtlistener.com/recap/gov.uscourts.cand.459191/gov.uscourts.cand.459191.122.0.pdf;
and eBay's user agreement,
https://www.ebay.com/help/policies/member-behavior-policies/user-agreement?id=4259.
12. On Meta Muse's technical architecture (the separate cloud virtual
machine Muse Secure VM, the built-in cloud browser, Muse Spark 1.3, the
Muse Wonder and Muse Wonder Full models released October 12 and their
availability by channel, and the Active Memory and Active Focus
mechanisms), the Connectors ecosystem, Stripe Link (supporting about
200 AI agents, with single-use virtual card numbers) and the PayPal
integration, US subscription pricing (Power $20 a month, Maximum $100 a
month), and Oppenheimer's annual revenue estimate, see Grenade.tw
(October 13, 2026), https://grenade.tw/blog/muse-meta-ai-agent/; and
FourWeekMBA (October 19, 2026),
https://fourweekmba.com/ai-metas-muse-hit-5m-at-record-pace-amazon-jpmorgan-bar-it/.
Meta's model release and connector documentation:
https://about.fb.com/news/2026/10/introducing-muse-wonder-models/;
https://www.meta.com/help/superintelligence/1687253048996149/. Stripe's
payment flow:
https://stripe.com/newsroom/news/stripe-helps-meta-muse-shop-with-link.
13. On Meta Muse's early growth figures (No. 1 on the US App Store in 10
days; more than 5 million US downloads in 22 days; more than 10 million
US and Canadian users creating agents in six weeks; more than a quarter
of weekly active users using shopping, with average related purchases
above $200; 43% of consumers comfortable with AI managing
subscriptions; a user's account of expected savings of $1,920 over 24
months after negotiating an AT&T fiber bill) and the effect on the
share prices of Meta and of financial and OTA stocks, see CNBC
(September 23 and 27, 2026), FourWeekMBA, BigGo Finance, and
Grenade.tw. Meta's earnings-call remarks:
https://stockanalysis.com/stocks/meta/transcripts/718643-q3-2026/.
14. On Amazon's block of Meta Muse on September 20, 2026, the statements of
Amazon spokesperson Lara Hendrickson, and the hardware (Muse Charm,
Ray-Ban audio glasses, Meta VR glasses) and official retail partners
(Walmart, Shopify, Best Buy, Gap, Sephora, Wayfair) announced at Meta
Connect 2026 (September 23), see CNBC (September 23, 2026),
https://www.cnbc.com/2026/09/23/metas-standoff-with-amazon-over-muse-comes-ahead-of-meta-connect.html;
Pasquale Pillitteri News; and NotebookCheck.
15. On the public statements of JPMorgan CEO Jamie Dimon (October 13),
Charles Schwab CEO Rick Wurster (October 16), RBC CEO Dave McKay
(October 20), and PNC CEO Bill Demchak (remarks October 19, reported
October 21) about stopping outside AI agents from moving money, and
about risk and liability, see CNBC (October 13, 2026),
https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html;
Mashable; FourWeekMBA; Dealroom; and Banking Dive.
16. On *Axios* senior AI reporter Madison Mills's October 22, 2026
investigation of unauthorized third-party agents in banks' back
offices; the banks' "day after" contingency plans; XMTP Labs CEO Shane
Mac's account of Grok Bot sending a personal financial report to a
management Slack channel by mistake; and the responses of Morgan
Stanley, Citi, Bank of America (a warning email to customers around
October 29), and Wells Fargo (revised agent authorization and liability
terms effective November 24), see CBS News (October 23, 2026),
https://www.cbsnews.com/news/ai-agents-customer-bank-accounts-security/;
Cybernews (October 23, 2026),
https://cybernews.com/ai-news/banks-blocking-ai-agents/; ZDNet (October
29, 2026),
https://www.zdnet.com/innovation/bank-of-america-customers-no-sharing-passwords-ai-agents/;
and CMMedia (信传媒, October 27, 2026).
