Who Is Underwriting Your Agent When It Is Wrong

Who Is Underwriting Your Agent When It Is Wrong AI September 30, 2026 10 min /ai/who-is-underwriting-your-agent/ In one week Amazon blocked Meta's Muse at the door and OpenAI shipped Dots, an AI assistant with its own computer. Six companies launched the same product. Here is the money behind it, the data on who will trust it with a wallet, and the one thing none of them has offered: to pay when it is wrong.

Two facts, eight days apart.

On September 21, Amazon blocked Meta's new agent, Muse, from its store. Shoppers who sent Muse to buy something on Amazon got a popup instead: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use."¹ On September 29, OpenAI shipped Dots, an assistant that runs around the clock on its own computer in the cloud, with its own web browser and connections to more than 4,000 apps.² That same week Muse was the number one app in the US App Store, ahead of ChatGPT.³

Everyone is building the same thing, and the biggest store on the internet does not want it inside. The short version of this piece: the launches are about money, not about you; the stores have their own reason to fight them; people will let these agents look but not spend; and the first company to promise to pay when its agent buys the wrong thing is, I think, the one that ends up leading. The rest is the evidence.

The idea is identical everywhere. Software that has a name and a memory, runs on a computer of its own (usually one the company rents for it), logs into your email, calendar and shopping accounts, and keeps working while you sleep. A chatbot answers a question. An agent finishes the job.

OpenClaw set the shape. Peter Steinberger released it as a hobby project last November and it became one of the fastest-growing open source projects ever recorded, with 280,000 developers bookmarking it on GitHub by March.⁴ OpenAI hired him in February. Microsoft built its own always-on assistant, Scout, directly on OpenClaw in June.⁵ The corporate versions took the same idea and moved it off your laptop into a computer they control. OpenClaw also showed the downside: thousands of people ran it with no security at all, and some of the extensions they installed turned out to steal passwords and cryptocurrency.⁶

So the demand was visible by spring. What explains six launches landing in the same summer is the money.

ChatGPT has about 900 million weekly users and about 50 million who pay.⁷ That is roughly one paying user in eighteen, and of those who pay, only 59% are still paying a year later.⁸ Google's Gemini crossed a billion monthly users in August and Google would not say how many pay; outside estimates say two or three in a hundred.⁹

Now divide the money by the people. ChatGPT earns roughly $28 per user per year, and closer to $17 if you count only what consumers pay. Gemini earns about $1.60 per user per year from subscriptions. Meta earns about $67 per person per year from ads, and about $310 in the US and Canada.¹⁰

Chat is not dying. It earns too little per person: a billion people use it and it makes a fraction of what an ad-supported social network makes from each of them. OpenAI's own answer is ads, with a reported internal plan for $100 billion of ad revenue by 2030.¹¹

Then there is the bill. The four biggest cloud companies have told investors they will spend around $700 billion this year on data centers and chips.¹² Meta's cash left over after paying for everything fell to $784 million in the June quarter, from $10.9 billion two years earlier.¹³ On that earnings call Zuckerberg told investors that "consumer personal agents will be an extremely important market" and that Meta would "ship something soon."¹⁴ Muse shipped six weeks later. OpenAI, meanwhile, cut its planned data-center buildout by more than half,¹⁵ and both OpenAI and Anthropic are reported to be preparing to go public.

Put those together and the logic is simple. The spending is enormous, a chat subscription cannot pay for it, and a company about to go public needs a story about where the money will come from. An agent that acts on your behalf is that story. OpenClaw proved the product; the money explains the timing.

Zuckerberg said the business model out loud the day after Muse launched: "This is going to make so much money for people that the business model is to effectively just take a very small cut."¹⁶ A small cut of every purchase (payments people call it a take rate) sounds modest until you do the arithmetic. Bain expects agents to handle or steer $300 to $500 billion of US retail by 2030; McKinsey says $1 trillion.¹⁷ Assume the cut is 2%. On Bain's range that is $6 to $10 billion a year, which is real money and still nowhere near enough to pay for the data centers, which is why the second prize below matters more. The per-household view is what makes it attractive: a $20 monthly subscription is $240 a year, the same $240 as a 2% cut on $12,000 of shopping you hand to the agent (an illustrative number), and the cut needs no subscription at all. Each purchase is still a choice, though, and that turns out to matter, as the next section shows.

