The Future Of The Internet Isn't Open For Your Agent. Muse, Dots And Claude Duet Will Find Out.

We've got more AI assistants offering to run our lives than ever before. We've got Dots, we've got Muse, we've got Grockbot, we've got Duet, we've got Instinct. They want to book your flights, they want to buy your stuff, they want to manage your accounts. And this month, the websites they need to get into got a real good reason to get more strict with agents, not less. Black October has showed us how much easier AI makes breaking into websites. So, here's what I think happens next. I don't think you get one open internet for your agent anytime soon. I'm sorry. You're going to get a world of uneven access. Some doors open, some doors shut, and a smarter model isn't going to be able to unlock that door that a business has decided to close. Let me show you who's doing the deciding about our internet, how you can think about picking an agent that is going to be best for you. I want to tell you how I divide my own work across agents. What do I do in this wild, fragmented, wild west of a world? How do I assign agents work? And I'm going to go agent by agent across my whole setup.

Number one, Grockbot gets tougher coding and build jobs for me where I can use communication between bots, which Grockbot excels at. If several pieces of the build depend on each other, I don't want to have to relay every discovery between workers. And that coordination part is fantastic with Grockbot. And it just works, right? Like you can tell chief of staff, which I have for my Grockbot, get this done. and it will just work with a bunch of bots to get it done. With dots, I love the context I have in codecs. I can push it hard with that background and coordinate across calendars and emails. It is not super fast, but starting over is something that I don't have to do anymore, right? It just knows the projects. It knows the decisions. It knows what's changed. And that accumulated context is part of what makes an agent choice matter. Instinct, which as of this recording is raising again, I think at a $30 billion valuation. They are very, very leaned in on the travel use case for better or worse. And I do travel. I do get on the plane a lot. And one of the things that I really value is that Instinct makes it easy to text on the go. It has this nice autonomous check-in function that it operates on. It can do a lot of deep diving on destinations and understanding how to sort of visit the destination and not just be an ordinary tourist. It's tons of fun. So for that particular use case, Instinct is great. I use Muse for tons of preliminary shopping and scoping. I'm already looking at holiday stuff. So doing holiday gifting and shopping as well and for bookings, right? Like if I want a restaurant for a

date night, if I want a yoga class, things like that. And sometimes I want choices and sometimes I just want to get it done. And Muse handles both of those really well. Muse knows my yoga class login and can just take care of that on the go. Muse can also through the link partnership with Stripe just buy at a bunch of websites which is handy for gifts and so I love that aspect. I think the non-technical friendliness of Muse is fantastic. Duet from Anthropic is brand new and I'm still figuring it out but I love how smart it is. In fact, it's one of those things where within the first day or two it was proactive with me. It reminded me of something that I didn't realize was coming up and that I needed to think about ahead of time. So it was already a lifesaver and I'm really really thankful for it. Uh and that is one of the things with duet with dots and also to a lesser extent with muse but dots and duet both very very strong at proactively telling you something that call it 50 to 75% of the time you're like oh wow I did need to know that it's not 100% yet but the proactivity when it hits hits really well. Like I've seen cases where I was traveling and I had accidentally had a flight double booking. In this case, it was before Duet came out. Dots is the one that caught that and was like, "Hey, you have a double booking. Great. Thank you. I canceled it. I got money back."

Like, it was nice. And so, there's really concrete stuff if you start to let it be proactive that it starts to actually bring value back. But I also want to say, as much as I've shared with you all the stuff I do for my own agents and kind of which personal agents I'm using for what, I am the weird one, right? I'm the one that is saying I use Duet. I also use Dots. I also use Muse. I also use Grockbot. I also use Instinct. Normal people don't do that. Normal people pick one. Normal people are going to pick one and say this is the one that I want to use and stick with. And I think the jury is out on who that's going to be. But I would look to differentiate how this works at work and how this works with consumers. I think Muse is absolutely on track to lean in on the consumer side. Grockbot and Duet and Dots all are leaned in on the proumer and work side right now. But of course with Chat GPT's scale, it's relatively easy to imagine Dots leaning into consumer in the future. My agent can plan a trip perfectly and still get stopped at a hotel booking page and kind of freeze. And that's very uneven. It depends on the particular hotel, etc. A smarter agent does not solve that problem. That hotel booking page locked out agents. that changes which businesses are going to get my money because I have to figure out how to shop with my agent as much as I figure out how to shop with me now. Now, in my recent Black October piece, I looked at weaknesses that had survived for years

