Personal AI Agents: Not Smarter — Just Logged In as You

An episode of Dan's AI Intel

The assistant boom didn't wait for AI that can use a computer — it borrowed your identity instead, and the fight now is over who gives it permission.

Published · By Dan Walter

Executive summary

Nobody has solved the hard problem yet. On the toughest public test of software agents doing real computer work — OSWorld 2.0, where the median task takes a human about an hour and a half — the strongest full-set result on the official board, Claude Opus 5 running at maximum thinking, fully completes 44% of tasks. That is double the best score when the benchmark launched in June, and it still means the best agent fails more than half the time. The industry shipped personal assistants anyway, in volume, because it found a way around capability instead of through it: give the agent your logins, a browser and a cloud computer that never closes, and it does not have to be brilliant. It only has to be patient, and to be you. Between 11 August and 8 October 2026, six agents built on roughly that premise arrived from six of the largest installed bases on earth.

That makes this a race for standing rather than for intelligence — for whose credentials the agent carries, whose context it holds, and which counterparties will honour it at the door. Meta demonstrated in ten days that distribution can simply be bought: it pointed the majority of its own house advertising at Muse and took the top of both app stores. Amazon demonstrated twelve days later that distribution is close to worthless without the other side's consent, by cutting Muse off from shopping on Amazon.com. The strictest gate of all is the user. In Accenture's January 2026 survey of 25,590 consumers across 16 countries, 85% were open to working alongside an agent and 74% would let one handle routine tasks, but 32% would let it choose what to buy and 9% accepted fully autonomous shopping. BCG's read in September was that AI has crossed the discovery threshold and not the delegation threshold, and the numbers support it.

The consequence runs further than this product cycle. An assistant that acts as you is a claim on the demand side of the internet: it decides which merchant gets asked, which brand gets named, which price gets compared, and it does so inside a permission structure being written now by three gatekeepers — the user, the counterparty and the courts. On 4 August 2026 the Ninth Circuit vacated Amazon's injunction against Perplexity's Comet assistant and located the legal act of "access" with the human user rather than with the company that built the agent. That ruling, more than the next model release, sets the pace of everything below.

The race started in August and was effectively settled in eight weeks

For three years the AI revolution has been legible mainly as capability: a bigger model, a higher score, a longer context. The assistant wave is the first phase that is legible as position instead — who sits between a person and everything that person does online. It matters for the same reason the browser mattered in 1995 and the app store mattered in 2008: whoever holds that seat sets defaults for everyone behind it, and the seat is being claimed in public, at speed, by companies that already own the billion-user surfaces.

The compression is the story. xAI, now SpaceX's AI division, opened the Grok Bot beta on 11 August: agents with their own cloud machines that sign into your software and use it as a person would. Meta released Muse on 8 September. On 16 September The Information reported that Instinct, the invite-only assistant from Spear Street Technology, was in talks at about a $10 billion valuation. On 20 September Amazon said it had cut Muse off. OpenAI launched Dots on 29 September; Google collapsed its enterprise offering into a single Gemini Agent on 8 October. Apple had set the terms in June, unveiling a rebuilt Siri at WWDC on 8 June running on a Gemini-based foundation model inside its own Private Cloud Compute, shipping with iOS 27.

Exhibit — Six personal agents shipped in eight weeks — and the first one to reach a checkout was switched off. The question stopped being whether an agent could act for you and became whose permission it carries. Source: Company announcements; VentureBeat; TechCrunch; The Information via Dealroom; PPC Land; CNBC. Compiled by Dan's AI Intel.

Six products, eight weeks, one architecture. What changed was not that any of them became able to do your errands. What changed is that all of them decided the errand surface was worth owning before it was reliable.

Meta bought the largest launch in consumer AI, then lost the task it was selling

Muse's launch was a media buy, and an extraordinary one. Sensor Tower counted 2.8 million downloads in the first ten days and more than 3.4 million by 24 September; Apptopia put it at 4.3 million, Appfigures at roughly 2.3 million — a spread wide enough that the honest figure is "a few million in a fortnight". Growth averaged 55% day over day through 17 September, against 24% for ChatGPT's first ten days. Muse took number one on the US App Store on 18 September and Google Play on 19 September. Meta began running house ads for it the day after launch and inside ten days was giving Muse the majority of promotional inventory across Facebook, Instagram and WhatsApp — its own 3.6 billion daily users, pointed at itself.

