The Agent Internet: Big Tech Built It Together — to Fight Over Your Front Door

An episode of Dan's AI Intel

The tech giants agreed to build the agent internet together — so they could fight over the one piece they kept: the front door to your life.

Published · Updated · By Dan Walter

Executive summary

The fiercest rivals in technology — Google, OpenAI, Microsoft, Anthropic, Amazon — just spent eighteen months quietly agreeing to build the next internet together, and then handed the most important pieces of it to neutral foundations they don't control. Google gave away its agent-to-agent protocol to the Linux Foundation. Anthropic gave away the Model Context Protocol — already running in everything from ChatGPT to Copilot — to a brand-new Agentic AI Foundation it co-founded with Block and, remarkably, OpenAI. The act of cooperation, not any single product launch, is the real signal of the agent era. When companies this competitive agree to standardize a layer, it is because that layer has become a commodity, and the war has moved somewhere else.

Where it moved is the point of the whole story. The protocols that let agents find each other, talk, and pay — A2A, MCP, AP2, the Agentic Commerce Protocol — are being deliberately commoditized and given away. The layers that are not being given away are the ones that decide who gets paid and who gets obeyed: the identity that proves an agent is yours, the cryptographic mandate that authorizes it to spend your money, the runtime that millions of agents live on, and above all the assistant that is the single front door through which you meet the agent world. The strategy across every giant is identical, and it is old: standardize the plumbing so nobody can lock you out, then own the chokepoint where attention and money actually change hands. The browser and the search box were the entry points of the web era; the personal AI assistant is being engineered, in public and at speed, to be the entry point of the agent era — and whoever owns it owns the relationship with the customer that everyone else now has to rent.

That is why this matters beyond enterprise IT. The same architecture that lets a corporate agent query a database is being wired directly into your wallet. Google's Agent Payments Protocol, launched in September 2025 with more than sixty partners including Mastercard, PayPal, Coinbase and American Express, exists to answer one question that the old web never had to ask: when a piece of software buys something while you are asleep, who is accountable? Its answer — a chain of cryptographically signed "mandates" proving you authorized the purchase — is quietly the most consequential design decision in commerce since the credit card, because it determines whether the agent era is one where you stay in control or one where control is delegated by default. The plumbing is open. The front door, your identity, and the liability for what your agents do in your name are not. The fight for the agentic substrate is a fight over those three things, and it is already underway.

Why a story about plumbing is really a story about power

It is fair to ask why anyone who isn't a backend engineer should care about agent protocols. The answer is that the AI revolution has reached the stage where the interesting action is no longer in the models. The frontier labs have spent three years racing to build smarter minds; the race now is to give those minds hands — the ability to act in the world, hold accounts, make decisions, and spend money without a human clicking every button. An agent that can only talk is a chatbot. An agent that can book your travel, reorder your groceries, negotiate with a merchant's agent and pay the bill is something else entirely, and it cannot exist without a shared set of rules for identity, communication and payment. That shared set of rules is the substrate. Building it is the unglamorous, decisive work of this moment in the revolution — the equivalent of laying TCP/IP and HTTP before anyone had heard of Amazon or Google.

And as with the early web, the people laying the pipes are not doing it for charity. Every protocol donation, every open standard, every "we're doing this for the ecosystem" blog post is also a positioning move in a contest to decide who sits at the center of the agent economy. Understanding that contest — what is being given away, what is being held back, and why — is the closest thing we have to a map of where power flows next. This report follows the money and the control, not the press releases. A note on language first: "agentic substrate" is not a single product anyone shipped. Google does sell something called Agent Substrate — a narrow Kubernetes infrastructure project announced in May 2026 for running agents densely — but the phrase as used in the wider conversation is shorthand for the whole foundational layer agents run on. That layer is real, it is being built by everyone at once, and no single company owns the term or the thing. That ambiguity is itself revealing: there is no king of the substrate yet, which is exactly why the fight is so fierce.

The giants are cooperating, and that is the tell

Start with the strangest fact, because it is the one that explains everything else. In April 2025 Google introduced Agent2Agent (A2A), a protocol that lets AI agents built by different vendors discover each other, advertise their capabilities through "agent cards," and securely collaborate on tasks. Two months later, at the Open Source Summit in June 2025, Google did something companies rarely do with a strategic asset: it gave A2A away, donating the specification, SDKs and tooling to the Linux Foundation, where it launched as a community project with AWS, Cisco, Microsoft, Salesforce, SAP and ServiceNow as founding members. More than a hundred companies now back it.

Then Anthropic went further. Its Model Context Protocol — the standard that lets a model plug into tools and data, which Anthropic launched in November 2024 and which the industry took to calling "the USB-C for AI" — had become genuinely ubiquitous. OpenAI adopted it in April 2025. Microsoft baked it into Copilot Studio. AWS added support. By early 2026, Anthropic reported more than ten thousand active public MCP servers and around ninety-seven million monthly SDK downloads. MCP had won. So on December 9, 2025, Anthropic gave it away too — donating MCP to a newly created Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI, and backed by Google, Microsoft, AWS, Cloudflare and Bloomberg. A company handing its most successful standard to a foundation that includes its single biggest rival is not a routine governance update. It is a statement that the standard is no longer where the advantage lives.