that AI is only just now exposing. So, the PHP research I discussed describes how AI is helping researchers develop and adapt working exploits across applications very, very quickly. And unfortunately, not just researchers, but attackers. Part of the old protection for the internet was the sheer obscurity, the sheer difficulty of figuring out how to exploit flaws. AI has reduced that difficulty toward zero. Notforg's investigation showed attackers using agents to coordinate work and share discoveries and keep on trying with lots of intrusions documented. And they're not the only ones. There's been a pile of research on this. Businesses facing this now have to handle software doing legitimate AI agent work and software applying similar persistence to breaking in. And businesses have reasons to ask much more questions about who has authorization to do what. I think that the most clear example of this in the last week or two has been the banks in the US that have made headlines by saying AI agents are all over our websites and we don't know what to do about it. And the problem is really simple. They don't know if it's an enthusiast like me who wants the agent to use computer use on the website and look at a bank or if it's an enthusiast who is a bad actor who is using an agent maliciously to gain unauthorized access.

How do you know? How do you know? So banks don't have the technical teams by and large to understand the sophistication of agent behavior and in fact that's not just a knock on banks. It is very difficult as a first principles problem to distinguish agent-driven computer use from human computer use. They are by definition similar extremely similar. And so one of the big open questions right now is how we think about understanding human authorization in a world where agents and humans can look very very similar. Now let's look at what we want out of our agents a little bit. Let's look at what we want from dots, from Muse, from Grockbot, from other personal assistants. You hand over the job. The software works through websites and services to get that job done. And if you're doing that job well, the more you delegate, the more often a business encounters your software, your agent instead of you. Blocking all of that is going to block the work customers want done. Whether that's browsing, whether that's shopping, whether that's planning, whether that's email, whether that's calendar, whether that is paying.

If I want to say, "Please get my kids homework plan figured out with the school and get it done or please answer and calendar all of the school events for my kids in the next six months." Those are also equally agentic tasks. Same problem occurs all the way through the recipient website, the website that has the information, the website that has my kids homework information from their teacher, the website that has the calendar of school events, the website that has the hotel and travel information, all of it is being used by an agent. And does the website understand that? Are they able to respond to that appropriately? Can they distinguish that appropriately? Does it look like an attack if it's done at scale? Maybe I'm not the only one who's going to the school and getting all the events done. Maybe a bunch of other tech people are like, "We're gonna hammer this and make sure this happens." And it suddenly looks like a giant influx of traffic. And we have actually seen that in reality, not at school districts, but with restaurants. And so you have this whole reservation market developing that is a second order function of agents going after reservations for people. And this is at root an authorization question. If I told my assistant to do a job, the hotel, the school, the restaurant, they need to know whether they're dealing with an authorized customer. The payment provider, if money changes hands, needs to know what is allowed to be charged. The AI assistant needs to protect my account from

malicious attacks that might try to redirect it. And so, anything that's completed depends on all of those decisions agreeing together. And that brings me to a really interesting agreement that came out in the last week or two. On October 20th, Visa, Bill, and Bill Trust announce a live invoice payment pilot where a buyer approves a supplier's bill and Bill's agent completes the payment through the supplers's portal using a service called Bill Trust. The agent is registered, payment credentials get controlled according to the buyer's instructions, and the receiving system recognizes the agent and grants access. The payment is then formally tied to the invoice and has visibility all the way through approval and completion. This reminds me a lot of how Stripe is thinking about the link solution. I've talked with Stripe before. I've done that on this channel as well. They're thinking a lot about how you handle payment and wallet authorization for consumers. This is an example that's more B2B oriented, right?

How you think about it from a business payment perspective. We're going to see a bunch of solutions like this. solutions that essentially are partnerships that allow authorized agents to do authorized purchases of high value or high consideration items. But we can go a step further back too. Even recognizing the visitor takes infrastructure. We talked about the importance of recognizing agents just earlier in this video. Cloudflare's signed agent system lets the infrastructure sending a request attach a digital signature. Cloudflare can verify and the website can set rules for agent traffic. Recognition gives the business some evidence about where the request came from and the business still has to decide whether that visitor can read a price or see a reservation or cancel the res reservation. And those are all permissions that businesses are starting to set. I suspect we're going to start to see norms around this. We're going to start to see packages or solutions that businesses can install that give them permissioning here that's very simple and non-technical to use.