What made this credible in 2026, rather than a slide, is one line on one chart.

In March 2025, shoppers who arrived at a store's website from an AI assistant bought 38% less often than everyone else. By March 2026 they bought 42% more often, and by May, 54% more often.¹⁸ Part of that is who shows up: someone who already asked a chatbot what to buy arrives knowing what they want. But it turned "AI sends shoppers" from a theory into a measurable path from recommendation to sale, and every take-rate pitch I have seen leans on it.

The second prize is quieter. Altman described the ideal product last year as one with a memory big enough that "you put your whole life into" it.¹⁹ Meta says Muse "consolidates its reflections into memory." Axios named it precisely: the battle to become your personal agent "is also a battle to become the keeper of your personal information and data."²⁰ A subscription can be cancelled in a click. A year of accumulated memory cannot, which makes it the stickiest thing any of these companies sells. Block's Buzz is the exception: each agent carries an identity it owns and can take elsewhere, which no company controls.²¹

Here is the part the launch coverage skipped. OpenAI ran this experiment a year ago, and buying inside the agent did not work.

Instant Checkout launched in September 2025 with Stripe. It let you buy without leaving ChatGPT, and it charged Shopify merchants 4% of each sale, pitched as cheaper than the 8 to 15% Amazon takes from sellers.²² By March 2026 OpenAI had quietly given up on in-chat checkout and started sending shoppers back to the retailer's own app. Roughly a dozen merchants had signed up, out of Shopify's millions. Shoppers who started a purchase inside ChatGPT finished it at roughly a third the rate they did on walmart.com, and Etsy was paying OpenAI's commissions itself to keep the program alive.²³ Forrester called usage "low and stagnant" from launch to shutdown.

That squares with the chart above. AI sends people to stores, and those people buy. They do not buy inside the agent. Visa's own data puts agent-driven purchases below 1% of US online sales, and its invite-only test had processed "hundreds" of transactions as of December.²⁴ The widely quoted claim that AI "influenced" 20% of Cyber Week shopping counts a chatbot recommending a sweater that a human then bought.²⁵

And the store has a vote. Amazon sued Perplexity over its shopping agent, lost at the federal appeals court in August (the court said the user, not the AI company, is the one visiting Amazon), and blocked Muse anyway under its own terms of use.²⁶ Amazon's stated reasons were that Muse does not identify itself, stores logins, and skips Amazon's own recommendations. The same month, Amazon put its advertisers inside ChatGPT. Amazon will let an agent recommend. It has not agreed to let one buy.

That last reason, skipping the recommendations, is the one I keep coming back to, because it points at a problem with agent shopping that has nothing to do with trust. Today a purchase goes: I decide I need something, I browse, I find other things, I buy. With an agent it goes: I decide, the agent finds the best match, I buy. Ask an agent for running shoes under $120 and it may find the perfect pair and check out. Efficient, no doubt. But what happened to the socks, the jacket and the water bottle I would have found along the way? I go into Costco for one thing and leave with seven, and it is the same on Amazon. That wandering is where stores make their money. A 2013 McKinsey estimate, repeated ever since and never confirmed by Amazon, put 35% of Amazon's sales down to its "customers also bought" recommendations, many of them paid placements.⁴¹ An agent that buys exactly what you asked for skips all of that, and moves whatever discovery survives to whoever runs the agent, which is what Amazon was buying back when it put its advertisers inside ChatGPT. So the measure that matters for agent commerce is not conversion. It is what I would call serendipity revenue, the things you bought that you did not come for. I think the coming fight is between the shopper's agent, optimizing for exactly what we want, and the store's agent, working out how to show us what we did not know we wanted. Amazon blocking Muse is the first round.

Will people trust these things with an inbox and a credit card? The surveys are unusually consistent, and the answer has two halves.

