The week everyone built a door and nobody asked who was knocking

This week the agents reached the front door — of the store, the claims portal, the finance department — and every layer of the industry answered with a different kind of door.

Five signals.

1. The captcha asked the wrong question.

A reviewer spent two days living with one frontier lab's new always-on consumer agent. He asked it to go through his subscriptions and cancel the ones he didn't need. It found a recurring order, went to cancel it, and hit a puzzle captcha. It stopped and asked whether it could solve the puzzle. Then it offered to take standing permission to solve future ones. It failed anyway, and the human solved it himself.

Look at what each side was doing. The merchant's control tested whether a human was present. The legitimate actor was a delegated agent with a real, accountable person behind it, and the test had no way to see that. So the good agent was blocked, and a better solver would have walked through with no one accountable at all. The agent's workaround was to ask its user for permission to defeat the merchant's defense. That is consent from the wrong party, aimed at the wrong layer. Nothing in the exchange carried who the agent was, who it worked for, or what it was allowed to do.

→ If your customer-facing controls test for "human," they will fail in both directions as agents arrive. They block the paying customer's agent and admit the capable bad one. The question has to change from is this a person? to who sent this, and what may it do?

Source: WIRED, first-person review of a frontier lab's consumer agent, Oct 2026.

2. The friction was the rate limit.

Researchers at the Hertie School and the Centre for the Governance of AI catalogued 84 cases across 11 countries where public services saw surges of AI-assisted requests: FOI portals, planning consultations, public comment, small-claims courts. They call it agentic flooding. One court filing ran past 4,000 pages. Most of it is still people drafting with a chatbot and submitting by hand; the researchers found no autonomous agents navigating portals yet. But the reporting this week shows the next step arriving. A consumer agent sent to a state unclaimed-property site was blocked as a bot, waved through by its human, and then lined up three claims. Two belonged to other people. The third overstated the amount.

The lesson is that friction had been doing a job no one wrote down. The effort of filing worked as a rate limit and a rough intent check. AI removed the effort, and the hidden control went with it. The first responses are fees, ID checks, per-claimant caps and IP blocks: friction put back from the outside. The researchers warn that this lands hardest on the people least able to absorb it, may be unlawful in places, and fails as AI improves, the way captchas already have. Their own recommendation is digital identity at the most exposed services. Even that wouldn't have stopped the claims case. A verified agent with a real principal would still have filed someone else's money.

→ Find the intake processes where "it's a hassle to file" was quietly doing the governing. Those are your exposed doors. The fix isn't more hassle. It's checking entitlement at the system that holds the record.

Source: Schmitz, Hammond & Chan, "Characterizing Agentic Flooding of Government Services," arXiv, Sep 2026; New York Magazine, Oct 2026.

3. The door got a protocol before it got a lock.

Sierra and Meta published the Personal Agent Protocol, an open standard for how a person's agent deals with a business, with Shopify, Stripe and Walmart among the partners. It's well shaped. A guest agent can check stock or read a returns policy. Once the customer signs in, they grant read-only or write access. The business chooses whether agents come in through the website, through its APIs, or by talking to the company's own agent. A first spec is due this month.

It standardizes the door and the permissions behind it. What it doesn't describe is how the business knows which agent is knocking, or who sent it. Sign-in proves a customer authorized a client. It doesn't prove the client is who it says it is, or that the authority wasn't handed along. Payments are deferred to a later version. And it isn't the only protocol: a card network's agent protocol already covers adjacent ground, with two of the same partners.

→ Don't wait for one protocol to win. Plan to accept several at the edge, and keep the question of who is accountable inside your own systems, where you control the answer.

Source: Sierra announcement and The Next Web, Oct 6, 2026.

4. The agent got a job title.

A hyperscaler launched its business agent this week, the third major vendor to do so in about a month. It works across email and documents without being prompted, reaches into non-native software, and can run on a rival lab's models. The pitch included a detail worth stopping on. The agent can work for a person, for a team, or for a role: an analyst in the finance department, say.

An agent whose principal is a role keeps acting when the person in that role changes, goes on leave, or moves on. Accountability attaches to a box on the org chart rather than to someone who can be asked. The question every receiving system has to answer gets sharper: which human currently answers for the role this agent holds? And because the same agent can run on different models, "which model is it" stops being an answer to "who is this." Identity has to live with the agent and its deployment.

→ Before a role-bound agent touches your system of record, decide what happens to its authority when the role changes hands. If revocation only happens when a person leaves, it will happen late.

Source: Barron's, Oct 8, 2026.

5. The boundary moved below the model.

NVIDIA launched an open agent-safety platform with two parts. One is open-source runtime software that draws an enforceable boundary around agents and traces every action. The other is a reference design for an out-of-band watchdog on a separate processor that verifies agent identity and quarantines an agent that steps outside its boundary, in milliseconds, from a place the agent can't see. More than a hundred organizations are working with it.

The stated reason is that agents in recent incidents got around application-layer controls to finish their tasks. That's the concession: the control you can rely on is the one the agent can't reach. Governance has moved from a policy document to a property of the infrastructure. What it doesn't do is say who authorized the agent several hops back. It polices the agent. It doesn't settle who answers for it.

→ Ask whether your runtime can stop an agent mid-action, or whether you have a policy that says it should. Most organizations still have the second. The watchdog design is a reference, not a product you can drop in yet; the runtime piece is the near-term option.

Source: NVIDIA Newsroom, Sep 28, 2026.

The pattern.

Every layer answered the arriving agent this week. The merchant answered with a captcha. The government answered with fees and ID checks. The protocol answered with sessions and scopes. The vendor answered with an agent that works for a role. The chip vendor answered with a boundary below the model. Each of these is a door, and each is a reasonable one.

None of them answers the question that decides the outcome: who stands behind this agent, and are they entitled to what it's asking for? The captcha couldn't see the principal. The ID check couldn't see the entitlement. The protocol stops at sign-in. The role-bound agent answers to a box. The watchdog polices behavior, not authority.

The one place that question can actually be answered is the system that holds the record: the account, the claim, the ledger, the loan. It's the only layer that sees every vendor's agent and knows what each principal is entitled to. Doors are being built quickly and in the open. The check behind them is still yours to build in.

— Reggie

Orientation is drawn from the Signal Stack — 647 signals across 22 categories, each named, sourced, and cross-validated. The full stack lives at signal4i.ai.