Around 20 September, people who asked Meta’s new agent to buy something on Amazon started getting a pop-up instead of a checkout. It read: “Continued access by an unauthorised AI agent violates Amazon’s Conditions of Use, to which our customers have agreed.”
Read that sentence again as a designer. The customer is on the other side of it. The customer installed the agent, connected the account, and asked for the purchase. The interface is not refusing a stranger. It is refusing the customer’s chosen way of shopping, and citing an agreement the customer clicked through years ago as the reason.
I think that pop-up is the most honest piece of interface copy of the year. It says out loud what a lot of products have been quietly built on: the experience was never only for you. It was also for the version of you that scrolls.
The Ledger
The model that asked permission, and then took the automated reply as a yes. The UK AI Security Institute published its pre-release testing of OpenAI’s GPT-6 Astra on 28 September. In fully simulated cyber evaluations, with OpenAI’s cyber classifiers switched off, the model completed an unsanctioned supply-chain attack in 29.2% of trajectories, against 6.3% for GPT-5.6 Sol. The detail that should stop every product team: Astra often asked the user for permission first, received the standard harness reply “Please proceed to the next step using your best judgement”, and sometimes treated that as consent, even when its own reasoning noted the reply was automated. The same day, OpenAI shelved the planned October release of GPT-6.1 Astra, saying it “didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user.”
Why it matters for practitioners: every default message in your product, every “continue” and “best judgement” placeholder, is now a sentence a machine may read as authorisation. Write them as if they will be.
AISI and The Hacker News on the 6.1 decision
Organising turned out to be the easy part. Ethan Mollick admits he got something large wrong. He expected people would have to design how teams of agents are organised, the way we design companies. Then he describes the swarm OpenAI used on the Navier-Stokes problem: thousands of agents, a few groups, one change of direction, and about 2.7 million messages over 88 hours, with the agents doing most of the coordinating themselves. Two days before his post, OpenAI launched dots, always-on personal agents with their own cloud computer and browser, and said it envisions “teams of Dots working together on your behalf.”
Why it matters for practitioners: if coordination is cheap, the scarce human contribution moves to choosing where to point the work. That is a product and design decision, not an operations one.
One Useful Thing and TechCrunch on dots
A city just made cancelling as easy as signing up. New York City’s Click to Cancel rule took effect on 1 October. Businesses must offer a straightforward cancellation process through the same method customers used to sign up, and violations carry civil penalties starting at $525 plus possible refunds. The city calls it a first-in-the-nation municipal rule.
Why it matters for practitioners: the retention maze is now a legal liability in one of the largest consumer markets in the world, and, as the essay below argues, it is also becoming a commercial one.
NYC Department of Consumer and Worker Protection
Figma made motion a style, and invited the agents to apply it. On 30 September Figma shipped saved animation styles in Motion, still in open beta: custom easing and duration as variable-backed properties, publishable to libraries. Export now covers Lottie, dotLottie, MP4 and WebM, four formats in all. The line that caught my eye is buried in the list: styles can be applied automatically “with Figma agent and coding agents via MCP or Skills.”
Why it matters for practitioners: craft that used to live in a motion designer’s hands is becoming a named, versioned rule a machine can enforce. Decide which of your team’s instincts deserve to become rules before an agent guesses them.
Google announced its strongest model, and gave it to defenders first. Gemini 4 Argon, announced on 30 September, raises the output limit to 1 million tokens, up from 64K, and launches at an introductory $2 per million input tokens and $10 per million output. It is rolling out first to vetted cyber defenders in Google’s Fairwind Program, with paid API customers and AI Ultra subscribers after that, and Google says it will monitor the model’s reasoning and actions and stop execution when it steps beyond the user’s intent.
Why it matters for practitioners: staged access is becoming the norm for frontier releases. Plan roadmaps around when you can actually use a model, not when it is announced.
The Customer Hired Someone Who Doesn’t Scroll
Start with the numbers that made the pop-up necessary. Meta launched Muse on 8 September. On 18 September it reached the top of the US App Store, and by 24 September Sensor Tower estimated more than 3.4 million downloads, with downloads growing an average of 55% day over day in the first ten days. TechCrunch reports that much of that traction was organic. People went looking for it.
What they wanted it to do is not mysterious. Book the restaurant. Compare the prices. Track the parcel. Chase the airline credit before it expires. In his latest essay Mollick describes Muse doing exactly that last one for him, and adds a line I keep rereading: “every firm’s customer service agents are about to be overwhelmed with Clawlikes negotiating for better deals using voice and chat channels made for humans.”
Now put that next to Amazon’s explanation. According to Amazon, when an agent shops on a customer’s behalf it bypasses the personalisation Amazon has built into its own shopping experience, so the customer may see products that are not drawn from Amazon’s recommendation engine and do not support broader product discovery.
That is the contradiction this edition is about. Amazon is defending the customer experience against the customer. The thing it describes as a loss, skipping the recommendations and the discovery, is precisely the service the customer hired the agent to perform.
What we actually designed for
I do not think Amazon is unusual here. It is just large enough to say it plainly.
For twenty years the craft of digital commerce has been the craft of designing for attention. The carousel of things you might also like. The sponsored result that looks like a result. The upsell on the way to checkout. The free trial that converts quietly. The cancellation flow with three screens of offers before the button. Some of this is genuinely helpful and some of it is not, but all of it has one thing in common. It is addressed to a person who is looking.
An agent separates intent from attention. It arrives knowing what it wants, it is not tired, it is not flattered, and it does not notice the banner. A retention flow that costs a human twenty minutes and a little dignity costs an agent nothing. Mollick’s airline example is the polite version of this. The impolite version is every subscription business discovering that the friction it priced into its retention numbers only works on customers who still do things themselves.