But this is the direction we're going where businesses are going to have to decide rules of the road for agents. This can have concerning second order effects. One of the interesting leaks out of Black October is that Claude ended up in some instances leaking human email addresses when asked to do so by businesses that had encoded instructions in their website saying, "Agents, please identify yourself." And you know, Claude wants to be helpful. Claude identified itself as an agent. But that inadvertently led to a leak of PII. And so businesses also need to recognize that when they're asking for this, they need to do so in a responsible way to avoid making a difficult security situation even worse. Another player here is Google's agent payments protocol or a. It describes how you handle signed records for instructions and for purchases. Stripe shared payment tokens are a very similar solution and they're really focused on making sure that you are able to let payment credentials carry restrictions such as only for a particular seller, only for a particular amount limit, only until a particular expiration time. And so it's important to understand as we evolve these regimes that we don't yet have a full schema for rules of the road that everybody agrees on for agents. So when you hear these different protocols, what you're hearing is basically really smart people trying to say this is how we think we should structure guard rails for the agent

economy. And we're going to have to see how the market moves to see what ends up being adopted. If there's a winner take all or winner take most system or if we're going to end up in a world that's a little bit fragmented where some people are going to be on Google's system and some people are going to be on Stripe system and we're just going to have to kind of patchwork our way through. It's not clear yet. This is a little bit of the wild west here. And because it's the wild west, that introduces complexities for businesses as well. Right? Because if you want to say you support agents, what do you mean? Right? One service might recognize the sender but still need proof of a particular instruction for that agent. It might allow research but stop at payment. Others are going to allow a particular kind of payment authorization but not a different kind of payment authorization. And so, unfortunately, businesses are going to need to be a little more sophisticated right now. They need to understand when they're unlocking agents what exactly they're unlocking. And as I like to say on this channel, there is no substitute for a little bit of technical depth. And you can use AI to help you get there. You can use AI to dive in on what this looks like. And in my companion piece on Substack for this, I do talk about what these different protocols are in more detail so you can understand what is the current state of play. and I'll have a prompt that you can feed to your agent as well so that you can dig in deeper.

The other piece that needs to change is the information that businesses need to provide. Take the hotel example from a trip. You want to stay near the meeting. You want to arrive late. You want to be able to cancel if your plans change. Your agent assistant needs to compare those requirements against what hotels actually offer. And a hotel with a beautiful homepage and big images can still make it really, really difficult to find the cancellation terms for a particular room. And often they do. And so businesses are going to need to change what they define as a good quality website pretty quickly here. I actually thought that uh Patrick Collison from Stripe had a really good reflection when he wrote on X a week or two ago that netn net net he thinks that the pressure of the agentic economy is a pressure toward product excellence. Agents are not fooled by jazzy marketing that influences humans and they demand really good products and so he thinks if more of us are using these agents we are going to be raising the product bar and demanding higher quality products. We'll see how that works out, but certainly there's a pressure on businesses to change how they present product information in ways that they may not be used to. And Shopify's October 28 expansion shows this starting to happen in retail. Merchants can review and publish facts that are specifically for agents, including return windows and shipping destinations. Shopify also describes shop pay inside Muse, inside

Claude Duet, inside Instinct and names Grockbot among the assistants offering it for brands outside Shopify. So information, decisioning, checkout are increasingly coming together inside an assistant that you may already be using. So if you're a merchant, being considered by that assistant is now part of a distribution strategy. And so for you, a request like find something that arrives before Friday and can be returned, which is very much a holiday request these days, that becomes much easier to delegate with a degree of trust. The merchants's actual policies are going to be translated to the agent, and better reasoning is going to enable you to grab that with the agent you've got and bring it back with a confidence that you can get a package that arrives on time. At least that's the hope. We're about to all live through whether that works through this holiday season. It's really the first agent holiday shopping season. And what I tend to notice is that businesses are of course acting in their own best interests when they're trying to figure out how to negotiate this world. And so Shopify, roughly a challenger brand in the retail space, is incentivized to lean in on the agentic future to partner with Muse and others.