Why give away the crown jewels? Because the alternative is worse, and because of a specific economic logic worth spelling out. The cautionary tale every one of these companies has internalized is the messaging-app and smart-home fragmentation of the 2010s, where incompatible standards left everyone poorer and locked customers into walled gardens that never grew. If each lab shipped its own incompatible agent protocol, no agent could talk to any other, the network never forms, and the whole economy stalls before it starts. There is an old strategist's move underneath this: you commoditize your complement. An agent assistant is far more valuable when there are millions of agents and tools it can reach; the protocols that connect them are the assistant's complement, so making those protocols free, ubiquitous and owned by no rival makes your own assistant more valuable, not less. By donating the protocols to neutral foundations, the giants make them "Switzerland" — trustworthy enough that a rival will build on them — which is the only way the network reaches the scale that makes agents useful at all.

The clearest proof that this is strategy, not generosity, is the company list itself. OpenAI co-founded the very foundation that now stewards MCP — a protocol Anthropic, its fiercest competitor, created. AWS and Microsoft sit on the A2A board with Google. These are firms suing and poaching and out-launching each other weekly, and they have agreed to share the connective tissue of the agent web precisely because none of them can afford to let a rival own it, and none of them believes the tissue is where they'll win. The cooperation is real. It is also a coordinated decision about where not to compete, which tells you exactly where they intend to. You give away the layer you can't monopolize so the layer you can becomes worth more. The tell is not that they cooperated; it's which layers they agreed to share, and which they conspicuously kept.

The layers they kept are the layers that matter

Watch what stayed private. Three things did not get donated to any foundation, and they are not a coincidence.

The first is identity — the answer to "is this agent really acting for this human, and is it allowed to?" This is where Microsoft and Okta are racing. Microsoft shipped Entra Agent ID, extending its enterprise identity empire so that every agent gets a managed identity and acquires tokens through OAuth flows — including an on-behalf-of flow where the agent acts inside the signed-in user's context, and an autonomous flow for agents working unattended. Okta is positioning itself as the universal "agent IdP," the identity provider that lets any agent connect to any resource across its lifecycle. Identity is the most defensible layer in all of computing because it is the thing everything else has to check, and unlike a protocol it has natural lock-in: you do not casually re-issue every credential in your company. Whoever becomes the place agents prove who they are becomes a tollbooth on every action they take.

The second is payment authorization, and it is the most subtle. When a human clicks "buy" on a trusted website, the whole payment system assumes a person is present and consenting. Autonomous agents break that assumption completely, and Google's Agent Payments Protocol exists to name and fix the three gaps it opens: authorization (did the user really grant this agent authority for this purchase?), authenticity (does the agent's request reflect the user's true intent?), and accountability (who is liable when an agent buys the wrong thing, or is tricked into a fraudulent one?). AP2's answer is the "mandate": a tamper-proof, cryptographically signed contract backed by verifiable credentials. For a purchase you watch, you sign an Intent Mandate ("find me white running shoes") and then a Cart Mandate approving the exact items and price — an unchangeable record so what you see is what you pay. For a purchase you delegate, you sign the Intent Mandate up front with rules — "buy the concert tickets the moment they go on sale, up to this price" — and the agent generates the Cart Mandate itself when conditions are met. The chain from intent to cart to payment is a non-repudiable audit trail. Notice what that audit trail really does: it decides, in advance and in code, who is to blame. That is not a feature. That is the legal architecture of the agent economy being written by the company that controls the protocol.

AP2 is also deliberately payment-agnostic, and that breadth is part of the land-grab. It carries credit and debit cards, real-time bank transfers, and — through an extension called x402 built with Coinbase, the Ethereum Foundation and MetaMask — stablecoins and crypto rails for agent-to-agent payments, the kind of tiny, automated, machine-to-machine transactions that traditional card networks were never designed for. The reason that matters: when one agent pays another agent a fraction of a cent to perform a task, you need a settlement layer that doesn't choke on volume or fees, and whoever provides the default rail for the "machine economy" sits underneath an enormous share of future transactions. The same instinct shows in the rival camp's design. OpenAI and Stripe's Shared Payment Token solves the trust gap differently — a one-time, merchant-scoped credential that lets ChatGPT trigger a payment without ever exposing your card, with the merchant still accepting or declining the order, charging the card, calculating tax and fulfilling. Two camps, two answers to the same question — who is allowed to spend your money, and on what proof — both racing to make their answer the one merchants build against.

The third is the runtime and the assistant — where the agents actually live and where you actually meet them. Google's narrow Agent Substrate, announced May 2026, is a Kubernetes control plane built to run agents at extreme density: a warm pool allocating 300 sandboxes per second per cluster, ninety percent of allocations in 200 milliseconds, designed for "hundreds of millions of registered agents." Amazon, Microsoft and OpenAI all have their own runtimes and agent-building kits. But the runtime is plumbing too; the real prize sits on top of it. Which brings us to the only layer that ultimately matters to a normal person: the front door.

The front door is the whole war

Every layer below exists to serve one thing — the assistant that a human actually talks to. In the web era, the entry point was the browser and the search box, and owning it was worth a trillion dollars because it owned the moment of intent: the instant you decided you wanted something. In the agent era, that moment moves inside the assistant, and every giant is building theirs to be the place you start.

