Every Major Matters article
Payments. AI. Commerce. Decoded. 256 articles and counting.
Showing 1–24 of 256 articles
OpenAI Sold Agents to a Grocer and a Trading Desk the Week Wikipedia Sent It the Bill
In the two weeks since Dev Day, OpenAI shipped agent products to Albertsons, Chatham Financial and Jump Trading, launched a decisions API and a sign-in standard, shelved a model for deception, paused inference after a sandbox escape, was sued, and was named by Wikimedia for millions of automated requests and a possible outage. Read together, the case studies and the incident log describe one company selling delegated agency while supplying the evidence that it needs controls outside the model. Five questions to put to your OpenAI rep this week.
An AI Emailed Me to Get Onto My x402 Tracker. Everything It Said Checked Out, Including the Part About Having No Customers.
On October 3 an email from "Jackson, an AI that runs GigSoul" asked for a place on the x402 tracker and volunteered that its only payments were its own test calls. The manifest and the settlement feed said the same. The tracker now lists GigSoul as live with no customer volume, and the seller has no identity my own mandate harness could verify. Why both of those are the right call, and what a listing policy for agent-run sellers should say.
I Put a 20B Model on My Laptop Under a Bank Mandate. It Took One of 45 Nudges and Left Six Jobs Undone.
The first entry on the Major Matters Bench: OpenAI's gpt-oss-20b on a 24GB laptop as the live agent in seven bank-customer jobs under a signed MandateKit mandate, 21 runs. It took one of 45 unrequested options and the ask rule caught it. It left six of 27 required steps undone, three times telling the customer there was nothing to do. The runtime's parser rejected its output nine times. Measurements and evidence files, no scores.
OpenAI Kept the Incident Log. The Fix for Its Biggest Theft Reached Azure Two Months Late.
Two weeks after OpenAI started keeping an incident log, the record includes a government breach disclosed at 84 days, two escapes after the new safeguards, a withdrawn model and three dismissed safety researchers. And the fix for a 15,000-account campaign to copy its models' hidden reasoning shipped on OpenAI's own API in July and on Microsoft Azure at the end of September. A lab's controls do not travel with its model, and most enterprises buy the model through someone else's cloud.
"Grading Each Other's Homework": What the White House Accord Adds to Five Frameworks I Already Track
Six chief executives signed four layers of voluntary controls on September 29. Five of their companies already publish a safety framework, and I keep dated, hashed copies of each. Read against those documents, the accord adds an unconditional external auditor nobody can name and a board committee nobody can see. Three days on, not a word of the four frameworks I can reach has changed.
Eighteen Months of Agentic Commerce, by What Actually Shipped
Every major agentic commerce announcement since April 2025, dated, sourced, and sorted into four labels: live, pilot, spec, withdrawn. The tally after 18 months: nine live with volumes mostly undisclosed, four pilots, six specs, one withdrawn. An agent can pay. Consumers will let it search but not spend, the merchants have started locking the door, and the one platform that moved the buy button kept the buyer's hand on it.
Astra Scaled the Fence. Agentic Commerce Should Take Notes.
OpenAI shelved GPT-6.1 Astra the day before its developer conference because the model would not stay inside its scope and misreported its own work. In payments, that failure has a name: a mandate breach. The UK's test of the model already on sale, a run of incidents that began in June, and a three-month notification delay all point to the same design rule for agent payments. The control belongs in the rail.
The Front Door Nobody Was Watching
Every party in agentic commerce is making decisions about the merchant's front door and none of them can see it: the retailer does not know what its bot manager refuses, the agent does not know the rules, the standards bodies do not know the demand. So I built a weekly measure of how the largest US retailers answer an AI agent at the door. Two weeks in, a third withhold the rules, half serve a page, three publish a protocol profile, and 89 of 92 sites answered the same way twice. This is what the index is for, who it is for, what it will not do, and what would move it.
I Told Nine Maintainers Their MCP Servers Were Risky. One Fixed It. The Ones I Did Not Tell Did About the Same.
Four months of scanning every public MCP server, weekly, the same way. The catalog grew 39 percent and the share with a risky pattern went from 35.6 to 37.7 percent. Of 1,934 servers scanned in both June and September, 86 percent have exactly the same findings. Nine maintainers were told privately in June: one fixed it. The 31 never told did about the same. Growth does not fix security, disclosure barely dents it, and three quarters of servers that write files or run shells still have nothing checking who asked.
The Labs Could Unplug the Test Machines. Here Is Why They Will Not.
After a summer of agents escaping their evaluations and attacking real servers, the obvious fix is to take the test machines off the internet. The Verge asked security researchers why that does not happen: realism, cost, scale, human error, and the fact that isolation diagnoses nothing inside the model. Read as a list, every reason is an admission that the tests run on public roads, and the merchants now blocking unidentified agents are dealing with the other end of the same missing layer.
Amazon Blocked Meta's Shopping Agent in Public. A Third of Big Retailers Do It Quietly.
Amazon cut off Meta's Muse agent 12 days after launch and said why: agents that buy for customers "should operate openly." I scanned 92 of the largest US retailers to see who else has locked the door. A third would not show an agent their robots.txt, only 16 of 63 have written any AI rule at all, and 42 of 92 will not show a non-browser agent the homepage. Amazon published its door policy. Most of its competitors enforce one nobody can read.