Whereas Amazon, not a challenger brand on the internet at all, is incentivized to not do so. And I've talked about the fact that Amazon said decided to say no to agents. I still find that frustrating. And Walmart decided to say yes. Shopify decided to say yes. We're about to see the implications of that strategy play out in real time this holiday season. If we are in a world where businesses are trying to figure out how to act in their own interests in a new and evolving marketplace, we have a fragmented series of different regimes for coordinating businesses, consumers, and their agents. And we have a fragmented number of agents. We're in a series of many to many marketplace problems. There are many agents to one person potentially. There are many agents to one business. There are many businesses to a particular agent. It's just a very complicated scenario. In that world, I want to suggest to you a framework you can take away and work with. The internet your assistant is going to encounter in 2027 is going to have three zones. In the partnership zone, the business is going to provide an accepted route for work. So, supported shop pay checkout is a great example. The invoice pilot is another example. Several competing assistants are going to be able to use that same infrastructure. So choosing one doesn't automatically shut you out of what businesses another can reach. So in the aspiring actor zone, an agent is going to work through an existing site trying to complete the sequence as a person would. Duet's browser for sites without

connector is a great example. It might finish. It might encounter a changed page, an account check, a step that needs you, or it might just not finish. An assistant can be good at this kind of navigation and still leave you with work, especially if businesses start telling agents to please not do this because agents want to be compliant and they will often listen to that. And then we have the no-go zone. In the no-go zone, the business is absolutely refusing the agent or the action. Amazon's dispute with Muse, which I covered back in September, is prime example of this. Amazon's objections have included undisclosed agent access, the absence of an agreement, credential handling. This is really a story about who gets to own the customer relationship. That's what's at root here. And it is going to be a heavy conflict across a number of fronts. Amazon versus Muse is just one example. Your desire to delegate as a consumer, and the destination business's conditions for accepting that delegation will remain in conflict in a number of high-profile sites for a while. And these are real internet zones. They are maybe not permanent categories, but they describe a series of experiences that we are all going to start to have. And if you're a business, importantly, they describe a series of stances that you can have toward agents in 2027. And it's going to be really really critical if you're a business to invest in the technical capability that will allow you to reliably differentiate between

desired access from agents and undesired access from agents. And since most companies lack that expertise internally, the companies that provide these kinds of authorized connections are about to gain a ton of power because both sides needs them. So businesses want protection, assistant companies want their products to finish the job. And I wrote about how infrastructure is gaining power on the internet back in May. This is more and more true as we head into 2027. And this is part of why I'm bullish on Google, on Stripe, on other large companies that are effectively to facilitate the agentic economy on the internet. We need trusted intermediaries and trusted brokers. In a sense, this reminds me of the problem that Amazon itself solved back in the 1990s when internet commerce was a very dangerous thing. Part of the thing that Amazon was known for was providing secure checkout and you got what you paid for. And that seems like a solved problem on the internet now, but I promise you for a long time it wasn't.

And part of what led to this tremendous influx of volume and value into Amazon over the years is that Amazon was one of the first to do that. Built up a muscle memory for people knowing they could trust a transaction at Amazon. And now here we are. We are in that beginning 1990s phase again with agents and people are figuring out what agent can I trust? Where can that agent go on the web? And how do I know that agent has trusted access? And ironically, businesses are in the same boat. What agent can I trust? Can I give that agent trusted access? The people who can provide that protocol in the middle who take security requirements seriously are in a really good spot. And as we talk about solutions here, I think one of the things I want to celebrate is that we have some evidence that a number of companies are going for a more open direction that allows us to have common standards across the net, which I think would be good for everybody. So, Cloudflare, for instance, explicitly advocates open standards and independent choices of identity providers, payment processors, and agent partners. I think that's a super responsible approach. I think that helps us to set up an internet that's safer for everybody.