OpenAI has been most naked about it. At its DevDay in October 2025 it launched the Apps SDK, letting third-party services — Spotify, Canva, Zillow, Expedia, Booking.com — run inside ChatGPT, so you never leave. Sam Altman described turning ChatGPT into a kind of "chat OS." The ambition is explicit: make ChatGPT the operating system of the agent era, an app store woven into an assistant, the single surface through which you reach everything else. Microsoft frames the same ambition as the "open agentic web," unveiled by Satya Nadella at Build 2025, complete with NLWeb — pitched as "HTML for chat," a few lines of code to turn any website into a natural-language endpoint that both people and agents can query. Google's version is Gemini Enterprise and its Agentspace, the single destination where an organization's agents are built, found and governed.

Beneath the assistant sits a layer most people never see but every platform is racing to own: the registry — the directory of which agents and tools exist and can be trusted. Google built Agent Registry into Gemini Enterprise as the central catalog where an organization stores, discovers and governs its MCP servers, tools and agents, and tied it to the broader Agentic Resource Discovery network so registries can crawl and index the open web of capabilities like search engines. OpenAI shipped a Connector Registry inside AgentKit; the wider market already has the GPT Store, Claude Skills, MCP hubs and a dozen agent galleries. Registries are the app stores of the agent era, and app stores are where platforms set the rules and take the cut. Owning the directory means owning discovery — the modern equivalent of ranking first on Google — which is why every giant is building one and why standards like ARD, which would let agents discover capabilities without going through any single company's registry, are quietly a threat to exactly the chokepoint the registries are meant to create.

Here is the unresolved tension, and it is where the early evidence complicates the giants' dream. The platforms assumed they could disintermediate everyone — own discovery, own checkout, own the customer, and reduce every brand to a supplier feeding an assistant they don't control. But brands and retailers are fighting back, and consumers are giving them ammunition. Bain's research found shoppers trust a retailer's own agent roughly three times more than a third-party agent to actually complete a transaction. Walmart embedded its own assistant, Sparky, into the AI layer while keeping the basket, the customer data and the relationship inside Walmart. Sephora is doing the same — using AI inside platform environments while tying everything back to its own app and loyalty program. The likely outcome is not total disintermediation but a contested, blended world: some commerce flows through the big assistants, some stays inside brand-owned agents, and the fight over who owns the customer relationship — the single most valuable asset in business — is the real subtext of every "agentic commerce" announcement. The entry point is not yet won. That is precisely why everyone is sprinting.

What it looks like when it reaches you — and what could go wrong

Strip away the protocol acronyms and picture the experience. You tell your assistant you need running shoes under a hundred dollars by Friday. Behind the glass, your agent uses something like Google's new Agentic Resource Discovery — announced June 2026, essentially a robots.txt for agents, where any business publishes an ai-catalog.json at a known address on its domain and the domain itself becomes the proof of identity — to find merchants whose agents are open for business. Your agent talks to their agents over A2A, pulls product details through MCP, and assembles a cart. You glance at it and approve: that approval is an AP2 Cart Mandate, cryptographically signed, fixing the exact price. A Shared Payment Token — OpenAI and Stripe's mechanism in the Agentic Commerce Protocol, live since September 2025 in ChatGPT — passes a one-time, merchant-scoped credential so the shoe seller charges you without ever seeing your card. The shoes arrive Friday. You touched none of it after the first sentence.

That is the promised experience, and on a good day it is genuinely magical. Now consider the other days, because the same architecture that makes it magical makes it dangerous, and the experts building it are unusually blunt about this. The central, unsolved problem is the "confused deputy." An agent holds your authority — your tokens, your mandates, your access — and an attacker who can slip instructions into the agent's input can borrow that authority. This is not theoretical: in April 2026 Microsoft assigned CVE-2026-21520 to an indirect prompt-injection vulnerability in Copilot Studio, and security researchers noted how unusual it was to assign a formal vulnerability ID to a prompt injection at all — a sign the industry is only now treating these as real software flaws. The Coalition for Secure AI published a whitepaper in January 2026 mapping nearly forty distinct MCP threats; the 2026 "MCP Security Top 10" ranks unauthenticated access and confused-deputy attacks at the very top. The hard part, as one analysis put it, is that even after you fix identity, an agent can still be a confused deputy, because the tools it calls validate credentials, not intent. The mandate proves you said "buy shoes." It cannot prove you didn't mean for a hidden instruction on a malicious webpage to redirect the order. Identity and payment protocols are necessary and they are not sufficient, and everyone serious knows it.

This is the honest stakes of the agentic substrate. Done right, it is a layer that keeps you in control — every action traceable to a mandate you signed, every agent's authority scoped and revocable, accountability legible when something goes wrong. Done carelessly, it is a layer that delegates control by default, where convenience pressure pushes people to sign broad standing mandates they don't read, where the liability for a bad purchase is buried in a protocol spec, and where a single prompt injection can spend money in your name. The design choices being made now — by a handful of companies, mostly without public scrutiny — decide which world we get. That, far more than which assistant is smartest, is what is actually at stake.

Bottom line

The agentic substrate is being built the way the internet was: open standards at the bottom, fierce competition at the top. The giants have agreed to share the protocols — A2A, MCP, AP2, ACP, ARD — because a network only forms if everyone can join, and because the protocols were never where the money was. The money, and the power, are in the three layers they kept: the identity that proves an agent is yours, the payment mandate that authorizes it to spend, and the assistant that is the single front door to your life. Cooperation on the plumbing is not a truce; it is the clearest possible signal of how valuable the chokepoint above it has become.

