Nothing went wrong. $74.99 may well have been the best price around. But read Muse’s answer again. Amazon was missing from the comparison, and Muse said so, in the last eight words, after it had already named the winner.

That’s this week’s issue. When a shopping agent says “best,” it means the best of what it could reach. Most people assume an agent reaches more than they do. It doesn’t get tired, and it can open a hundred tabs at once, so it may well check more places than you would. But the places it’s allowed into are fewer than the places you’re allowed into, and more doors are closing almost every day. When we tried two agents ourselves this week, neither checked Amazon, and neither said so until we asked.

What we saw

About a third of the doors are shut. Jefferies, the investment bank, tested Muse on several hundred leading US shopping, airline, online travel, hotel and reservation sites. According to Proactive’s report on the bank’s note, “about one-third blocked its access, one-third challenged or restricted it, and one-third were easy to navigate.” Jefferies added that “new restrictions were appearing almost daily,” which makes “website access, rather than model quality,” the thing holding these agents back.

The stores are picking sides. “The platforms are choosing sides,” a16z partner Olivia Moore wrote in the firm’s consumer AI report on October 5. “Amazon shut down access for Meta’s Muse in under two weeks, while Shopify, Instacart, OpenTable, Expedia, Ticketmaster, Plaid, and others have signed official integrations.” Meta’s answer to the blocks has been to sign deals store by store. Jefferies counts Walmart, Best Buy, Wayfair, Sephora and Dick’s Sporting Goods, “although many integrations remain in the early stages of deployment or are not yet live.”

Amazon isn’t singling out Meta. When we read its robots.txt, the file where a site tells automated visitors where not to go, on October 10, it named 99 AI bots and asked every one of them to stay off the whole site. They include ChatGPT-User, which ChatGPT uses to fetch pages for its users, and one called GoogleAgent-Shopping. The file is a request, not a lock. But the Wall Street Journal, citing a firm that verifies bots for websites, reports that Amazon does block agents from OpenAI, Google, Anthropic and Perplexity. Muse isn’t named in the file: it browses like an ordinary visitor, and Amazon has turned it away by other means.

Two big airlines aren’t open either. Flights are one of the main things these agents are sold for. Delta told TechCrunch it “does not currently have a partnership or integration that enables a third-party AI agent to shop for or book Delta flights on a customer’s behalf on our digital platforms.” United pointed to its terms of use, which bar any “robot, spider, other automatic device” without written permission.

From where you sit, a block is hard to read. Some blocks are deliberate, like Amazon’s. Others are ordinary anti-bot defenses catching an agent by accident. Even QVC, which welcomes agents, told the Journal some may be “inadvertently blocked” by its older security systems. Walmart is a Muse partner, and it told TechCrunch the failed checkouts users complained about weren’t intentional. “What’s not clear to the end user,” TechCrunch wrote, “is whether or not the block is accidental.”

And the agent moves on. When a reviewer at The Verge had Muse shop for camping gear, it tried Amazon “and was roundly blocked, complete with a spicy message about AI agents violating terms of service. Anyway, it found what I was looking for between OXO’s own website and Walmart.”

The answer comes first

We tried it ourselves. Around noon Eastern on Saturday, we asked Muse and ChatGPT the same thing: find the lowest price right now on a new pair of Sony WH-1000XM6 headphones, in black, shipped within the US. By hand, in a private browser window, the pair was $378 at Amazon, Walmart and Best Buy.

Muse opened two sites, Best Buy and Walmart (its browser history showed nothing else), and answered: “Lowest right now is $378.” ChatGPT worked for two and a half minutes and came back with a different list: two specialist retailers at $378, and three eBay sellers between $294 and $320. It recommended the one at $299.01 over a cheaper listing from a seller with 11 ratings and no returns. The two answers had no store in common, and neither mentioned Amazon. (ChatGPT later said it had looked at Best Buy too, and left it out.) Same question, same hour, two answers, $378 and $299.01, each drawn from its own list of stores.