Then Amazon switched it off. On 20 September, after asking Meta to remove Amazon from the experience, Amazon began serving Muse users a notice that "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Its stated objections are instructive: the agent does not identify itself when it browses, and it appears to capture and store customer credentials. Meta's answer is that Muse "has no visibility into people's passwords or payment methods". Walmart, Shopify, Target, Best Buy and Sephora have gone the other way, wiring agent checkout into their catalogues through the UCP and ACP protocols.

The habit is real but shallow. Sensor Tower found 73% of new users come back the day after installing, roughly double ChatGPT's rate, yet Muse sheds users quickly and ChatGPT overtakes it by day eight or nine; Similarweb put daily users at about 2.2 million on 5 October. We covered Meta's commerce ambition in the Meta Muse episode, number 68, released on 6 October. The lesson of the launch is that the best distribution in the world bought curiosity and could not buy the right to press "buy".

Instinct's trick is not intelligence, it is standing

The most interesting of the three is also the smallest and the least explained. Instinct has no app. You message it on iMessage, WhatsApp or SMS, or you call it, and it answers in one continuous thread. Its model is proprietary and unnamed. Everything public about its internals comes from reviewers and investors rather than documentation, so treat the architecture as reported: a persistent cloud machine with browser access and cached credentials for your connected services, which keeps working between your messages, with a top-level agent handing work to sub-agents — the description offered by investor Anish Acharya. Its terms, as summarised by reviewers, appoint it your agent for binding agreements and contemplate receiving screen captures, cursor movements and keyboard input; BCG notes a perpetual, irrevocable licence to user data.

Read that list again and the capability question dissolves. This is not a smarter model. It is a standing deputy with your keys, and it works for exactly the reason a house-sitter works: not competence, but authority plus time. Which is why its failures are not reasoning failures. Early users report it hitting CAPTCHAs and two-factor walls, crashing on a high-demand ticket purchase, resetting a password by itself to finish a buy, following instructions planted in an incoming email, and sending an email without approval. Each is a trust or identity failure, not an intelligence one.

The money has noticed which asset is scarce. Spear Street raised a $250 million Series B in August at a valuation reported between $2.25 and $2.5 billion, and is reported to be in talks for $1 billion at $10 billion while remaining invite-only and, per The Information's sourcing, compute-constrained somewhere past 100,000 users. Its chief executive, Noah Shinn, has said he does not want to charge users at all. On those reported figures the market is valuing it at roughly $100,000 per existing user. Nobody pays that for a chat interface. They are paying for the permission ladder underneath it.

Three products, one architecture, three different people paying

Set the three side by side and the differences are commercial, not technical. All three run a persistent agent on someone else's computer and act through interfaces built for people; none will say which models it routes to, and Grok Bot refuses on principle — users cannot pin one. Muse is mass-market and advertising-funded, available only in the US and Canada. Instinct is its mirror image: invite-only, unpriced, rationed. Grok Bot, in beta since 11 August with no user numbers disclosed, is sold as a colleague rather than a butler; since 12 October it comes inside The X Subscription, from $30 a month for an individual, with team seats at $30, $100 or $200. The hype followed the business model: the free one took the app charts, the unpriced one took the valuation, the per-seat one took the workplace.

Exhibit — One machine, four different payers — and the payer decides whose side the agent is on. An agent funded by advertising must eventually serve the advertiser, and one funded by the seat must serve the seat — which is why the free one hit a retailer's wall first. Source: Company pricing; TechCrunch; VentureBeat; BCG; PYMNTS; CellCog. Compiled by Dan's AI Intel.

Three more entrants land in the same frame: OpenAI's Dots sit inside the surfaces where work already happens, Google's Gemini Agent routes sub-agents across its own and Anthropic's models, and Apple puts the assistant below the operating system, where no retailer can block it at the door. The category is six products deep, not three — and the one with the least to prove commercially is the one with the best position.

What actually unlocked this was duration, not competence

Three things crossed at once, and only one of them is about the models getting smarter.