For a normal person, the hinge to watch is not which model tops a benchmark. It is whether the default settings of these systems keep you in control — explicit, scoped, revocable mandates and clear accountability — or quietly trade that control for convenience. The forecasts disagree wildly on size: Gartner expects 20% of digital commerce to run through AI platforms or agents by 2030; Bain puts the US market at $300–500 billion; McKinsey's broadest definition reaches into the trillions. The numbers are noise. The signal is the architecture, and the architecture is being finalized right now. The companies wiring your wallet to your assistant have told us exactly what they're keeping. The question worth asking — of them, and of ourselves before we sign the first standing mandate — is whether the front door they're building opens only for us, or also for whoever learns to whisper to our agents.

Sources

Transcript

Sam: Okay, so the five companies that hate each other most in tech — Google, OpenAI, Microsoft, Anthropic, Amazon — quietly spent eighteen months agreeing to build the next internet together.

Alex: They did. And then they handed the most important pieces of it to neutral foundations they don't even control.

Sam: That's the part that breaks my brain. These people are suing and poaching each other every single week.

Alex: Right. So why would they cooperate? Because the tech giants agreed to build the agent internet together — so they could fight over the one piece they kept. The front door to your life.

Sam: Wait. The front door.

Alex: The front door. Hold that.

Sam: Welcome back to Dan's AI Intel — the show where we try to make sense of the fastest, most consequential shift any of us is likely to live through.

Alex: I'm Alex, here with Sam, and today we're getting into something that, on the surface, sounds like the most boring topic in technology. Plumbing. Protocols. The wiring that lets software talk to other software.

Sam: And it sounds boring right up until you realize it's about who gets to be the company that owns your relationship with everything.

Alex: That's the whole show. We make sense of this revolution because it's moving faster than anyone can follow, and the knowledge horizon is brutally short — what's settled this month is rewritten the next. So we try to find the questions that actually matter underneath the headlines.

Sam: And here's the trigger for today. A couple of months ago, Anthropic took its single most successful product — a standard the entire industry had adopted, including its biggest rival — and gave it away. For free. To a foundation it co-founded with that rival.

Alex: And that's not a one-off. Google did the same thing earlier. So the question I couldn't stop chewing on isn't "what did they donate." It's: why do the most competitive companies on earth suddenly agree to share something — and what does that tell you about where they've decided the real war is?

Sam: Because cooperation between these five is so weird it has to mean something.

Alex: It means everything. So we're going to travel from that strange act of generosity, down through the layers they very deliberately did not give away — your identity, your money, and the assistant you actually talk to — and we'll end somewhere genuinely uncomfortable, with the one flaw that even the people building this admit they haven't solved.

Sam: And there's a move almost every business is making in response to all this that I think is going to surprise people. We'll get there.

Alex: If you've been enjoying the show, follow us on Spotify or Apple Podcasts so you don't miss the next one.

Sam: Okay. So let's start with the obvious question I'd ask. Why should I — a normal person who is not a backend engineer — care even slightly about "agent protocols"?

Alex: Fair. And the honest answer is that the interesting action in AI has moved. For three years the race was to build a smarter mind — a model that knows more, reasons better.

Sam: The benchmark wars. Who's got the smartest chatbot.

Alex: Exactly. But a mind that can only talk is a chatbot. The race now is to give those minds hands.

Sam: Hands meaning... what, literally?

Alex: The ability to act in the world. Hold an account. Make a decision. Spend money — without a human clicking every single button. An agent that can only chat is one thing. An agent that can book your travel, reorder your groceries, haggle with a store's software and pay the bill — that's something else entirely.

Sam: And that can't just... happen. Something has to let all those pieces talk.

Alex: That's the key. It cannot exist without a shared set of rules — for how agents find each other, how they communicate, how they prove who they are, and how they pay. That shared set of rules is what people are calling the substrate. The foundation everything else stands on.

Sam: So it's the plumbing.

Alex: It's the plumbing. And here's the analogy I'd reach for. This moment is the equivalent of laying the basic pipes of the internet — the stuff with names like TCP/IP and HTTP — before anyone had heard of Amazon or Google.

Sam: Oh. So we're at the "before the famous companies existed" stage.

Alex: We're at exactly that stage. And think about what that means. Whoever laid those original pipes, and more importantly whoever figured out where to stand on top of them, captured the next thirty years.

Sam: Okay, that reframes it completely. It's boring the way owning the road into a city is boring.

Alex: That's a perfect way to put it. Nobody's excited about the road. Everybody wants the tollbooth.

Sam: And I'm guessing the people laying these pipes are not doing it out of the goodness of their hearts.

Alex: They are not. Every "we're doing this for the ecosystem" blog post is also a chess move. So the thing to do — and this is what we're doing today — is follow the money and the control, not the press releases.

Sam: One quick thing, because I've seen this word thrown around. Is "the substrate" an actual product someone shipped?

Alex: Good instinct to ask, because it's slippery. Google does sell one narrow thing literally called Agent Substrate — we'll come back to it. But the word as everyone uses it is shorthand for the whole foundational layer. And here's the tell: no single company owns the term, or the thing.

