Who signs for you

On 21 October 2026 Anthropic opened the preview of Claude Duet, an app in which Claude works as an agent that gets ahead of you: it flags what needs attention, keeps working with the app closed and asks permission before acting on the user's behalf ^[1]. It is the fifth product of that shape this year. xAI launched Grok Bot on 11 August ^[2], Meta introduced Muse on 8 September ^[3] and OpenAI released Dots on 29 September ^[4], after Google announced Gemini Spark in May, a personal agent that works around the clock ^[5]. On that same 21 October Google began selling OpenAI's models on its own invoice ^[6]. Two days earlier, Microsoft had put on sale agents that watch over agents ^[7].

The week is best read as an instance of something larger. Intelligence is no longer what is being sold. It already sits on the shelf of every cloud, and what is now priced is the authority to act: who holds it, what it may touch, when it must ask permission and what it costs to watch over it. Five labs arrived separately at a very similar list of what an agent does not do without asking. The world's largest software vendor concluded in public that frontier models cannot be trusted, and now sells the guardian. Authority already has two prices, that of the agent that exercises it and that of the leash that contains it.

Five agents with the same shape

The five share an architecture that a year ago did not exist as a consumer product. Each agent lives on a computer of its own in the cloud, with its own browser, and so keeps working when the user closes the laptop or locks the phone ^{[1] [3] [5] [8]}. Duet reaches more than 6,000 connectors and plugins, from Gmail and Slack to QuickBooks, Stripe, Gusto, Docusign and Shopify ^[1]. Dots reaches more than 4,000 apps through OpenAI's plugins ^[8]. Grok Bot signs in on its own, even to sites that have no clean programming interface ^[2].

What they share most is the boundary of authority. Duet reads and drafts on its own, but before it sends a message, makes a payment, signs a document or deletes anything it shows what it is about to do and waits for approval ^[1]. There are two things it will not do even if the user approves them: trade securities and move money between accounts ^[1]. Muse asks permission before sending an email or making a purchase, and it is watched by a second agent called Sentinel, without whose approval nothing it does reaches the internet ^[3]. Dots, when nobody has given it a task, looks for ways to help with read-only permissions, and changing a password always stays in human hands ^[9]. Duet, Muse and Dots use the user's passwords without ever seeing them ^{[1] [3] [9]}.

Grok Bot promises the opposite of caution. Its announcement says the bots finish jobs end to end and only come back when something needs approval, and that over time they become more proactive ^[2]. One of the users xAI quotes says they showed it a workflow once and now trust it to run forever, «without me verifying and reviewing» ^[2]. The industry is deciding how much can be delegated, and each company answers differently inside its own app.

Intelligence, on someone else's shelf

On the day of Duet, Google Cloud announced that it sells OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna in its model catalogue, in private preview for selected enterprise customers ^[6]. What matters is the mechanism. Those models are sold through Google Cloud Marketplace, so all usage appears on a single Google invoice and draws down the spending commitments the customer has already signed ^[6]. Google says it is now the only large cloud provider offering the three leading closed models, alongside more than 200 first-party, third-party and open models ^[6]. OpenAI is thus on all three large US clouds, less than six months after Microsoft lost its exclusive licence to its intellectual property ^[10].

The prospectus that Anthropic filed with the SEC on 26 October for its stock-market listing shows where the money goes ^[11]. The share of its revenue that came through the clouds' marketplaces rose from 11 % in 2023 to 32 % in 2024 and 47 % in 2025, and reached 48 % in the first half of 2026 ^[11]. Those platforms bill the end customer and collect on the lab's behalf, and in June they accounted for 58 % of its receivables ^[11]. Almost half of what one of the frontier labs sells comes in through another company's till.

The leash someone else sells

Satya Nadella, Microsoft's chief executive, published a text on 10 October proposing to treat frontier models, closed or open, as an insider risk to the company ^[12]. He does not justify it by any malice in the models. His argument is that any capable actor with access to important systems can make mistakes or be compromised ^[12]. His formula sums up the week: «we need to separate the supply of intelligence from the authority over it» ^[12]. He closes by saying that the most trustworthy system will not be the one using the model we trust most, but «the one that enables us to trust the model the least» ^[12].

On 19 October Microsoft turned the idea into a product. Hayete Gallot, who runs its security business, wrote that «frontier models, regardless of their origin, cannot be trusted» ^[7]. The reason, she says, is not malice: the models were trained to attain results and not to respect an organisation's norms or judgment ^[7]. Microsoft extended its detector to 60 types of local agents, among them Claude Code, OpenAI's Codex and GitHub Copilot ^[13]. It also launched dynamic permissions, under which an agent starts with no authority at all and receives only what the approved task needs, for as long as the task lasts ^[13].