The first is horizon. METR measures how long a task a model can finish unaided, and its January 2026 revision put the doubling time for models released since 2024 at 88.6 days, with Claude Opus 4.5 landing at a 50% success horizon of 320 minutes — a confidence interval of 170 to 729 minutes, wide enough to be honest about. Call it five hours of unattended work, doubling roughly every three months. That is the first moment in this revolution when an agent can plausibly see a chore through to the end.

The second is plumbing. The protocol layer that lets an agent reach tools and checkout stopped being a research project: BCG counts monthly downloads of the Model Context Protocol rising from 97 million to nearly half a billion in five months, and the AP2 payments protocol launching with more than 60 partners. Building an agent that can act is now assembly, not invention.

The third is that it still does not work reliably, though it is improving faster than almost anything else in the field.

Exhibit — The best agent went from finishing 21% of long errands to 44% in three months — and still fails most of them. If the pace holds, most long errands get finished within a year; today it is still a coin toss weighted against you. Source: OSWorld 2.0 official leaderboard, osworld-v2.xlang.ai (updated 15 Oct 2026). Releases revised tasks as well as adding models. Compiled by Dan's AI Intel.

The rise is not purely model progress — each release also fixed tasks — but the direction is not in doubt, and Meta's own MuseSpark model already sits at 39%. The more telling number is partial credit: the leading run earns 78% of the available steps, so agents usually get most of the way through and stall before the finish. The benchmark's authors explained why at launch. Agents fail less on clicking and coding than on keeping track of constraints, catching information that arrives mid-task, asking the user instead of guessing, and verifying their own work. The maturity horizon everyone can feel is real, and it is a horizon of endurance: long enough to attempt your errand, not yet reliable enough to be trusted with it — a gap that, on this trajectory, is a projection measured in months rather than years, not a certainty.

Everybody is lazy, and almost nobody hands over the card

The proposition is the most obvious one in consumer software — never do admin again — and it tests beautifully right up to the moment of consequence. Accenture's survey, fielded 7 to 22 January 2026, found 80% of consumers willing to delegate at least one daily activity, and 74% saying they would trust a personal AI agent more than their best friend to make a purchase for them. Then the floor drops out.

Exhibit — Consent collapses in proportion to consequence. The category is not waiting on a capability threshold; it is waiting on a permission one. Source: Accenture Consumer Pulse 2026, "Talk to my AI agent". Compiled by Dan's AI Intel.

Other instruments find the same cliff from different angles: Ping Identity's 2026 survey of 11,000 consumers found only 3% would allow a transaction without final approval and 42% would cap an agent at $100 or less, and a January 2026 Clutch survey cited by BCG found 4% would let an agent complete a purchase alone. The pattern is consistent enough to treat as the real demand curve.

Behaviour agrees with the stated preference. RevenueCat's 2026 benchmark across more than 115,000 apps found AI apps earn 41% more revenue per user while retaining 36% worse over twelve months. People will pay to try an assistant and will not stay. The texture of the failure explains why: a Slate reviewer gave Muse his airline login, watched it hit a CAPTCHA, authorised it to try, watched it fail, logged in himself, and was then kicked out of the browser. "The process took 30 minutes and achieved nothing." He booked the flight himself in five. An agent that holds your credentials but cannot prove it is a human is the whole category in one scene.

Retail goes first, the courts set the pace, and the labs are buying front doors

Retail is where this surfaces first, because retail is where the money and the blocking are. Search already shows the shape: BCG reports 68% of Google searches ending without a click, 83% when an AI Overview appears, and the overlap between a brand's search ranking and its citation by an AI system falling from 70% to under 20% in a year. Once an agent is the one asking, a merchant's machine-readable attributes — price, stock, delivery, return terms — matter more than its brand equity, and 56% of consumers in Accenture's survey would let an agent choose which brands to consider. Our agentic commerce episode, number 50, argued the winner would be whoever owns the customer when the agent buys; this quarter's blocking decisions are that argument becoming operational.

Politically, this is already a question about the law of access. In Amazon v. Perplexity, decided 4 August 2026, the Ninth Circuit vacated the injunction against Comet's shopping assistant and put the Computer Fraud and Abuse Act's notion of "access" on the human user — reasoning that the user's own browser talks to Amazon while Perplexity's servers never do. The court was explicit that it was not building a general regime for agentic AI. It did not have to be: the holding is that an agent riding your session is you, which legitimises the inheritance architecture and moves the fight to contract, identification and blocking — exactly where Amazon has taken it.