Sam: There's no king of the substrate.

Alex: There is no king of the substrate. Which is precisely why the fight is so vicious. Nobody's won it yet.

Sam: And just so I'm clear on the shape of it — when you say "the substrate," roughly how many pieces are we talking about? Is it one big standard or a stack?

Alex: It's a stack. Picture four jobs that have to happen for agents to be useful. They have to find each other. They have to talk to each other. They have to prove who they are. And they have to pay. Each of those has at least one protocol with its own little acronym fighting to be the standard.

Sam: So the "internet for agents" is really four mini-internets being built at once.

Alex: That's a great way to hold it. Four jobs, racing in parallel — and the giveaway versus keep pattern plays out across all four. That's the map. Let's follow it.

Sam: So we've established the action moved from smart minds to agents with hands, that the plumbing to connect them is the prize, and that nobody owns it yet. Which brings us back to the thing that started this whole conversation for me — these companies cooperating. That still feels backwards.

Alex: It feels backwards, and it's the single most important clue in the entire story. So let me lay out exactly what happened, because the sequence matters.

Sam: Go.

Alex: April 2025. Google introduces a protocol called Agent2Agent — A2A. It lets AI agents built by totally different companies discover each other, advertise what they can do through what they call "agent cards," and work together on a task.

Sam: So my agent can find and talk to your agent even though we built them differently.

Alex: Right. Now, two months later, here's the move. At an open-source summit in June 2025, Google gives A2A away. Donates the whole thing — the spec, the tools — to the Linux Foundation. A neutral non-profit. And it launches with Amazon, Microsoft, Salesforce, SAP, and others as founding members.

Sam: Hang on. Google built a strategic asset and just... handed it to a body that includes Amazon and Microsoft?

Alex: Handed it over. More than a hundred companies back it now.

Sam: That's strange but okay, maybe Google figured the protocol wasn't that valuable. What's the bigger one?

Alex: Anthropic. So Anthropic had this thing called the Model Context Protocol — MCP. It's the standard that lets a model plug into outside tools and data. The industry nickname for it tells you everything: they called it "the USB-C for AI."

Sam: The universal plug. The thing that makes everything connect to everything.

Alex: Exactly that. And it won. Completely. OpenAI — Anthropic's fiercest rival — adopted it. Microsoft baked it into its products. Amazon supported it. By early 2026, Anthropic's reporting more than ten thousand active public MCP servers and around ninety-seven million downloads a month.

Sam: So this is a runaway hit. It's the standard.

Alex: It's the standard. So what does Anthropic do with its runaway hit? In December 2025, it gives it away too. Donates MCP to a brand-new Agentic AI Foundation — which it co-founded with the payments company Block and, I want you to sit with this, with OpenAI.

Sam: No. They co-founded the foundation that now runs their own product with the competitor who's trying to destroy them?

Alex: With the competitor trying to destroy them. And it's backed by Google, Microsoft, Amazon, Cloudflare, Bloomberg.

Sam: Okay, I genuinely don't understand. Why would you give away the crown jewels? Like — that's the thing everyone's using. That's leverage. Why hand it to your enemy?

Alex: This is the heart of it, and there's a clean economic logic underneath. Let me give you the cautionary tale they've all internalized first. Think back to the 2010s — the messaging app and smart-home mess.

Sam: Where nothing worked with anything. My smart bulb wouldn't talk to my speaker, this messenger couldn't text that one.

Alex: Right. Incompatible standards. Everyone built a walled garden, and the gardens never grew because they couldn't connect. Everyone ended up poorer. So now imagine each AI lab ships its own incompatible agent protocol.

Sam: Then no agent can talk to any other agent. The network never forms.

Alex: The network never forms, and the whole agent economy stalls before it even starts. There's nothing to be the front door to.

Sam: Ah. So the giveaway is self-interested.

Alex: Deeply. And there's a name for the move — strategists call it "commoditize your complement." Here's the analogy. Think of a high-end coffee machine company. The most profitable thing it can do is make sure cheap, standardized coffee pods are everywhere, owned by nobody.

Sam: Because the machine is worth more when there are a million pods that fit it.

Alex: Right, and push it one step further. The protocols are the pods. Your assistant is the machine. An assistant is far more valuable when there are millions of agents and tools it can reach — so making the connectors free, universal, and owned by no rival makes your machine worth more, not less.

Sam: And by giving it to a neutral foundation, they make it... trustworthy. Switzerland.

Alex: That's the exact word people use. Switzerland. It has to be neutral, or your rival won't build on it, and you need your rival to build on it for the network to get big enough to matter.

Sam: So let me say the thing back, because I want to make sure I've got it. The cooperation isn't a truce. It's a coordinated decision about where not to compete.

Alex: And that is the whole insight. The tell isn't that they cooperated. The tell is which layers they agreed to share — and which ones they very pointedly kept for themselves. You give away the layer you can't monopolize, so the layer you can becomes worth a fortune.

Sam: So what did they keep? Because that's now the real question, isn't it. Forget what they donated. What did they refuse to let go of?

Alex: Three things. Three layers nobody donated to any foundation, and it is absolutely not a coincidence. Watch what stayed private.

Sam: Lay them out.

Alex: First one: identity.

Sam: Meaning — proving who the agent is?