Shopify's developer expansion is somewhat similar. It opens up the catalog and checkout tools to other builders and extends work that it began in the spring. These companies are proposing ways for a bunch of different assistants to share access and that deserves to be assessed by how well we're able to build on those choices over the next 6 months to a year. But in general, I think it's the right approach. Now, we're all going to judge this much more concretely, right? If we go back to the hotel thing, we're going to judge it by whether I can check out on that hotel page. We're going to judge it by whether I can get those school events, whether I can get that reservation at the restaurant. For consumers, this is all going to be invisible. And I can't underline that enough. If you are trying something and you are just saying, "I want to try Muse. Uh, it's my first time trying Muse. I want to see if it works." If it has a mistake, you're not going to be very patient. You're probably not going to try it again after one or two times. My challenge to you, you, this is a sophisticated audience. This is an audience that has some influence over the way your friends and family use AI in your life. I would suggest that you think about when you choose to talk about AI agents with those around you and make sure that the use cases they're going to care about are actually use cases on the internet that your agent is equipped to handle. Are there passionate hobbies they have? Are there passionate things that they're going to care about this holiday season? If you're going to be talking about, "Hey, I used Muse to

get whatever it is that you got for them as a gift." Are they going to be like, "Oh my gosh, show me this. I want to do my holiday shopping with Muse. Well, you better make sure that it actually works. And that goes for Dot. It goes for Duet. It goes for Grockbot. It's the same conversation. Does this agent that you are using actually become an agent that someone who is less technical is able to use across the internet without thinking about it? We are just not at that point in 2026. and and critically until we get some of these open protocols worked out, we're not gonna be at that point. And I would argue that Black October set us back. It was predictable, but it set us back. It basically reset the security agenda for a bunch of companies around making sure that their websites are safe. And if you're trying to make sure that your websites are safe, figuring out if an agent can access it, I got to say it's not going to be at the top of a lot of people's lists. It's just not.

And this is even more true if your agent can be a source of risk to you as a consumer. Forever Security found a malicious agent instruction file in an end customer's downloads folder and says it stopped a coding agent from installing malware from there. The original delivery route is not something they could figure out, but researchers have demonstrated that a website can absolutely plant a file there based on poisoning an agent. And so that means that right now in the current internet world, you have to think about where you ask your agent to go on the net. You have to think about giving an agent a project folder whose contents you can keep an eye on and manage. And this gets at a degree of sophistication we can't really expect from consumers. I can't talk to my aunt at Thanksgiving and say, "No, no, no. The Asian age is here. You can trust it." and also recognize that like she may get poisoned with a virus or something because the agent ran across the wrong website. I have to change the way I talk about it and say use your agent for these use cases. This is where it's really good. This is where I recommend it. And right now I would say there's a few shopping websites that's really good at. There's some travel stuff that agents are really good at. If you're a sophisticated AI user, there's a ton you can do around knowledge work and coding that I spend a lot of time talking about on this channel. And then there's general conversation and general utility around your schedule and your email that are really good. Those are the big buckets.

And if you want to do something outside that, if especially if you want to do something on the broader internet, it's going to be a question mark. You're not going to know if it can be done. You're not going to know if your agent ran across a risky website. And these are things that you really ought to feel comfortable are safe if you want to roll this out to the wider world. We are right in the middle of that transition. By the end of 2027, it's going to be a very different world, but this is where we are now. So, I want to leave you now with a few takeaways. Number one, better or worse, like it or not, the internet is going to be more splintered next year. It's going to be splintered around how agents can access the internet. Number two, because that is happening, you have more and more power and influence for organizations that are setting up protocols that keep us safe, both as businesses and consumers. And I really hope they're open and I'm applauding all of the efforts from various actors who are trying to make these protocols more open. And we see efforts from Cloudflare on that, efforts from Google on that, efforts from Stripe on that. The more open these protocols are, the easier they are to engage with.

And then number three, I want you to think about how you frame and talk about agents in the internet to those who are less technical. This is a pretty technical channel. I want you to think about this Thanksgiving as you're talking with folks who are less technical. How do you talk about what agents can do in a way that's accessible and in a way that's going to give them a great experience? We already are in an environment where people are suspicious of AI who are less technical. Let's not make it worse. Let's actually talk about what agents can do well. And that's why I shared with you all of the things I use AI for in a very high degree of detail. We need that specificity to earn trust these days. All right, best of luck. Let me know which agents you're using and let me know how you're thinking about the agent business trust problem. It's one of the biggest problems on the internet today. Are you building it in that space? Put in the comment. If this is exciting to you, hit that subscribe button. I'm going to be here before you know it with another AI take.