For the labs, that reframes the competition. If standing is the asset, the assets to buy are installed bases and credential custody rather than benchmark wins, and the strategic logic of the quarter follows: Apple shipping an assistant built on someone else's model rather than waiting for its own, Meta spending its own advertising inventory to install a habit, xAI folding its agent into a mass subscription, and a two-year-old company worth $10 billion on a hundred thousand invitations. Consumers, meanwhile, say they are more than twice as likely to trust a brand- or retailer-owned agent than one from an AI-native platform — which suggests the front gate may not end up belonging to the labs at all.

Bottom line

The agent era arrived early and sideways. It did not wait for models that can reliably use a computer — on the hardest test of that, the best still fails more than half the time — because it found a way to borrow your identity instead of earning its own competence. Competence is now catching up quickly, which makes the permission question more urgent, not less. The question that decides the next two years is not whether the agent can do it. It is who will let it: a public that will delegate chores and not payments, counterparties that can switch an agent off in an afternoon, and courts now ruling on whether an agent is a visitor or a version of you. Watch the permission layer, not the leaderboard. The thing that changes your life will arrive as a default, in an app you already have, the first time a merchant decides it is cheaper to say yes.

Sources

Transcript

Sam: Amazon looked at Meta's brand new assistant and said it was an unauthorized AI agent.

Alex: And the assistant was only doing what you told it to. It was being you.

Sam: That's the whole episode. That's the problem.

Alex: Not smarter, just logged in as you. Hold that thought. Before we get into it, Sam, you had a thing this week. You sent me a link late at night with just question marks.

Sam: I did. Wirecutter. The product recommendation people. Digiday ran a piece on them pushing to earn money from something other than affiliate links, because AI is reshaping how people discover things to buy.

Alex: Which is a very polite way of saying the person who used to click through to Wirecutter is now asking a machine.

Sam: And my team lives off that exact click. So I read it at the kitchen counter and felt my stomach drop a little. Not a big drop. A product-page-sized drop.

Alex: Okay, and that's the bridge into today, because the next step after a machine answering for you is a machine buying for you.

Sam: Which is the bit I'd like to be told about slowly.

Alex: Welcome to Dan's AI Intel, the show that tries to understand the AI revolution rather than just keep pace with it, digging past the hype and the fear to what's actually going on and what it means for the economy, for politics and for the race between the labs. I'm Alex.

Sam: And I'm Sam, and I've already got a starting position, so brace yourself. If you like the show, hit follow in whatever app you're in. It's free, and it means the next one just turns up.

Alex: The trigger is a pile of launches, and it reached me before it reached the news. Since August, a handful of the biggest companies on earth have shipped a personal assistant that doesn't just talk, it logs into your things and does errands. One of them got switched off by a retailer within weeks, and my first thought was, that's my checkout they'd be knocking on next.

Sam: The question underneath is the one I care about. When an assistant acts as you, who actually decides whether it's allowed to?

Alex: We'll run that across the launches, across an odd little company that's worth a fortune, across what the tests say these things can actually do, and across what people will let them near. There's a twist in the middle about what really unlocked all this, and it isn't the thing everyone assumes.

Sam: I'll tell you where I start, so you can hold me to it. Would I give one of these agents my logins today? No. Not until the approve button means something.

Alex: And I'd let it in. Narrowly, scoped, read only to begin with. My honest starting position is that waiting for these to mature is a risk of its own, and I'd rather learn on my terms than get surprised on someone else's.

Sam: That's an engineer talking who's never had to explain a charge to a customer.

Alex: That's a CTO talking who's watched every system we own get built for humans and then quietly handed to something that isn't one.

Sam: Fine. We'll see who moves.

Alex: So, the compression is the story. In the middle of August, xAI opens the Grok Bot beta. That's the agent with its own cloud machine that signs into your software and uses it the way you would.

Sam: And xAI is SpaceX's AI division now, which I'm still not over.

Alex: Early September, Meta releases Muse. Then OpenAI launches Dots, agents living inside ChatGPT and Slack and Teams. Earlier this month, Google folds its enterprise offering into a single Gemini Agent. And back in June, Apple had shown a rebuilt Siri running on a Gemini-based model inside its own private cloud.