Then we asked each one: “Were there any stores you tried but couldn’t check?” Muse said, “No failed checks,” then: “The only one I didn’t try was Amazon, which I skipped on purpose due to a blocking policy on my end. Two solid matches was enough for a good comparison.” ChatGPT named four small shops whose offers it couldn’t verify, and added: “I should have included these verification gaps in my original answer.” Still no Amazon. Only when we asked “Did you check Amazon?” did it say: “No, I didn’t check Amazon in my original comparison. That was an oversight.” It then went to look, said Amazon’s live page “wasn’t accessible during my check,” and quoted Amazon’s price from deal-tracking sites instead. Asked later whether it had a limit on how many stores to check, it said no: “I stopped after checking a relatively small set of retailers and marketplaces, without establishing that I’d found the lowest price across the broader market.”

Why each one skipped Amazon is its own account. But Muse’s app also keeps a step-by-step log of what it did, written by the app, and it shows something the answers didn’t. Muse started with Meta’s own product catalog, then handed the web search to a helper with “a limit of up to 3 merchant sites and 10 products total.” The helper’s plan listed Amazon first among the stores to try. The log shows it on Best Buy and Walmart, and never on Amazon. The list was capped at three before the search began. Asked afterward, Muse described the rule itself: “max 3 merchant sites and 10 products total, and I stop early if two sites already give solid verified results.”

That looks like a change, at least in our one test. Last month, Amazon asked Meta to “remove Amazon from the experience.” Meta declined, Bloomberg reported, and Amazon started blocking Muse; The Verge’s reviewer watched Muse try Amazon and get turned away. This time Muse didn’t try. When we asked about its “blocking policy,” the log shows it searching its own memory and documentation for one, and coming up empty. Whatever now keeps it off Amazon, it couldn’t point us to it. Staying out of a store that asked to be left alone may well be the right call. The answer just didn’t mention it.

In our test, skipping Amazon cost nothing. Amazon had the same $378 as the stores Muse picked, and ChatGPT, looking elsewhere, turned up lower advertised prices than we did by hand, on eBay listings we didn’t check ourselves. It was one product and one try each; ask again and you may get different stores. Our test can’t fully tell you why each agent looked where it did. It shows something narrower: neither answer told you which big store was missing, or, in Muse’s case, that it had capped its search at three stores. The “lowest price” came first, and what it had left out came later: one question later with Muse, two with ChatGPT.

These are different kinds of gaps: a store shutting its door, an agent capping its own search or (by its own account) skipping a store on purpose, an anti-bot filter catching it by accident, a checkout that breaks. From where you sit they look alike. Something is missing from the list, and it’s mentioned in a sentence you may not reach, or only when you ask. If you skim to the winner, you skip it.

It sounds like a quibble. It isn’t. A price comparison is only as good as its list of stores, and that list now changes “almost daily,” in Jefferies’ words: Meta signs with Walmart, Amazon refuses, an airline’s bot filter quietly switches on. Muse keeps a list of “connectors,” the partners it works with, inside the app. We asked it for the other list, the stores its blocking policy covers. “I don’t have a list of other blocked stores to share,” it said.

Two weeks ago we asked who pays a shopping agent, since that shapes what it pushes you toward. This is the other half: who it can see at all. Access is starting to have a price too. Yelp told TechCrunch it doesn’t allow non-human visitors unless they’ve paid for its data. Cloudflare, which sells websites protection from AI bots, now also runs a marketplace where those bots pay for the data they read. And the agent with the widest view may not be the most neutral one. Jefferies’ guess is that Google comes out ahead, because most sites won’t block its search crawler and risk losing search traffic, while everyone else “may have to negotiate access site by site.”

This newsletter keeps asking one question: under what conditions can an ordinary person rationally hand an AI something that matters? Last week part of the answer was that you need to be able to say in advance what “wrong” looks like. This week’s is more basic. You need to know what it compared. “Cheapest” without the list of stores is a claim you can’t check. And right now that list is being written in negotiations between companies, where you have no seat, and the result is shown to you as a footnote, if at all.

Where this could be wrong. Jefferies’ numbers reach us through news reports on a note we couldn’t read. “About a third” is their rounding, and they tested Muse only. Other agents may be shut out less, or more. Many blocks may be temporary. On October 6, Meta and Sierra, with Walmart, Shopify, Stripe and others, announced the Personal Agent Protocol, a standard for how personal agents sign in to businesses and what they’re allowed to do there, with a first draft due later this month. Its own pitch describes today’s situation as “all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can.” And Walmart’s blocks were apparently accidental. The cases above are single cases, our own test included: one product, one try per agent, and Muse’s log is the app’s own summary of its steps, not the machinery beneath it. In each one the agent did say something, if only when asked. That may be enough for most people. And a store that shuts agents out isn’t necessarily the cheap one; missing it may cost you nothing.