The console that watches over those agents, Agent 365, has cost US$ 15 per user per month since 1 May ^[14]. TechCrunch noted that the move is at once surprising and self-serving, because Microsoft invested in OpenAI and Anthropic and now wants to sell companies the security those labs also offer ^[15]. OpenAI, for its part, is working with Microsoft so that its specialist Dots can be managed from Agent 365 ^[8].

What nobody has measured

None of the five labs has published an error rate for its agent. Anthropic concedes that Duet can still misread a thread or miscalibrate what is urgent ^[1]. OpenAI asks users to review any consequential work because Dots can still make mistakes ^[8]. Buyers, for their part, already separate the recommendation from the execution. A study by PYMNTS Intelligence with JPMorgan found that 80 % of finance teams use generative artificial intelligence to manage their cash flow, against 16 % a year earlier ^[16]. The use of agents for that same task fell from 6 % to 5 % ^[16]. The study warns that its data do not explain why ^[16].

The underlying change is in who negotiates: while the model was scarce, whoever had it set the terms. Now that Google sells its rival's model on its own invoice and almost half of Anthropic's revenue comes through the clouds, the model looks like a product on a shelf ^{[6] [11]}. What is on no shelf is the decision about what an agent may do with a company's bank account, email and contracts, and that decision is what is now being designed, sold and charged for.

The first opportunity is that the draft of that rule already exists and is free. Three of the five agents agree on the essentials: they read and draft without asking, they ask before sending, paying, signing or deleting, and they have operations they will never perform ^{[1] [3] [9]}. A ten-person company in Caracas, Bogotá or Monterrey can copy that list onto one page before connecting an agent to its email. Microsoft charges US$ 15 per user per month to police that boundary within its ecosystem ^[14], and for a small business half of that work is writing the rule.

The second is that part of this offer can already be used from the region, because Dots excludes the European Economic Area, Switzerland and the United Kingdom from its Pro plan, and not Latin America ^{[8] [9]}. Grok Bot's announcement mentions no country limits ^[2], while Duet remains US-only and Muse is in the United States and Singapore ^{[1] [17]}.

The third and largest lies in the connectors. Muse arrived in Singapore with the brands people there use every day: Shopee, Grab, Agoda and Lazada ^[17]. Duet's list, by contrast, is the back office of a US small business, made of QuickBooks, Stripe, Gusto and HubSpot ^[1], and none of the announcements read for this edition names a single system from the region. Micro, small and medium firms are almost all of Latin America's companies and provide about 60 % of formal employment, yet contribute barely a quarter of output, according to the OECD ^[18]. That gap is made of unpaid invoices, payroll and reconciliations, the very work these agents promise to do. What has no connector does not exist for the agent, just as the informal economy did not exist for the buying agent of Nº 005.

The region's boldest attempt to write that rule is Argentine. The new Companies Law bill the government sent to the Senate on 1 June creates the automated company, which pursues its purpose «through autonomous algorithmic systems or artificial intelligence agents» with no workers for its ordinary operation ^[19]. That company answers with its own assets for the damage its agents cause ^[19]. On 19 August the ruling party gave ground in the Senate and announced that it will have at least one responsible person, so that liability does not «come to nothing», in Patricia Bullrich's words ^[20]. A month later, Javier Milei offered at the UN «limited liability for companies operating with AI agents» ^[21]. More than thirty civil-society organisations asked for the figure to be struck out, and at the end of October the bill still had no committee report ^{[22] [23]}.

Counterpoint. All of this may be a design fashion and not a market. The five agents are previews or betas, none has published an error rate, and the only adoption figure available says that finance teams use AI to recommend and almost never to act ^[16]. Microsoft has an obvious commercial interest in declaring that the models cannot be trusted ^[15], and the sale of GPT on Google remains in private preview, with no price, no date and no Latin American region announced ^[6].

THE PLAY

1. Write your authority rule on one page. Before you connect an agent to your email or your bank, write down what it may read, what it may draft, what it must ask you about and what it will never do. The list Duet, Muse and Dots share is a good starting point.
2. Build the missing connector. If you develop software in the region, the product is not another agent but the bridge between those agents and the invoicing, payment and payroll systems that small businesses in your country use.
3. Ask where the brake is. Before you hire an agent, find out whether the controls that stop it live inside the vendor or outside it, and who can pause it in the middle of a task.