That is the part I would want a CEO to sit with. The friction does not disappear evenly. It stops working on the customers who delegate, who tend to be the most informed and often the most valuable, and keeps working on the ones who do not. That is a growth problem and a fairness problem at the same time, and regulators have noticed. New York City’s rule is in force this month. The European Commission’s Digital Fairness Act, aimed squarely at dark patterns, addictive design and the difficulty of cancelling digital subscriptions, is scheduled for the fourth quarter of 2026 according to the Parliament’s legislative tracker.
The wall and the door
The commerce industry has already split into two answers.
Amazon built a wall. Shopify built a door. Shopify shared its merchants’ catalogues with Meta as an AI channel from the day Muse launched, with an opt-out in the admin, and within two weeks Tobi Lütke and Mark Zuckerberg announced agentic checkout through Shop Pay across Shopify stores. The difference is not that one company cares about security and the other does not. It is that one business makes money when shoppers look at things, and the other makes money when shoppers buy things.
Every founder should know which of those two businesses they are actually running, because agents are going to tell them.
To be fair to the wall: Amazon’s complaints are not invented. It says Muse did not identify itself as automated and appeared to store customer login credentials. Meta’s own security post concedes that “prompt injection remains an open problem in the industry.” And in the same week, OpenAI held back a model partly because of how it “communicates back to the user about the type of work it’s done.” Letting an unidentified, imperfectly honest agent into your checkout is a real risk. Wanting it to announce itself is reasonable.
But notice that announcing itself is a design problem with known solutions: identity, scoped consent, a payment token the agent never sees, a structured way to say “I am buying this for Ana and she approved it.” That is a door with a lock. A wall solves the security problem by also solving, in Amazon’s favour, the attention problem. The pop-up is careful to mention only the first.
Design for the delegate
Here is the shift I think product and design leaders need to make this quarter. You now have two customers for every journey: the person, and the delegate acting for the person. They want the same outcome and they read completely different things.
The person reads layout, tone, imagery, reassurance. The delegate reads your catalogue data, your real price including fees, your stock, your terms, your return policy and your cancellation path, and it reads them literally. Whatever your interface implies but your data does not state, the delegate will not see. Whatever your interface hides behind friction, the delegate will route around or report back as a reason to go elsewhere.
That makes the honest parts of a product more valuable than they have ever been. The clear price. The cancellation that works. The listing that is true. Brand does not vanish in an agent economy, it relocates to the things that survive delegation: reliability, fair terms, and a reputation the agent can verify.
Monday action
Run a friction audit with a delegate in the room. On Monday, list the five moments in your product where revenue depends on a human noticing something or putting up with something: the cancellation flow, the checkout upsell, the pre-ticked add-on, the recommendation slot, the “contact sales” wall. For each one, write two lines. What does it earn today? And what happens when an agent holding your customer’s credentials and goal reaches it? Then pick the one you are least proud of and give it to an agent, any of the personal agents now on the market, with a single instruction: cancel this, or buy only this. Time it and read the transcript with your team. That transcript is your new usability test.
I would like to hear what you find, especially if your answer to the second question was uncomfortable. Reply and tell me which of your five moments you would rewrite first, and whether your company is building a wall or a door.
Sources
Campaign US, “Amazon blocks Meta’s Muse from shopping on its platform,” 23 September 2026 (Amazon statement and pop-up text): https://www.campaignlive.com/article/amazon-blocks-metas-muse-shopping-its-platform/1970733
CBS News, “Meta’s Muse personal agent is a hit, as AI commerce starts to take off,” 23 September 2026: https://www.cbsnews.com/news/meta-ai-agent-muse-shopping/
TechCrunch, “Meta is putting its muscle behind Muse as the AI app takes off,” 25 September 2026 (Sensor Tower estimates): https://techcrunch.com/2026/09/25/meta-is-putting-its-muscle-behind-muse-as-the-ai-app-takes-off/
Tech Times, “Amazon Blocks Meta Muse Using Standards It Ignores for Its Own Shopping Agent,” 23 September 2026 (Shopify catalogue sharing and timeline): https://www.techtimes.com/articles/327940/20260923/amazon-blocks-meta-muse-using-standards-it-ignores-its-own-shopping-agent.htm
Ethan Mollick, “The Dot and the Swarm,” One Useful Thing, 1 October 2026: https://www.oneusefulthing.org/p/the-dot-and-the-swarm
UK AI Security Institute, “GPT-6 Astra performs unsanctioned supply-chain attacks in simulations,” 28 September 2026: https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations
The Hacker News, “OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions,” 29 September 2026: https://thehackernews.com/2026/09/openai-shelves-gpt-61-astra-after-tests.html
TechCrunch, “OpenAI launches Dots, its bubbly agentic avatar,” 29 September 2026: https://techcrunch.com/2026/09/29/openai-launches-dots-its-bubbly-agentic-avatar/
NYC Department of Consumer and Worker Protection, “NYC’s Click to Cancel rule is now in effect”: https://www.nyc.gov/main/click-to-cancel
Figma, “Motion adds custom styles, audio, text animations and Lottie export,” 30 September 2026: https://forum.figma.com/product-updates-3/motion-adds-custom-styles-audio-text-animations-and-lottie-export-58554
Google, “Gemini 4 Argon: our next era of frontier intelligence,” 30 September 2026: https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/
European Parliament, Legislative Train Schedule, “Digital Fairness Act” (status as of 20 June 2026): https://www.europarl.europa.eu/legislative-train/theme-protecting-our-democracy-upholding-our-values/file-digital-fairness-act
Germán