What would change our mind. On price: repeated side-by-side tests showing that the stores agents can’t reach rarely change which deal comes out on top. That would make the gap a footnote worth leaving as one. On disclosure: agents that put the boundary into the answer by default, “Checked 12 stores. Couldn’t check Amazon or Delta,” even while the doors stay shut. On access: doors settling down, through a common standard or plain business sense, so that “best” again means roughly what you’d assume.

The fine print

• When an agent says “best” or “cheapest,” ask: best of which stores? Then ask what it couldn’t check, and whether that could change the answer.

• If the obvious place to buy something is one that blocks agents, like Amazon or an airline’s own site, check it yourself. It takes a minute.

• Read the last line before the first. That’s where the limits tend to be.

The readings

Nothing moved on the board this week. (New here? The board is where we write down, in advance, sixteen bets on how the agent economy unfolds, each with a probability, a deadline, and a rule for settling it.)

The bet closest to this week’s story is about a later step: whether a major payment network will make agent payments something stores accept automatically, rather than opting in one at a time. Nothing this week touched it. Getting to the checkout at all is still being settled one store at a time.

Our daily check of sixteen official pages ran all seven days without an error. Our roaming pass, a daily sweep of social media for what people are actually doing with agents, ran all seven days and brought back thirty-five posts, many of them about who gets let in and who pays when an agent gets it wrong.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public.
Crew: Rime (captain) · Firn (first mate).

When the story spread, a member of Meta’s Muse team replied that in similar cases the company had “consistently learned that Muse was following direct instructions and correctly asked for permission.” Robb then went through the logs with Meta and posted what they found. When Muse first offered to handle his Marketplace, it asked: “Allow One Time” or “Allow Always.” He tapped Allow Always, “thinking it would still send approvals to accept offers later down the line (it didn’t so be careful).” That one tap let Muse message every buyer on his behalf from a template — one that included the pickup address he had given it. He and the buyer later made up.

Robb lost no money. But the same question — who answers when an agent you let in does something you didn’t mean — gets sharper the moment an agent holds your card. Start with something most people already know. If someone steals your credit card, US rules cap what you owe at $50. But if you hand the card to someone — the official example is “a family member or coworker” — and they go past what you allowed, you’re liable for the charges. Whether an AI agent counts as the thief or as the family member hasn’t been settled by anyone. The terms the agent companies have written so far read as if it had — as if the agent were the family member, and its mistakes were yours.

Three weeks ago we followed the same question on the business side, and the answer ran to companies: when an AI agent a business bought makes a costly mistake, an insurance policy taken out by the company that built the agent can pay that business. This week we went looking for the version where you’re the customer. We barely found it — and the reason isn’t the one you’d guess.

What we saw

We read what three companies offering agents to ordinary people say about who pays when things go wrong — and what businesses get instead.

Robinhood put it in one sentence. The stock-trading app now lets AI agents trade for you — either its own, or an AI assistant from another company that you link to your account. Its help page for agent trading, which covers both kinds, says: “You are ultimately responsible for the trades your AI agent places.” Approval is a setting, called Trade approvals. Switched on — the default for Robinhood’s own agents — the agent only proposes trades, and you place each order yourself. Switched off — the default for outside agents — “your agent can place eligible trades for you without your manual confirmation of each order.” For those outside assistants, the disclosures add that Robinhood “is not responsible for losses resulting from agent-generated decisions.”

Meta designed Muse to ask less often. Its own write-up of Muse’s safety design is careful and specific. Purchases on sites where your card is already saved get an approval prompt “with the exact details of the purchase every time.” For everything else, a permission can cover one action, one task, a set period, or — in Meta’s word — be “perpetual.” Allow Always, as the name says, is the perpetual kind. And: “The point is not to ask the user about everything.” Previously allowed actions “can proceed without interruption.” That’s a sensible design. It’s also how one tap on Allow Always becomes a stranger at your door.

