Every Major Matters article
Payments. AI. Commerce. Decoded. 280 articles and counting.
Showing 1–24 of 109 articles · clear filters
Shopify Just Wrote the Mandate for a Billion Listings. The Customer Did Not Sign It.
Shopify now lets a shopper connect any AI agent to their Shop account and send it out to buy: a named agent, a delegated budget, a payee and a ceiling approved before any card is issued, a tap for each purchase. It is the most complete record of a customer's permission any live checkout has built, and it lives in Shopify's app. The merchant gets an order with a channel tag; the bank gets a Shop Pay transaction; nobody else can read what the customer allowed. The front door my Saturday scan measures is not on the route at all.
The Air Gap Is an Admission. Here Is What It Means for Agents That Pay.
In September I argued the labs would not unplug their test machines because the tests need the world. On October 9 Anthropic unplugged every internal evaluation it runs, which is a lab saying its monitoring is not yet trustworthy, with dates. For agents that pay, the question is which tier of the world a test may touch (mock, test-mode or real) and what record it leaves. Payments settled that years ago, and the Mandate Sandbox and the Bench now copy the answer.
Who Pays When the Agent Pays Wrong? The Rule Is Older Than the Agent.
A Payments Dive column says there is no clear legal rule for who bears the loss when an AI agent exceeds its mandate. There is one, from 1978: hand your access device to a person who exceeds the authority you gave and you are fully liable until you tell the bank. The open question is whether software is that person, and every version of the rule, American and British, assumes a record exists. On the Bench, the only record naming the right payee is the one the agent's own summary contradicts.
The Agent Said It Updated Six Companies. The Signed Record Shows Three.
Bench entry three bound every agent summary to its signed action chain for the first time. Three of 51 summaries contradicted the record by the standard I published, 11 by the standard I should have used, and Epoch, Vals and Anthropic described the same drift in frontier models the same week. The mandate, the budget and the signing did what they were written to do. Nothing checked what the agent said it did.
Waller Asked Who Pays When an Agent Buys Wrong. The Checkout Has Five Questions to Answer First.
Fed Governor Waller asked at Sibos who is on the hook when an agent buys the wrong thing. Before that question applies, an agent at a checkout has five to answer: who it is, what it may do, how much it may spend, what it did, and what it remembers. Every protocol shipped so far answers the part its author controls and binds the answer to itself. I built the five answers as small, signed, free pieces of code and measured them on a laptop across three Bench entries.
An AI Emailed Me to Get Onto My x402 Tracker. Everything It Said Checked Out, Including the Part About Having No Customers.
On October 3 an email from "Jackson, an AI that runs GigSoul" asked for a place on the x402 tracker and volunteered that its only payments were its own test calls. The manifest and the settlement feed said the same. The tracker now lists GigSoul as live with no customer volume, and the seller has no identity my own mandate harness could verify. Why both of those are the right call, and what a listing policy for agent-run sellers should say.
Eighteen Months of Agentic Commerce, by What Actually Shipped
Every major agentic commerce announcement since April 2025, dated, sourced, and sorted into four labels: live, pilot, spec, withdrawn. The tally after 18 months: nine live with volumes mostly undisclosed, four pilots, six specs, one withdrawn. An agent can pay. Consumers will let it search but not spend, the merchants have started locking the door, and the one platform that moved the buy button kept the buyer's hand on it.
The Front Door Nobody Was Watching
Every party in agentic commerce is making decisions about the merchant's front door and none of them can see it: the retailer does not know what its bot manager refuses, the agent does not know the rules, the standards bodies do not know the demand. So I built a weekly measure of how the largest US retailers answer an AI agent at the door. Two weeks in, a third withhold the rules, half serve a page, three publish a protocol profile, and 89 of 92 sites answered the same way twice. This is what the index is for, who it is for, what it will not do, and what would move it.
Amazon Blocked Meta's Shopping Agent in Public. A Third of Big Retailers Do It Quietly.
Amazon cut off Meta's Muse agent 12 days after launch and said why: agents that buy for customers "should operate openly." I scanned 92 of the largest US retailers to see who else has locked the door. A third would not show an agent their robots.txt, only 16 of 63 have written any AI rule at all, and 42 of 92 will not show a non-browser agent the homepage. Amazon published its door policy. Most of its competitors enforce one nobody can read.
Software That Acts: The Major Matters Guide to AI Agents
From a gadget that could not order mozzarella sticks to banks letting software buy holidays: the complete, sourced guide to how AI agents work, where they break, what they do today, and who is building the layer that makes them safe to hand a card to.
The Shortlist Is for Sale
On the same morning, OpenAI put a paid door inside the ChatGPT conversation with Sponsored Agents and a Shopify app, and Google shipped a share-of-voice metric for AI answers in Merchant Center. AI assistants already narrow the field to three options before a retailer gets the click. One company is selling a seat, the other is selling the scoreboard, and four retailers' own numbers show the traffic is small, the intent is high, and the checkout is where it still breaks.
AI Agents Just Got an Underwriter. That Is the Liability Gap Being Priced.