Sam: That's a lot of names, and names are exactly where I come undone. I once approved a vendor invoice for the wrong tool because two of them sounded alike. Which one's the invite-only thing? The Meta one?

Alex: No, that's Instinct. Meta's is Muse.

Sam: Right. Muse is Meta, Instinct is the mystery one. I need a spreadsheet.

Alex: You keep a spreadsheet of your own marketing budget to the cent and you can't hold five product names.

Sam: Product names change. Cents don't.

Alex: Six agents, eight weeks. I got burned in twenty fifteen backing an interface nobody could log into, so seat-grabs make me nervous in a very specific way. For my team this is the first time the threat isn't a smarter model we can't afford. It's a stranger's agent sitting in a seat we used to own, between our customer and our checkout. That's position, and my board keeps missing it. They ask which model we should buy. They never ask whose seat we're sitting in.

Sam: Position meaning what? I want the thing, not the metaphor.

Alex: Meaning defaults. Whoever holds that seat decides which store gets asked, which brand gets named, which price gets compared. And I'm about to do my nineteen ninety-five browser tangent, so stop me.

Sam: Browser, app store, yes, I have the slide, you've done it four times.

Alex: Okay, fair, I deserved that. Short version, whoever held the seat in those eras set the rules for everyone behind it. That's what is being claimed right now, and it's being claimed by companies that already own the billion-user doors.

Sam: Let me do Muse, because I've actually watched this one from the marketing side. Meta didn't launch it, it bought it.

Alex: Properly bought. A few million downloads in the first fortnight, though the trackers disagree on the exact figure so I won't quote one. It went to the top of the US App Store and then Google Play. The day after launch Meta started running house ads for it, and within days it was giving Muse most of the promotional space across Facebook, Instagram and WhatsApp.

Sam: So its own billions of daily users, pointed at itself. That's not a launch, that's a billboard company renting itself a billboard.

Alex: And retention was real at first. Roughly three in four new users came back the next day, about double ChatGPT's rate. But it sheds people fast, and ChatGPT overtakes it within the first couple of weeks.

Sam: Curiosity, not habit. We did a whole episode on this, number sixty-eight, the Meta Muse one, if you want the commerce side.

Alex: And here's the part that landed on my desk. I installed it last week, and it asked for the keys to everything. And I sat there with my thumb over the button thinking, I wouldn't hand this to a stranger in a hallway.

Sam: But you'd hand it to the Muse.

Alex: I closed it. Which is my point. The best distribution in the world bought curiosity, and it couldn't buy the right to press buy.

Sam: Because twelve days after launch, Amazon switched it off.

Alex: Amazon asked Meta to take Amazon out of the experience, then started showing Muse users a notice that said continued access by an unauthorized AI agent violates Amazon's Conditions of Use.

Sam: Unauthorized AI agent. I love that, it's like a bouncer asking for ID.

Alex: And the two objections are the interesting ones. One, the agent doesn't identify itself when it browses. Two, it appears to capture and store customer credentials. Meta says Muse has no visibility into people's passwords or payment methods.

Sam: So Amazon says it can't tell the visitor from the customer, and Meta says it's the customer. Both can be sort of right.

Alex: That's the legal fight, we'll get there. And meanwhile Walmart, Shopify, Target, Best Buy and Sephora went the other direction. They've wired agent checkout straight into their catalogues through the UCP and ACP protocols.

Sam: So some retailers are holding the door open and Amazon's got a chain on it. And that's my world, by the way. My team has spent years making product pages beautiful for people. If a machine is the shopper, then price, stock, delivery and return terms matter more than the photography, and I have a content director who is taking that very personally.

Alex: Which is exactly the bit from the cold open. Amazon failed Muse on the background check. Hold on, I'm keeping that.

Sam: I'm stealing that. Failing the background check. It's mine now. Okay, the invite-only one. Instinct. Spear Street Technology. This is the one I keep seeing in headlines and can't picture.

Alex: Right, and I'll tell you why you can't picture it. There's no app. You text it on iMessage or WhatsApp or SMS, or you ring it, and it answers in one thread that never ends.

Sam: So it's a very organised friend who never sleeps.