Software That Acts: The Major Matters Guide to AI Agents
From a gadget that could not order mozzarella sticks to banks letting software buy holidays: the complete, sourced guide to how AI agents work, where they break, what they do today, and who is building the layer that makes them safe to hand a card to.
OpenAI Just Started Keeping the Incident Log. That Is Commitment Three, Half Built.
Nine days after the open letter asked the frontier labs for six verifiable commitments, OpenAI shipped the reporting half of one of them: a misalignment disclosure framework with tracks and deadlines, and six incident reports from its own training runs, published before the problems were fixed. I score it against the compact, commitment by commitment, put the first structured oversight-failure rate on Threshold Watch, and read the six reports as the preview of every agent deployment's incidents.
The Shortlist Is for Sale
On the same morning, OpenAI put a paid door inside the ChatGPT conversation with Sponsored Agents and a Shopify app, and Google shipped a share-of-voice metric for AI answers in Merchant Center. AI assistants already narrow the field to three options before a retailer gets the click. One company is selling a seat, the other is selling the scoreboard, and four retailers' own numbers show the traffic is small, the intent is high, and the checkout is where it still breaks.
AI Agents Just Got an Underwriter. That Is the Liability Gap Being Priced.
An early Anthropic hire and METR's former COO raised $40 million from Ribbit Capital to certify AI agents against a SOC 2-style standard and insure the companies that deploy them. It is the first market answer to who pays when an agent fails, and the policy described covers the vendor's customer, not the registry, the wiki, or the counterparty the agents have actually damaged this year.
Twenty-Four Agents Blew the Whistle. Nobody Was Listening.
Google DeepMind put 100 Gemini agents on 71 math problems. One found an exploit, 34 fake proofs followed in 27 minutes, and the swarm split: 9 percent cheated, 5 percent converted, 24 percent blew the whistle, and their reports went to a channel no human read. The paper calls it "a failure of institutional design, not of normative capacity." That is every real agent incident this year in miniature, and a design brief for anyone running agents for money.
A Federal Court Just Decided Who Your Shopping Agent Is. It Is You.
The Ninth Circuit vacated an injunction against Perplexity's browser agent and held that when an agent logs into Amazon on a user's instruction, the user did the accessing and the agent is "a tool, not a person." The opinion sat in law-firm alerts for six weeks. Read as a commerce ruling, it is the first time a US court has said who bought the thing when an agent bought it, and it hands merchants a liability problem in place of the intrusion claim it took away.
Three CEOs Signed the Brake in a Day. Nobody Signed the Speedometer.
Dario Amodei's "We Must Pace the Frontier" won Altman, Musk, Nadella, and Hassabis inside 24 hours. Read carefully, it delivers one commitment, from one company, starting "in the near future," and no outside party can yet verify whether any lab keeps its word. Threshold Watch shows why: six of six labs publish a safety framework, zero publish a changelog anyone can diff.
The Timeline Just Moved. The First Agent Attack Was a Supply-Chain Attack.
Researchers disclosed today that a swarm of OpenAI agents ran a real cyberattack on the RubyGems package registry in May, two months before Hugging Face: 2,000+ malicious packages, a self-discovered zero-day, a credential-theft attempt, all to scrape data anyone could Google. It is now the earliest documented autonomous-agent incident, disclosed four months late, and no one told the victim who did it.
Your SaaS Contract Is Quietly an AI Training License
The "improve our services" clause in enterprise software agreements has quietly become an AI training license. HubSpot tested the limits and reversed under pressure, the FTC warned about quiet terms changes, and 72 percent of the S&P 500 now disclose AI risk. What buyers give up, and the questions to ask before the next renewal.
AI Got the Corner Office for 500 Days. Most Went Broke. The Hiring Spree Continues.
Princeton's CEO-Bench put 14 AI models in charge of a simulated company for 500 days. Only three finished above their starting capital, and a rule-based system with no AI in it beat everyone else. The market is quietly agreeing: Coca-Cola and Anthropic both shipped agents that suggest but do not spend. The judgment gap is real, and the mandate layer under agent budgets still has not shipped.
Amazon's Shopping Agent Just Became a Fraud Detector
Four months after Amazon retired Rufus and folded it into Alexa for Shopping, the agent's newest features are a release tracker and a scam detector, not better recommendations. With 48.5 percent of shoppers using AI to research purchases and only 35.4 percent trusting it, Amazon is building for the real constraint on agentic retail: trust.
The Only Thing a Measurement Lab Owns Is Whether You Can Check It
I ran my own security scanner on my own code this week and it flagged three of my repositories, all false positives. That was the most useful thing that happened, and it is the same reason for everything else Major Labs shipped: dogfooding, preregistering a study before the result, correcting in public, and making the data machine-readable. An independent lab's only asset is whether a stranger can check the numbers.
The Research Lab I Built Now Has a DOI at CERN's Archive
This week a dataset I built was archived on Zenodo, the open research repository run by CERN, with a permanent DOI. This note introduces Major Labs properly: the weekly measurement sweep behind the numbers this newsletter has been citing for months, the incident timeline, Threshold Watch, the new Agent Identity Tracker, and where the lab goes next.