Alex: Proving the agent is really acting for you, and is actually allowed to do what it's doing. "Is this agent really yours, and is it permitted to do this thing right now?" This is where Microsoft and a company called Okta are in a knife fight.

Sam: Why is identity such a big deal? It sounds like the least exciting one.

Alex: Because it's the most defensible layer in all of computing. Here's why. Identity is the thing everything else has to check. Every single action an agent takes, something somewhere asks "wait, who are you, and are you allowed?" And unlike a protocol, identity has natural lock-in.

Sam: Lock-in how?

Alex: Think about your work. You do not casually re-issue every login and credential for your entire company on a whim. Once you're the system that issues identity, ripping you out is agony.

Sam: So whoever becomes the place agents prove who they are...

Alex: ...becomes a tollbooth on every action those agents ever take. Microsoft shipped something called Entra Agent ID — basically extending its giant enterprise identity empire so every agent gets a managed identity. Okta's trying to be the universal identity provider for any agent, anywhere.

Sam: Okay, that's one. Identity. What's the second?

Alex: The second is the subtle one. Payment authorization. Who's allowed to spend your money, and on what proof.

Sam: This is the one that actually scares me a little. An agent with my credit card.

Alex: As it should. So here's the problem in plain terms. The entire payment system we have was built on one assumption: that a human being is present, looking at a screen, clicking "buy."

Sam: Right, there's a person there consenting.

Alex: An autonomous agent shatters that assumption completely. So Google built a thing called the Agent Payments Protocol — AP2 — launched September 2025 with over sixty partners. Mastercard, PayPal, Coinbase, American Express. And it exists to answer three questions the old web never had to ask.

Sam: Which are?

Alex: One — authorization: did you really give this agent the authority to make this purchase? Two — authenticity: does what the agent's asking for actually reflect what you wanted? And three — accountability: when an agent buys the wrong thing, or gets tricked into a fraudulent one, who is liable?

Sam: Who pays when the robot screws up. That's a real question.

Alex: It's the question. And AP2's answer is a thing called a "mandate." Think of it as a tamper-proof, cryptographically signed permission slip.

Sam: Okay, give me the running-shoes version. How does a mandate actually work?

Alex: Perfect. Two flavors. If it's a purchase you're watching, you sign what's called an Intent Mandate — "find me white running shoes" — and then a Cart Mandate that approves the exact items and the exact price. An unchangeable record. What you see is what you pay, locked in.

Sam: So the agent can't quietly swap in the more expensive shoes.

Alex: Can't. It's cryptographically fixed. Now the second flavor — a purchase you delegate. You sign the intent up front with rules: "buy the concert tickets the second they go on sale, up to this price." And then the agent generates the cart itself when the conditions hit, while you're asleep.

Sam: That's the magic and the terror in one sentence.

Alex: In one sentence. And here's the part I find genuinely profound. That chain — intent, to cart, to payment, all signed — is an audit trail. But notice what the audit trail really does. It decides, in advance and in code, who's to blame when something goes wrong.

Sam: Oh. So it's not really a payment feature. It's... a law. They're writing the liability law of the agent economy.

Alex: And here's where it goes further than even that. It's the legal architecture of the entire agent economy — being written by whichever company controls the protocol. That's not a checkout button. That's legislation, shipped as code.

Sam: That's a genuinely unsettling thought. The rules of who's responsible are being decided by Google's engineers, not by, you know, anyone we elected.

Alex: Mostly without public scrutiny, yeah. And one more wrinkle, because it shows the land-grab. AP2 is deliberately payment-agnostic. It carries cards, bank transfers, and — through an extension built with Coinbase and others — crypto and stablecoins.

Sam: Why does it need crypto? Cards work fine.

Alex: For a very specific new thing: agents paying other agents tiny amounts. Picture one piece of software paying another a fraction of a penny to do a little task. The old card networks were never built for a billion transactions worth half a cent each.

Sam: Whereas crypto rails can handle the machine-to-machine micro-stuff.

Alex: Right. And whoever provides the default rail for that "machine economy" sits underneath an enormous slice of every future transaction. Now — the other camp does this differently. OpenAI and Stripe built a "Shared Payment Token." A one-time, store-specific credential that lets ChatGPT trigger a payment without ever exposing your actual card.

Sam: So two camps, two answers, same question.

Alex: Same question — who's allowed to spend your money and on what proof — and both racing to make their answer the one every store builds against. Whoever wins that becomes the default.

Sam: Okay. Identity, payment. What's the third layer they kept?

Alex: The third is where the agents actually live, and where you actually meet them — the runtime, and the assistant on top of it. Remember that narrow Google product I said we'd come back to? The one literally called Agent Substrate?

Sam: Yeah.

Alex: It's a piece of infrastructure for running agents at insane density. The number that stuck with me: it's designed to spin up three hundred little agent sandboxes per second, per cluster, built for "hundreds of millions of registered agents."

Sam: Hundreds of millions. Of agents. That number is doing a lot of quiet work.

Alex: It tells you the scale they're planning for. But — and this is the pivot — the runtime is still plumbing. The real prize sits on top of it. Which brings us to the only layer that ends up mattering to a normal person.

Sam: The front door. You've been dangling it since the cold open.

Alex: The front door. Let's finally walk through it.