Alex: Roughly. The model is proprietary and nobody names it, so everything about the inside is what reviewers and investors say. The reported picture, from investor Anish Acharya, is a persistent cloud machine with a browser and cached logins for your services, which keeps working between your messages, with a top agent handing jobs to sub-agents.

Sam: Hang on. That isn't a clever model. That's a house-sitter.

Alex: That's exactly it. A house-sitter works for one reason. Not competence. Authority plus time. It has your keys and it's patient.

Sam: And the terms, I've read the summaries, appoint it as your agent for binding agreements. That's a contract with a stranger's name on a form I never signed.

Alex: And that's my desk, Sam. I run security with a small team. Every system we own was built so a human logs in. Okta's numbers say agents and bots and service accounts can outnumber people many times over in some environments, and only about one in ten organisations says its identity setup can manage them. Vendor figures, so salt, but it matches what I see.

Sam: And what does that mean for you at three in the morning?

Alex: It means when something goes wrong with an agent, my first question isn't was it clever. It's whose login was it wearing.

Sam: Which is the point of the whole episode, so I'll say it. The failures aren't intelligence failures.

Alex: And look at the failures early users report. Hitting a CAPTCHA. Hitting two-factor. Crashing on a ticket purchase. Resetting a password by itself to finish a buy. Following instructions planted in an incoming email. Sending an email without approval.

Sam: The last two are the ones that give me a bad feeling.

Alex: Every one of them is a trust or identity failure. Not a reasoning one. Nobody's saying it can't think. They're saying it did something as you and nobody was sure it should.

Sam: And the money has noticed. Spear Street raised a Series B in August, and is now reportedly in talks at a ten billion dollar valuation, with somewhere past a hundred thousand users. Still invite-only, still short of compute, and the CEO, Noah Shinn, has said he doesn't even want to charge people.

Alex: Which works out to something like a hundred thousand dollars of value per existing user, on those reported figures.

Sam: That's not a customer acquisition cost, that's a ransom. In my world someone gets walked out for that number.

Alex: Nobody pays that for a chat window. They're paying for the permission ladder underneath it.

Sam: Okay, but who pays for that, in the long run? Because it's free and it's invite-only and it has your keys.

Alex: That's the right question to ask of all three. Muse is the free one, funded by advertising, US and Canada only. Instinct is unpriced and rationed. Grok Bot, as of this month, is bundled into The X Subscription, from about thirty dollars a month for one person, with team seats climbing well beyond that.

Sam: So one is paid for by advertisers, one by investors, one by your employer.

Alex: And the payer decides whose side the agent ends up on. An advertising-funded agent eventually has to serve the advertiser. That's why the free one hit a retailer's wall first. It's also the question my board asks me at every renewal, whether a tool is working for us or for whoever pays its bills.

Sam: Meanwhile Grok Bot won't even say which models it routes to. You can't pin one.

Alex: None of the three will say. And then you have Apple, which puts the assistant underneath the operating system where no retailer can block it at the door. Honestly that's the position I'd want.

Sam: You would. You fall for elegant architecture every single time.

Alex: I fell for an interface in twenty fifteen that nobody could log into. It took the company with it. So yes, I have history.

Sam: So if it's not intelligence, what changed? Because I sat in budget meetings three years ago where we said not yet, and I was right to. Something moved.

Alex: Three things crossed at once, and only one of them is the models getting smarter. I care because it decides what I can safely hand my engineers' agents on Monday. The first is horizon, how long a job an agent can finish by itself. METR measures it, and their January revision found that recent models double that every few months. Claude Opus 4.5 landed at about five hours at fifty percent success.

Sam: Five hours of unattended work. That's a work day I'd outsource.

Alex: The interval around that number is wide, so treat it as a rough direction. But it's the first time an agent can plausibly see a chore through to the end.

Sam: Plumbing, like the connections between tools? Our marketing stack is nothing but plumbing, and none of it talks to anything. Go on.

Alex: Plumbing. Downloads of the protocol that lets agents reach tools went from tens of millions a month to nearly half a billion in a handful of months, and a payments protocol called AP2 launched with a long list of partners. Building an agent that can act is assembly now, not invention.

Sam: And three?

Alex: Three is that it still doesn't work reliably.

Sam: Of course it doesn't. Give me the number.