17. On Amazon's third-quarter 2026 results, the secured vendor financing
arrangement of up to about $80 billion, and CEO Andy Jassy's remarks on
outside shopping agents and Alexa for Shopping on the October 29
earnings call, see Inc. (October 30, 2026),
https://www.inc.com/jason-aten/amazon-just-said-ai-agents-dont-hurt-its-ad-business-so-why-did-it-block-muse/91428840
and
https://www.inc.com/aaron-mok/amazon-ceo-andy-jassy-says-ai-shopping-agents-have-at-least-2-problems-right-now/91428454;
the Stock Analysis call transcript,
https://stockanalysis.com/stocks/amzn/transcripts/720308-q3-2026/;
Amazon's earnings release,
https://ir.aboutamazon.com/news-release/news-release-details/2026/Amazon-com-Announces-Third-Quarter-Results/default.aspx;
and its third-quarter 2026 Form 10-Q,
https://www.sec.gov/Archives/edgar/data/1018724/000101872426000040/amzn-20260930.htm.
18. On the results of Billions Network's five-way classification of 51 US
retailers (5 explicitly restrict, 37 block incidentally, none has a
verified-agent checkout path; Pottery Barn, West Elm, and
Williams-Sonoma publish llms.txt); the specific rules of Tapestry, The
RealReal (the 20-minute cart-hold loophole), and Chewy; and Coupang's
restriction on in-app payment and Naver's on Plus Store product search
and blog and community content, see the Billions Network audit report
(October 9, 2026); Business Model Analyst; and Korea Economic TV's
original report of October 1, 2026,
https://www.wowtv.co.kr/NewsCenter/News/Read?articleId=A202610010130.
19. On the *Walmart Agentic Access Terms* published on October 21, 2026
(Sections 1–14 and Appendix 1, defining the responsibilities of three
parties: Agent, Authorizing Customer, and Deployer), the MCP-based
Walmart Agent Gateway, the Agent Profiles due in November 2026 (with
spending limits such as $50, $100, or $200), and CEO John Furner's
pledge "We price products, not people", see Walmart's official
announcement,
https://corporate.walmart.com/news/2026/10/Making-It-Possible-for-Agents-to-Shop-on-Behalf-of-Customers;
the text of the Agentic Access Terms,
https://www.walmart.com/help/article/walmart-agentic-access-terms/d048fc229d7549738d7c05a4317e24d7;
and The Next Web,
https://thenextweb.com/news/walmart-ai-agents-shop-agent-profiles.
20. On Amazon's 2025 advertising and retail-segment financials (advertising
revenue about $68.6 billion; combined North America and International
operating income about $34.4 billion; with the two segments' combined
net sales as the denominator, advertising revenue about 11.67% and
operating margin about 5.84%), compared with Walmart (fiscal 2026
global advertising revenue about $6.4 billion, including VIZIO),
Shopify (2025 total revenue $11.6 billion, merchant solutions revenue
$8.8 billion, GMV $378.4 billion, merchant solutions revenue equal to
about 2.33% of GMV), and QVC Group's bankruptcy reorganization figures,
see Amazon's 2025 annual report,
https://www.sec.gov/Archives/edgar/data/1018724/000101872426000004/amzn-20251231.htm;
Walmart's fiscal 2026 earnings release,
https://stock.walmart.com/sec-filings/all-sec-filings/content/0000104169-26-000032/earningsreleasefy26q4.htm;
Shopify's 2025 annual report,
https://www.sec.gov/Archives/edgar/data/1594805/000159480526000007/shop-20251231.htm;
and QVC Group's reorganization announcement of July 15, 2026,
https://investors.qvcgrp.com/investors/sec-filings/all-sec-filings/content/0001355096-26-000024/pressreleasedatedjuly152026.htm.
21. On Amazon's lineup of in-house AI shopping tools (Alexa for Shopping:
more than 400 million users, interactions up 570% year on year, 50%
higher US spend per order, linked CPC ad prompts; Shop Direct: more
than 250 million outside products; Buy for Me: cross-site buying for
the customer) and the comments of Adverio's Mike Danford, Paul Graham,
Chris McCabe, F. Flax, and McKinsey (which estimates that by 2030
agent-driven revenue in global B2C retail of physical goods could reach
$3 trillion to $5 trillion, about $900 billion to $1 trillion of it in
the US), see CNBC (November 1, 2026); Inc. (October 30, 2026); Livemint
(October 30, 2026); Amazon's official guide to its shopping tools,
https://www.aboutamazon.com/news/retail/how-to-use-amazon-shopping-ai-assistant;
and McKinsey's original report,
https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-agentic-commerce-opportunity-how-ai-agents-are-ushering-in-a-new-era-for-consumers-and-merchants.