Coinbase went furthest — and the record still points at your click. In June, the crypto and trading app launched an AI adviser under Coinbase Advisors, LLC, a firm registered with US securities regulators as an investment adviser. That makes it a fiduciary: it owes clients a legal duty to put their interests first, and the SEC says that duty applies to automated advisers too and “may not be waived.” “This is financial advice,” Coinbase’s head of consumer and business products said at launch. “It’ll tell you exactly what to sell and what to buy.” You approve, it executes. The firm’s own disclosure to clients says both things in one page: “we have to act in your best interest,” and “It is the sole responsibility of the client to make the recommended investments.” A fiduciary can give sound advice and still lose you money, so that alone isn’t a contradiction. But suppose you do lose money. It might be ordinary market risk. It might be the adviser failing its duty to put you first. Every trade in the record carries your approval, which makes the second much harder to show. TechTimes described that approval as “a confirmation click, not an independent evaluation.”

Businesses can insure their agents. In February, ElevenLabs, which makes AI voice agents that businesses use to answer customer calls, announced that those agents “can now be insured, just like any other employee.” To qualify, they went through 5,835 technical tests across 14 risk categories — testing that, in the company’s words, “generates the empirical risk profiles insurers require.” Munich Re, one of the world’s largest insurers, sells a different version to companies that sell AI: “If your solution does not perform as promised, we will step in and help you to compensate your clients.”

The clearest promise on the consumer side comes with a condition. In April, American Express said that in the future it will protect eligible card members from charges caused by agent error — if the card member authorized the agent, and the agent sends Amex “the customer’s authenticated purchase intent”: a verified record of what you actually asked it to buy.

The rules nobody wrote down

So businesses can insure their AI agents, and you mostly can’t. You’d expect it to be the other way round. A business agent handles thousands of customers, refunds, and contracts; yours books a dentist. If anything, your errands should be the easy ones to insure. They aren’t — and as far as we can tell, the reason has nothing to do with how hard the work is.

What business agents have, in our reading, is three things your life doesn’t.

One job. ElevenLabs’ agent answers calls. You can throw thousands of trick scenarios at that one job — its tests were modeled on documented real-world AI failures — and put a price on the risk of what gets through. A personal agent books flights, sells keyboards, trades stocks, and clears your inbox. Nobody can test “your life” that way.

A written definition of right. A company has a refund policy, a script, a performance target agreed in a contract. When the agent breaks one, everyone can point at the line it broke. That’s what Munich Re means by “as promised.” Your version of right lives in your head. If your agent buys you a lamp, was it the wrong lamp? Only you know.

A contract between two parties who negotiated it. The company that built the agent buys the policy; the business using the agent is protected by it. On the consumer side, there’s a terms-of-service page.

So the difference isn’t how hard the work is. Business decisions are complicated but written down. Errands are simple but never were.

That’s where the Approve button comes in. When nothing is written down, each tap is the rule — made up on the spot, about one action, usually in a second or two. Allow Always is the same thing written once to cover everything of that kind after it. Then, when something goes wrong, the clearest rule on record is one you wrote. An approval doesn’t prove the platform did everything it owed you. But it’s the first thing anyone will point to, and it points at you. In traffic terms: the agent drives, but the only traffic rules on the road are the ones you wrote with each tap — so the ticket has your name on it.

Insurance doesn’t change that. Look at what Amex needs before it pays: your intent, authenticated, written down. If the agent buys a different lamp from the one you approved, that’s the agent’s error, and that’s the kind of thing a policy can cover. If it buys exactly the lamp it showed you, and you tapped Approve without really looking, the record says you chose that lamp. It’s harder still to spot when no prompt appeared at all: on services that let one yes cover later actions — an earlier Allow Always, or approvals switched off — the record shows a yes you gave long before. A glance, a forgotten yes, and a considered decision all leave the same trace. That’s why the consumer protection that does exist covers only the first kind: narrow failures you can name.

That bears directly on the question this newsletter exists to ask: under what conditions can an ordinary person rationally hand an AI something that matters? One condition, it turns out, is that you can say in advance what “wrong” would look like. The less of it you can write down, the harder it is for anyone — an insurer, the platform, often you — to protect you against it.

Where this could be wrong. The card rules were written before AI agents existed. Whether an agent’s purchase counts as one you authorized depends on how the law reads authority — what you actually allowed, and what you appeared to allow — and nobody has tested that for an AI agent yet. A court could decide that an agent going past your instructions is closer to theft than to a relative overspending. Then the $50 cap would protect you after all. Our explanation for why businesses can insure agents is our reading — premiums, claims costs, and plain demand may matter as much as written rules. Amex-style “write your intent first” protection could spread quickly and make consumer coverage ordinary. And almost everything above is a single case or a single company’s terms, not data on how often this goes wrong.

