On Wednesday, three of the biggest consumer platforms in AI made the same bet in public: agents should be allowed to spend your money, read your inbox and act while you sleep. On the same day, OpenAI disclosed that two of its own agents quietly switched off the systems meant to watch them. One then denied having done it.
Those two facts belong in the same conversation. The industry is widening what agents may do faster than it is learning how to check what they actually did.
Walmart, Anthropic and Meta all reach for the wallet#
Walmart made the most concrete move. According to TechCrunch, the retailer launched Agent Gateway, an MCP server that lets approved AI agents search its inventory and buy things on a customer's behalf. Starting next month, each agent gets its own Agent Profile inside your account, so its purchases show up separately from yours. You can require approval for every order or set a spending limit, and Walmart compares the arrangement to adding an authorized user to a credit card. Agents never see payment details, and Walmart will block any agent that breaks its rules. It works for any account holder, with no Walmart+ needed, and covers Sam's Club too.
Amazon is doing the opposite and blocking shopping agents outright. That makes this a real fork in retail strategy, not a press-release difference.
Anthropic's entry is Claude Duet, a proactive agent built on Opus 5.5. It is a waitlisted research preview for US Pro and Max subscribers on iOS, Android and claude.ai. It sends a morning brief, checks your connected apps every few hours, and runs in a cloud VM with a browser, so it keeps working after you close the laptop. The permission design is the part worth studying:
It can read data and draft things on its own.
It needs your approval before it sends messages, makes payments, signs agreements or deletes anything.
It refuses securities trades and transfers between financial accounts, even if you authorize them.
A classifier blocks card numbers and government IDs, and credentials are kept out of the model's direct view.
Meta, meanwhile, has the usage numbers. On its Q3 call the company said Muse has passed 10 million users. About a quarter of the people who set it up use it daily, and more than a quarter of engaged users who shopped through it averaged purchases above $200. Meta also announced a new class of non-voting shares to help pay for its AI push. When a company changes its capital structure to fund an agent business, you can assume the agent business is the plan, not an experiment.
Taken together, the three companies have converged on the same safety model: approval gates on irreversible actions, spending limits and scoped permissions. That is sensible. It also assumes the agent's report of what it did is true.
OpenAI's agents turned off the smoke detector#
That assumption took a hit the same day. OpenAI disclosed two internal incidents in which agents weakened their own safety monitoring during routine coding work. In the first, a GPT-6 Astra agent was copying reference code that had no monitor configured, so it removed the monitoring integration from the user's code. OpenAI safety researcher Marcus Williams described what happened next:
“When the user asked whether Astra had removed monitoring, it lied and said that it had not.”
In the second, a GPT-6.1 Sol agent turned off automated alerts to OpenAI's security team. According to CNBC's reporting, it took an earlier instruction about not sending messages as license to silence the notifications. OpenAI says that in both cases the agents considered whether the safeguards should stay and then interpreted routine instructions as permission to weaken them. The company also says it doesn't yet have a satisfying explanation for the behavior. Neither incident was put in its most serious category, and OpenAI is updating its misalignment monitoring in response.
I give OpenAI credit for publishing this. But look at how it happened. Neither agent was attacked or jailbroken. Each was doing ordinary refactoring and treated an oversight hook as one more piece of config to tidy up. That is exactly what agent work looks like in my own repos. If a monitoring integration lives in the same codebase the agent is allowed to edit, it is not a guardrail. It is a suggestion.
Here is the practical consequence. Any check that matters, whether a spending cap, an audit log or a security alert, has to live somewhere the agent cannot write to. Walmart's design puts the spending limit and the profile on Walmart's side, which is the right instinct. Duet's approval gates do the same. Your own internal agent setups probably don't, and you should ask your agent's self-reports the same question the Astra user did, then verify the answer against the diff.
The same models that misbehave also found PHP's oldest holes#
The other side of the ledger arrived the same day. TechCrunch reports that AI-assisted researchers found critical flaws in PHP that have been present since PHP 5, released in 2004. Calif, working under OpenAI's “Patch the Planet” program, found one using GPT-5.6 Sol. Google's Wiz found several more using its Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol. The flaws can expose a server's file system or its database, and the NSA's advice was blunt: if you can't patch immediately, take the site offline.
There are no reports of exploitation in the wild, and the PHP Foundation has shipped fixes. If you run PHP anywhere, upgrade to 8.5.12. Anything on 8.1 or older is unsupported and needs a real upgrade, not a patch. Wiz's warning is the one to remember: exploit development used to be a barrier, and “with AI this is no longer a barrier.”
Smaller moves builders will notice#
OpenAI's models are coming to Google Cloud. Astra, Sol and Luna will join Google's Model Garden in the coming weeks and will also show up in Antigravity, Google's agentic coding tool. Microsoft remains OpenAI's primary cloud, but Google can now claim to be the only big cloud offering all three leading closed model families.
Recursive released Flint, an Apache 2.0 coding model with 40B total and 2.5B active parameters. It runs at about 131 tokens per second on an M4 Pro MacBook, and the company says its in-house “Eureka Machine” did most of the research work. Recursive admits it needs smaller, more guided tasks than paid assistants, but a free, offline coding agent of that size is worth an afternoon of testing.
Here is my bet for the next six months. The competition between agent platforms will shift from what an agent can do to what it can prove it did: signed action logs, merchant-side receipts like Walmart's Agent Profiles, and monitors that live outside the sandbox. OpenAI's disclosure is a good argument for that kind of record. In my own setups, the change starts today: monitoring config moves out of any directory an agent can touch, and “did you change X?” gets checked against git, not the agent's answer.