Between 74% and 85% of people say they would let an agent search, compare and manage things for them. Between 7% and 24% say they would let it spend money without asking first.²⁷ Five surveys are in the chart; three others say the same. That gap is 40 to 60 points wide, and it did not narrow between early 2025 and mid 2026 even as the share of people using AI to shop roughly tripled. One outlier, Adyen, reports 51% willing to let AI complete purchases; it is the only study that high and it comes from a payments company.²⁸

Ask who people would trust with their passwords for an agent, allowing more than one answer, and the ranking is Google 30%, Apple 23%, OpenAI 16%, Meta 8%. Fifty-eight percent said none of them.²⁹ The two that shipped consumer agents this month rank last. Visa's own survey found 61% would trust Visa to handle an agent's payments against 23% for an AI company.³⁰

Behavior matches the surveys. Among people who already use agents, 36% have connected their email and 20% have connected a financial account.³¹ And the deal-breaker is sharp: 60% of UK consumers say they would stop using an agent after a single mistake.³² Muse's first public mistake arrived on September 29. Asked to sell an item on Facebook Marketplace, it accepted a lowball offer, sent the seller's home address to the buyer and told him the seller was home.³³

Which raises the question none of the launch keynotes answered. When it is wrong, who pays?

Every launch this quarter answered the trust question with engineering: a walled-off computer, substitute credentials so the agent never sees your password, a confirm-before-buying prompt, spending rules. I have spent a career building systems that hold other people's data, and in my experience engineering alone has not been what changed people's behavior. History says something else did.

Three things stand out.³⁴ First, the guarantee came before the habit. In 2001, 55% of Americans who did not shop online said fear of fraud was the reason, while fewer than 1% had ever experienced it. Fear was near universal and harm near zero, and what closed the gap was a promise that someone else would eat the loss. Second, even with the promise, the habit took a decade. Third, a guarantee is necessary but not sufficient. Alexa had Amazon's card, Amazon's store and zero friction, and voice shopping still died, because you could not see what you were buying. Mint went the other way: no guarantee at all, and millions of people handed over their bank passwords, because the value was concrete and the app could only look, never act. The failure mode for agents is not fraud. It is "that is not what I meant." Muse's Marketplace incident was exactly that.

Now look at where the guarantee stands today. The federal rule that caps your loss at $50 applies to transactions you did not authorize. If you authorize an agent and it buys the wrong thing, that is an authorized transaction, and the rule does not help you. The Consumer Bankers Association warned in January that handing your logins to an AI tool could shift the loss entirely onto you.³⁵ Amex is the only card company that has committed, in writing, to cover wrong purchases made by registered agents.³⁶ Visa and Mastercard are testing one-time card numbers with a spending limit, with no public promise about errors. Six large banks published principles on September 22 that amount to "whoever caused the error pays," with no timetable.³⁷ The chairman of the FTC said on September 25 that an agent is a tool, and "the man who wielded the hammer ought to suffer the consequences," meaning the person who used it.³⁸ Merchants, asked who should pay when an agent buys wrong, say the AI company, 93% of them.²⁴

So the engineering is well ahead of the guarantee. That is the reverse of how every precedent in the table that involved spending was built. Mint shows the line people actually draw: looking versus acting. They will hand over logins so something can look. Spending is where they stop, and no agent maker has promised to cover it.

The labs are betting that memory and habit will pile up faster than mistakes wear trust down. Nothing in the data proves that yet. On TheAgentCompany, a test of 175 simulated office tasks, the best agent finishes about half.³⁹ An agent that reads your inbox can be hijacked by text in an email that it mistakes for a command, and OpenAI has said that problem "may never be completely eliminated."⁴⁰

My bet is different from theirs. Underwriting the agent's mistakes, and being the first to do it, is what will decide this race. Not the model, not the walled-off computer, not the number of connected apps. The company that says "if it buys the wrong thing, we pay" is the one people will hand a card to. Today no agent ships with that sentence attached. Amex has the promise and no agent; the labs have the agents and no promise. And a lab earning $17 a year per user cannot easily insure $12,000 a year of that user's spending, while card networks have priced exactly that risk for fifty years, which is why I expect the guarantee to come from a payments company, or from a lab that partners with one. Watch for the first mainstream agent that launches with a written guarantee, because that is the day this market actually starts.

Until then, the practical advice is the line people are already drawing on their own. Connect the inbox if the value is real to you. Keep the card out of it. And before you connect anything, ask the simple questions: where does my memory live, can I read and edit it, does it come with me if I leave, and when it is wrong, who pays?