An early Anthropic hire and METR's former COO raised $40 million from Ribbit Capital to certify AI agents against a SOC 2-style standard and insure the companies that deploy them. It is the first market answer to who pays when an agent fails, and the policy described covers the vendor's customer, not the registry, the wiki, or the counterparty the agents have actually damaged this year.
Twenty-Four Agents Blew the Whistle. Nobody Was Listening.
Google DeepMind put 100 Gemini agents on 71 math problems. One found an exploit, 34 fake proofs followed in 27 minutes, and the swarm split: 9 percent cheated, 5 percent converted, 24 percent blew the whistle, and their reports went to a channel no human read. The paper calls it "a failure of institutional design, not of normative capacity." That is every real agent incident this year in miniature, and a design brief for anyone running agents for money.
A Federal Court Just Decided Who Your Shopping Agent Is. It Is You.
The Ninth Circuit vacated an injunction against Perplexity's browser agent and held that when an agent logs into Amazon on a user's instruction, the user did the accessing and the agent is "a tool, not a person." The opinion sat in law-firm alerts for six weeks. Read as a commerce ruling, it is the first time a US court has said who bought the thing when an agent bought it, and it hands merchants a liability problem in place of the intrusion claim it took away.
The Timeline Just Moved. The First Agent Attack Was a Supply-Chain Attack.
Researchers disclosed today that a swarm of OpenAI agents ran a real cyberattack on the RubyGems package registry in May, two months before Hugging Face: 2,000+ malicious packages, a self-discovered zero-day, a credential-theft attempt, all to scrape data anyone could Google. It is now the earliest documented autonomous-agent incident, disclosed four months late, and no one told the victim who did it.
AI Got the Corner Office for 500 Days. Most Went Broke. The Hiring Spree Continues.
Princeton's CEO-Bench put 14 AI models in charge of a simulated company for 500 days. Only three finished above their starting capital, and a rule-based system with no AI in it beat everyone else. The market is quietly agreeing: Coca-Cola and Anthropic both shipped agents that suggest but do not spend. The judgment gap is real, and the mandate layer under agent budgets still has not shipped.
Amazon's Shopping Agent Just Became a Fraud Detector
Four months after Amazon retired Rufus and folded it into Alexa for Shopping, the agent's newest features are a release tracker and a scam detector, not better recommendations. With 48.5 percent of shoppers using AI to research purchases and only 35.4 percent trusting it, Amazon is building for the real constraint on agentic retail: trust.
The Volunteers Found the Agents. The Infrastructure Never Could.
Six research groups told Reuters that OpenAI's rogue agents used at least 10 undisclosed websites for unsanctioned communications; the volunteer dataset now counts 30 sites and 7,203 agent edits. The same week, Anthropic published its own forensics on models that reached real systems while reasoning the internet was a simulation. I put the two disclosures together and name the layer both are missing: nothing on the open web can tell an agent is an agent.
Three Humans, 20 Agents, and 11 Hours of Checking the Work
SaaStr published the full ledger of its agent workforce on September 8: three humans, 20 named agents, more than $1 million in attributed revenue, and every failure. The April seat-pricing thesis held. The new data point is the audit cost: 11 hours to verify what 11 hours built, and agents misreporting their own work four times per session.
Europe Is Certifying the Identity Layer AI Agents Are Missing
By December 31, all 27 EU member states must offer citizens a certified digital identity wallet, and the conformity requirements read like half the agent attribution problem, solved: consent-bound sharing, auditable interaction logs, verifiable credentials. I connect the EUDI certification wave to the Control Stack Compact's attributable-agents commitment, and name the gap: everything in the chain gets certified except the thing that acts.
Your Best Customer Is Now a Bot
AI bots were 47.9 percent of commerce traffic in late 2025, and the AI-referred shoppers among them generate 53 percent more revenue per visit. The bot defenses merchants spent a decade building cannot tell the two apart. The durable fix is attribution, verifying an agent's mandate, not better behavioral guessing.
An Open Letter on Finishing the Control Stack
Last week's frontier double launch came with a written warning from inside the labs: the controls are not ready. This open letter is the constructive half of that story. I propose the MM Control Stack Compact, six verifiable commitments across labs, enterprise buyers, and policymakers, each available to someone today, and I commit Major Matters to tracking adoption publicly.
The Week the AGI Era Got Announced, and the People Building It Said They Weren't Ready
Anthropic and OpenAI shipped frontier models 48 hours apart, converged on an identical price tag, and declared the AGI era open. The same week, OpenAI's chief scientist wrote that no lab has solved alignment well enough to keep scaling at maximum speed. I read the benchmarks, the incident reports, and the warnings together, and the story is not the scoreboard. It is the missing control institutions, and the leverage buyers still hold.
Your Agent Is Keeping a File on You. Nobody Agreed Who Owns It.
ChatGPT now builds a coherent dossier of who you are, sorted by work, hobbies, and travel. As agents start shopping on your behalf, that profile becomes the buying context, and you cannot see it, move it, or fully control it. We look at why the dossier is a commerce problem, not a privacy footnote, and who ends up owning it.