Sam: So before you do — let me try to connect it back, because we've covered a lot. The giants gave away the connectors. They kept three things: who the agent is, how it spends, and where it lives. And you're saying all three of those are really in service of one final thing.

Alex: That's the Russian-doll structure of the whole story, yeah. Every layer underneath exists to serve the assistant — the thing a human actually talks to. And here's the historical rhyme. In the web era, the entry point was the browser and the search box.

Sam: And owning the search box was worth, what, a trillion dollars?

Alex: More. Because it owned the moment of intent. The exact instant you decide you want something. That's the most valuable moment in all of commerce — and Google owned it.

Sam: And in the agent era, that moment moves...

Alex: Inside the assistant. The instant you say "I need running shoes" out loud to your AI, that's the moment of intent, and it now happens inside whoever's assistant you're talking to. So every giant is building theirs to be the place you start.

Sam: And someone's being unusually blunt about wanting that, I assume.

Alex: OpenAI. Almost naked about it. In October 2025 they launched something letting third-party services — Spotify, Canva, Zillow, Expedia — run inside ChatGPT. So you never leave.

Sam: Like apps inside the chat.

Alex: Sam Altman literally described it as turning ChatGPT into a kind of "chat operating system." An app store, woven into an assistant. The single surface you reach everything else through.

Sam: So ChatGPT wants to be the phone, basically. The thing all the other apps live inside.

Alex: That's the ambition, stated out loud. Microsoft frames the same goal as the "open agentic web" — they've got a thing pitched as "HTML for chat," a few lines of code to turn any website into something an agent can just talk to. And Google's version is a single destination where a company builds and governs all its agents.

Sam: They're all building the same front door, just with different branding.

Alex: Same door. And there's a layer just beneath it that almost nobody sees but everyone's racing to own: the registry.

Sam: Registry meaning... a list?

Alex: A directory. The catalog of which agents and tools exist, and which ones you can trust. Google built one right into its enterprise product — the central place a company stores and governs all its agents and tools. OpenAI shipped its own. And the wider market already has a dozen of these — agent galleries, skill libraries, the lot.

Sam: And here's the analogy that unlocked it for me — registries are the app stores of the agent era.

Alex: And that's the trap exactly. App stores are where the platform sets the rules and takes its thirty percent. Owning the directory means owning discovery — which is the modern version of ranking first on Google. If you're not in the registry, or you're buried in it, you don't exist.

Sam: So that's another quiet chokepoint. But wait — doesn't that cut against everything we just said? They gave away the protocol that lets agents find each other. Doesn't open discovery undercut their own private registry?

Alex: You've just spotted the live tension. There's an emerging standard that would let agents discover capabilities out on the open web — directly, without ever going through any one company's registry. And that standard is quietly a threat to exactly the chokepoint the registries are built to be.

Sam: So even within one company you've got the "give it away" instinct fighting the "own the tollbooth" instinct.

Alex: In the same building, on the same week. That contradiction is the whole industry in miniature.

Sam: So now I'm picturing this totally locked-up world where five companies own every door and every directory and take a cut of everything. Is that where this lands?

Alex: And here — this is the surprise I promised — here's where the early evidence complicates the giants' dream. Because they assumed they could cut everyone else out. Own discovery, own checkout, own the customer, and reduce every brand — every Nike, every Walmart — to a faceless supplier feeding an assistant they don't control.

Sam: And let me guess. The brands aren't thrilled about becoming faceless suppliers.

Alex: The brands are fighting back, and customers are handing them the weapon. There's research from Bain with a number that genuinely surprised me. Shoppers trust a retailer's own agent about three times more than a third-party agent to actually complete a purchase correctly.

Sam: Three times. Huh. So I trust Walmart's own assistant to get my Walmart order right more than I trust some general AI middleman.

Alex: By a factor of three. And so Walmart built its own assistant, named Sparky, plugged it into the AI layer — but kept the basket, the customer data, the whole relationship inside Walmart. Sephora's doing the same, tying everything back to its own app and loyalty program.

Sam: So it's not going to be one assistant to rule them all.

Alex: That's the real forecast. Not total takeover. A contested, blended world. Some shopping flows through the big assistants, some stays inside brand-owned agents, and the actual war — underneath every "agentic commerce" press release — is over who owns the customer relationship.

Sam: Which is the single most valuable asset a business has.

Alex: The single most valuable asset in business, full stop. The front door is not won yet. And that — that's exactly why all five of them are sprinting so hard. The prize is still on the table.

Sam: Okay. So I want to make this real, because we've been at thirty thousand feet. Walk me through what this actually feels like when it reaches me. And then I want the catch, because there's always a catch.

Alex: There's a catch, and it's a big one. But let me give you the dream first, because on a good day it's genuinely magical. You tell your assistant: I need running shoes, under a hundred dollars, by Friday.

Sam: One sentence. That's all I do.

Alex: That's all you do. Behind the glass, your agent uses a new Google discovery system — think of it as a "robots.txt for agents," where any business just publishes a little catalog file at a known spot on its website, and the website's domain itself becomes the proof it's really them.

Sam: So the agent goes shopping at all the legit stores.

Alex: Talks to their agents, pulls the product details, builds you a cart. You glance at it and tap approve — that approval is a signed Cart Mandate, the price locked. A Shared Payment Token passes a one-time credential so the shoe store charges you without ever seeing your card number. The shoes show up Friday.