22. On the analysis by Michael Jabbara, Visa's head of payment ecosystem
risk and control, of AI-agent fraud risks (fake agents stealing
credentials; a legitimate agent buying a sofa by mistake; an agent
hacking a gym's scheduling system and deleting another person's
booking to get a slot), and the comments of security experts at
Acalvio, DataVisor, and elsewhere, see CNBC (November 1, 2026) and
TechNewsWorld (October 27, 2026),
https://www.technewsworld.com/story/banks-restrict-ai-agents-amid-customer-account-security-concerns-180699.html.
OpenAI's incident review, published in August 2026:
https://openai.com/index/hugging-face-incident-and-the-road-ahead/.
23. On banking's "liability transfer" mechanism, JPMorgan CFO Jeremy
Barnum's statement, Section 15 of Wells Fargo's new agreement effective
November 24, 2026, and the rules on authorization, gross negligence,
and loss allocation under US Regulation E and German payments law, see
the Wells Fargo agreement,
https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/;
Regulation E § 1005.2 and its official interpretation,
https://www.consumerfinance.gov/rules-policy/regulations/1005/2/; and
German Civil Code § 675v,
https://www.gesetze-im-internet.de/bgb/__675v.html, and § 675w,
https://www.gesetze-im-internet.de/bgb/__675w.html.
24. On the analysis by Wharton professor Ethan Mollick and Princeton
professor Ed Felten of "agentic flooding" and its customer-service DDoS
effect, and the comments of Nikhil Behl, president of FICO's software
business, on AI agents dissolving traditional brand loyalty, see CNBC
(November 1, 2026).
25. On the exchange between Senators Bernie Sanders (calling to "Pause AI
NOW!"), Adam Schiff, and Mark Warner (the AI AGENT Act discussion draft
and formal bill S.5051; the Artificial Intelligence Risk Management and
Safety Act of 2026, S.5576) and White House AI Czar David Sacks (who
argues for distinguishing user-authorized agents from cyberattacks, and
for "read-only" APIs), see Benzinga (October 23, 2026),
https://www.benzinga.com/markets/tech/26/10/62552760/sanders-schiff-rogue-ai-agents-bank;
the text of S.5051,
https://www.govinfo.gov/content/pkg/BILLS-119s5051is/html/BILLS-119s5051is.htm;
the text of S.5576,
https://www.govinfo.gov/content/pkg/BILLS-119s5576is/html/BILLS-119s5576is.htm;
CFO Dive (October 27, 2026); and CBS News.
26. On next-generation standards for agent security and commercial
interaction, including Citi's proposed KYA (Know Your Agent) process,
the framework in which Akamai combines Web Bot Auth and the Visa Trusted
Agent Protocol, the *Personal Agent Protocol* from Sierra and Meta,
Google's UCP-based Universal Cart, Charles Schwab's MCP server, and the
client-side credential protections of Google Chrome and 1Password, see
Akamai (October 26, 2026); Space and Story (October 27, 2026),
https://spaceandstory.co/blog/what-ai-shopping-agents-mean-for-your-website;
Banking Dive,
https://www.bankingdive.com/news/citi-takes-cautious-approach-ai-agent-access/833849/;
and CMMedia. Primary protocol and product documentation:
https://personalagentprotocol.org/docs/introduction;
https://blog.google/products-and-platforms/products/shopping/universal-cart-launch/;
https://1password.com/press/2026/july/1password-for-claude;
https://blog.google/security/architecting-security-for-agentic/;
https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely.
---
— *网安寻路人, 个人AI代理访问规则分化与平台商业博弈：从Meta Muse崛起看银行与零售巨头的规则重塑
(Diverging Access Rules for Personal AI Agents and the Platforms' Commercial
Contest: How Banks and Retail Giants Are Rewriting the Rules as Meta Muse
Rises), November 2, 2026. Full translation by DCC; the opening list of the
account's earlier posts is omitted.
[Original (Chinese).](https://mp.weixin.qq.com/s/krn7JgKObwJOE4EpX6Z3BQ)*
*Figures, quotations, and US facts are as compiled by the original author
from public reporting; DCC has not independently verified them.*
— Not legal advice.