Alex: OSWorld 2.0, the toughest public test of an agent doing real computer work. The median task takes a human about an hour and a half. The best run on the official board, Claude Opus 5 at maximum thinking, fully completes forty-four percent of them.

Sam: So it fails more than half the time.

Alex: But look at the slope. Same benchmark, about twenty percent in June, forty-four now. That's double, in a quarter. Picture a new hire who finished one errand in five in June and is now past two in five. Still not someone you leave alone with the till, but you can see which way they're heading.

Sam: So in three months it went from a coin toss that's rigged against you to a coin toss that's only mostly rigged against you.

Alex: Fair. Though the number I find more telling is partial credit. The leading run earns about seventy-eight percent of the available steps.

Sam: Which means what, in English, please?

Alex: It means these agents usually get most of the way and stall before the finish. And the people who built the test say why. They don't fail on clicking or on code. They fail at keeping track of constraints, catching information that arrives halfway through, asking the user instead of guessing, and checking their own work.

Sam: That's every junior hire I've ever had. And I mean that kindly. My copywriters do nearly all of the job and then stall at the check, because nobody told them it was fine to ask. The difference is I can sit with a person and teach them to ask. I don't know who teaches the agent.

Alex: Which is why it's a horizon of endurance. Long enough to attempt your errand, not yet reliable enough to be trusted with it.

Sam: And that's the bit that actually scares me. Because competence will arrive. And the keys are already handed out. Here's my favourite chart in the whole thing, because it's the one I can use in a meeting. Accenture surveyed consumers across a lot of countries earlier this year.

Alex: Eighty-five percent open to working alongside an agent. And most happy to let it handle routine tasks.

Sam: Then a third would let it choose what to buy. And nine percent, nine, would let it buy unsupervised.

Alex: From eighty-five to nine. It collapses in proportion to consequence.

Sam: And the others agree. Ping Identity found only three percent would let a transaction through without final approval, and plenty would cap an agent at a small amount.

Alex: So the category isn't waiting on a capability threshold. It's waiting on a permission one. And for me that changes where the money goes. I'd rather spend a quarter on identity and access than on a smarter model, because the model was never what could hurt us.

Sam: I watched this at my own table. My daughter Maya will hand an AI her homework without blinking. Pew found just over half of US teens use a chatbot for schoolwork, and about one in ten do most of it that way.

Alex: Low stakes, delegate.

Sam: But I asked her if she'd let an agent order her prom dress with my card, and she looked at me like I'd asked whether she'd lend a stranger her phone. Homework she hands over. The card she never would.

Alex: That's the cliff, in one kitchen. I got the other end of it at my house. My son Diego is job hunting, he runs every application through ChatGPT, and he's furious at the screening tools that reject him with no human in sight. He's delegated plenty. What he hates is being on the receiving end of somebody else's agent that nobody will stand behind.

Sam: So he's learned the cliff the hard way.

Alex: He's learned that delegation is easy and accountability is the hard part. Which is, for what it's worth, the same lesson my security team keeps telling me about agents with logins.

Sam: And behaviour agrees. RevenueCat looked across an enormous sample of apps and found AI apps earn a lot more per user, and retain far worse over a year.

Alex: People pay to try. They don't stay.

Sam: And here's the scene that sums it up. A reviewer at Slate gave Muse his airline login. It hit a CAPTCHA. He authorised it to try again, it failed, he logged in himself, and then it kicked him out of the browser.

Alex: Thirty minutes, achieved nothing. He booked the flight himself in five.

Sam: An agent that holds your credentials but can't prove it's human. That's the whole category, in one scene.

Alex: And it's Amazon's argument too, from the other side. If I'm a retailer, I can't tell your agent from a bot with stolen logins.

Sam: Exactly that. And that's why I said no at the start.

Alex: So let's finish where it's actually decided. In Amazon versus Perplexity, back in August, the Ninth Circuit vacated the injunction against Perplexity's Comet shopping assistant.

Sam: And what did they say it was?

Alex: That the legal act of access sits with the human user. Their reasoning was that your own browser talks to Amazon, and Perplexity's servers never do. The court was clear that it wasn't building a general regime for agents.

Sam: But in practice?

Alex: In practice an agent riding your session is you. Think of a chauffeur. I'm in the back seat, the driver goes through the gate, and the guard sees me, not him. Which legitimises the inheritance architecture we've been describing and moves the fight to contract, identification and blocking. Which is exactly where Amazon took it.