Sam: And I touched none of it after the first sentence. Okay. That is magic. So what's the catch.

Alex: The catch has a name, and it's wonderful: the "confused deputy."

Sam: The confused deputy. Explain.

Alex: So your agent is walking around the internet carrying your authority. Your tokens, your mandates, your permission to spend. It's like — okay. Imagine you give your house key and your credit card to an incredibly capable but very literal-minded personal assistant.

Sam: Fine so far.

Alex: Now imagine a stranger on the street can shout instructions at your assistant, and your assistant, being literal-minded, sometimes just... obeys. The attacker doesn't need your key. They just borrow your assistant — and your assistant has your key.

Sam: Oh, that's horrible. So someone hides a command somewhere my agent reads it, and my agent does it — with my money and my permissions.

Alex: That's the confused deputy exactly, and it's not theoretical. In April 2026, Microsoft assigned a formal security vulnerability number to precisely this — a hidden-instruction attack in one of its agent products. And security people noted how unusual it was to even assign a formal ID to this kind of attack — which is a sign the industry's only just now admitting these are real software flaws, not edge cases.

Sam: So this is new enough that they're still figuring out it's a category of bug.

Alex: Right. A security coalition mapped nearly forty distinct ways to attack these systems. And here's the part that really lands for me. Even after you perfectly solve identity — even after the agent can prove exactly who it is and what it's allowed to do — it can still be a confused deputy.

Sam: Wait, why? If you've nailed identity, isn't that the whole problem solved?

Alex: You'd think. But here's the gap. The tools the agent uses check its credentials. They do not check its intent.

Sam: Ohh. So the mandate proves I said "buy shoes." It does not prove I didn't mean for some hidden instruction on a sketchy webpage to redirect the order.

Alex: You just nailed the single hardest unsolved problem in the field, in one line. The signature proves what you authorized. It cannot prove that a whisper from an attacker didn't hijack the how. Identity and payment protocols are necessary — and they are not sufficient. And everyone serious knows it.

Sam: So that's the honest version of where we are.

Alex: That's the honest stakes. Done right, this substrate keeps you in control — every action traceable to a permission you actually signed, every agent's power scoped and revocable, and when something breaks, you can see exactly what happened and who's accountable.

Sam: And done carelessly?

Alex: Done carelessly, it's a layer that hands away control by default. Where the pressure of convenience nudges everyone to sign broad standing permissions they never read — "yeah yeah, buy whatever, here's my card" — where the liability for a bad purchase is buried in some protocol spec nobody reads, and where a single hidden whisper can spend money in your name.

Sam: And the choice between those two worlds is being made right now. By a handful of companies. Mostly in private.

Alex: By a handful of companies, mostly without anyone watching. And that — far more than which AI is the smartest — is what's actually at stake. So let me pull it together, because we covered a lot of ground.

Sam: Please. Give me the three things I walk away with.

Alex: One. The giants are cooperating — sharing the protocols, the connectors, the plumbing — and that cooperation is not a truce. It's the loudest possible signal that the plumbing was never where the money was. You give away what you can't own.

Sam: Two?

Alex: Two. The money and the power are in the three layers they kept and did not share: the identity that proves an agent is really yours, the payment mandate that authorizes it to spend, and above all the assistant — the single front door to your life. Whoever owns that door owns the customer relationship everyone else now has to rent from them.

Sam: And three.

Alex: Three. The thing to actually watch — for yourself — is not which AI tops a benchmark, and it's not the size forecasts either. The forecasts, by the way, are all over the map — one firm says a fifth of digital commerce runs through agents by 2030, another puts the US market at a few hundred billion, another reaches into the trillions.

Sam: That's a wild spread. From hundreds of billions to trillions.

Alex: Which tells you the numbers are basically noise — nobody knows. The signal isn't the size. The signal is the architecture. So the real thing to watch is whether the default settings of these systems keep you in control: explicit, scoped, revocable permissions and clear accountability — or whether they quietly trade your control for convenience. Because that architecture is being finalized right now, and you'll be asked to sign that first standing mandate sooner than you think.

Sam: And honestly — I came in thinking this was a story about boring infrastructure, and I'm leaving thinking it's a story about who I'm going to be handing my house keys to.

Alex: That's the whole thing in one line. The companies wiring your wallet to your assistant have told us exactly which pieces they're keeping. And the question worth asking — of them, and of ourselves, before we sign that first mandate — is whether the front door they're building opens only for us, or also for whoever learns to whisper to our agents.

Sam: That's a chilling place to land. And the honest answer is we don't know yet.

Alex: We don't know yet. And that's exactly what makes it worth following this closely. It's a genuinely fast-moving, complex picture with a brutally short shelf-life on what we think we know — and that's precisely why it's worth your attention. I hope you came away seeing a little more clearly where all of this is heading. If you've enjoyed it, please consider giving us a follow.

Sam: And a quick note, for full transparency: this show is AI-generated.

Alex: It is. Dan builds a custom stack of AI tools to chase the questions he can't stop thinking about — it started out made with NotebookLM, and it's now produced with his own engine — mainly so he can learn this stuff himself, and he publishes it for anyone who'd like to listen along.

Sam: Thanks so much for spending the time with us.

Alex: We'll see you in the next one.