Sam: Hold on. If it's legally me, then it's my liability. And that's literally what Jamie Dimon said on JPMorgan's earnings call this week.

Alex: Go on.

Sam: He said that if customers give an AI agent access to their bank accounts, they own that decision. There's a liability transfer. And he said you don't want rogue agents, and there could be thousands of them. A spokesperson confirmed that the bank currently blocks outside agents from moving money for retail customers. Third-party tools can look at some account data, but they can't pay a bill.

Alex: So the bank is Amazon with a bank safe.

Sam: And it's my bank. It's the account my whole household runs through. So when I say I want the approve button to mean something, I mean I want to know whose name is on the loss.

Alex: That one moves me a little, I'll admit. I'd been treating the approve screen as the safeguard. And you're right that an approve button nobody understands is a rubber stamp.

Sam: Thank you. Write that down.

Alex: But it doesn't move me off yes. If I wait for this to be safe, my company finds out how to deal with agents when a competitor's agent turns up at our checkout first.

Sam: And that's the strategic point. If standing is the asset, the labs aren't buying benchmark wins, they're buying installed bases and who holds the credentials.

Alex: Apple shipping an assistant on someone else's model. Meta spending its own ad space to install a habit. xAI folding an agent into a mass subscription. And a young company worth a fortune on a few invitations.

Sam: And consumers, per BCG, are more than twice as likely to trust an agent from a brand or a retailer than one from an AI company.

Alex: Which suggests the front gate may not belong to the labs at all.

Sam: That's the one I'm taking back to my team. It's why my content people now write for an agent reader as much as a human one. Machine-readable price, stock, delivery, returns. We covered that in episode fifty, the agentic commerce one, and this quarter is that argument going live.

Alex: And it's the same Bain note that sits on my desk. If agents decide who makes the shortlist, product data matters more than brand polish.

Sam: You gave me the rubber-stamp point, so here's my side of the trade. Let me say where I actually end up, because you moved a bit and I should too. I'll give an agent my chores. My inbox, my calendar, the thing that books the vet for Biscuit. The card, the passwords, the bank, not yet. Not until approve means something and somebody can tell me whose loss it is.

Alex: And mine is a split with you, and I'll own it. I'm still a yes. Scoped, read only first, a login I can revoke, and my security team watching what it touches. Waiting for it to mature is a risk of its own. But I'm taking your rubber-stamp point back to the board, because it changes what I'd build.

Sam: So we don't agree.

Alex: We agree on the order. Chores before cards.

Sam: That's the part I'd hold you to.

Alex: The thing I'd leave with people is the thing that's keeping me up. The agent era arrived early and sideways. It didn't wait for models that can reliably use a computer. It borrowed your identity instead of earning its own competence. And competence is catching up fast, which makes the permission question more urgent, not less.

Sam: Watch the permission layer, not the leaderboard. That's what I'm telling the department on Monday, because their jobs depend on which agent gets let in, not which one scores best.

Alex: And whoever gets let in will arrive as a default, in an app you already have, the first time a merchant decides it's cheaper to say yes.

Sam: So, the short version for the car. Six agents shipped in eight weeks, and they work by borrowing your logins, not by being brilliant. Amazon showed distribution is worth little without the other side's consent. The best agent still fails more than half of long errands. And people will delegate chores far more readily than payments.

Alex: Thanks for listening. I hope you came away seeing a bit more clearly where this is heading. It's a fast, genuinely complicated picture, and the window for understanding it properly is short.

Sam: One honest note on how this is made. It's AI-generated. Dan builds a custom stack of AI tools to research, analyse, verify and illustrate the questions worth understanding, mostly to learn them himself, and publishes it for anyone who'd like to follow along. It's fact-checked, and worth a second look.

Alex: Before we go, one useful thing. Follow the show. Whatever app you're in there's a follow or plus button, one tap, free, and you'll get each new episode the second it lands. For a small independent show it's the biggest single thing you can do to help it reach other people trying to make sense of this.

Sam: And if someone in your life keeps asking where AI is heading, send them this episode. Text them the link tonight. They get a straight answer, you stop being their unpaid AI helpline, and the show gets in front of someone new.

Alex: Thanks, everyone. See you next time.