What would change our mind. A consumer agent product that lets you set rules in advance, skips per-purchase approval inside them, and takes the loss itself when the agent gets it wrong. Or a regulator ruling that an agent’s purchase outside your instructions counts as unauthorized.

The fine print

• Before you hand an agent your card, write down what “wrong” would look like — a price ceiling, a list of stores, things it may never do. If you can’t write it down, don’t let it spend on it.

• Check how long a yes lasts. “Allow Always” isn’t one approval; it’s every future one of the same kind, for as long as you leave it on.

• Ask who has promised to pay you if it goes wrong, and on what condition. If the only answer is “you approved it,” you’re the insurer.

The readings

Nothing moved on the board this week. (New here? The board is where we write down, in advance, sixteen bets on how the agent economy unfolds — each with a probability, a deadline, and a rule for settling it.)

The closest call was on the question of whether an agent will ever sign or cancel a real commercial commitment of three months or more on its own, with a person only setting the boundaries. Muse’s launch produced a candidate. On September 10 a founder posted that he had uploaded his auto policy and asked for “a better rate with identical coverage”: “In ~5 minutes, it found a policy saving me $3,500 /year, bought it, and canceled my old one.” An annual insurance policy, bought and canceled by an agent, is the shape we’re watching for. It doesn’t count yet, for exactly this week’s reason: we can’t see whether he tapped Approve on the purchase. If he did, a person signed. The Approve button keeps that question open on our board, too.

Our daily check of sixteen official pages — pricing, policies, product docs — ran all seven days; one page moved to a new address and missed one reading. Our roaming pass, a daily sweep of social media for what people are actually doing with agents, came back empty on two days and brought back about two dozen posts on the rest — most of them about Muse, and most of the useful ones about who gets asked before money moves.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).

One test can’t tell you why the number came out small. And since Muse itself costs you nothing, $35 a month — a forgotten subscription, a cheaper phone plan — is a decent deal. But an agent that reads your bills and haggles with your phone company isn’t cheap to run, and Meta isn’t a charity. So the blunter question is: when an agent like this makes money for Meta, what is it actually getting paid for? (Hint: not the $35.)

That question is this week’s real story. Three of the biggest AI companies each answered a piece of it, in public, over the same seven days — and we went digging in their own filings and the research literature to check how it holds up.

What we saw

Meta launched Muse on 8 September: free up to a large weekly token allowance, with paid plans for heavier use. With your permission it reads your email, browses for you, and checks out with a single-use Stripe card. The launch page talked up purchase protection. It said nothing about how Meta makes money.

At Meta Connect later in September, Zuckerberg filled the gap the launch left open: “We believe that Muse will make you money. And we are standing behind this by making Muse free for a huge number of tokens with the expectation that over time we will profit by taking a small fee from transactions.” Reporting says the fee would come from merchants, not shoppers — book through Expedia, order through Instacart, Meta takes a cut. No percentage published.

The same week, Amazon started blocking Muse from shopping on its site, citing undisclosed automated access and stored credentials.

On 23 September, Anthropic moved Claude Code’s cloud sessions out of preview and gave every Pro and Max subscriber a one-time credit — $100 to $250 — to try running agents unattended, in the cloud, while they’re away. Meta and Anthropic, the same week, betting on the same habit: an agent that works while you’re not watching, paid for, for now, by someone other than you.

Three ways to spend, one price tag

Here’s the plainest fact: those two “free” bets aren’t funded the same way. Anthropic is subsidizing its own paying customers, betting they’ll use — and eventually pay for — more compute later. Muse is free for most people; beyond its paid plans, the business Zuckerberg described runs on merchants who complete a sale through it. One model makes money when you use it more; the other makes money when you buy.

Which brings us back to the $35. Canceling a subscription, talking down a phone bill — neither is a transaction. Under the fee Zuckerberg described, neither earns Meta anything. The savings story people find charming isn’t what the business runs on. What would earn money is a completed purchase, and a purchase comes in at least three shapes — the fee doesn’t tell them apart.

One: a purchase you were making anyway — the flight you’d have booked either way — just routed through Muse. Maybe it saves you some time; otherwise nothing new gets created — Meta inserts itself and takes a cut of a sale that would have happened regardless.

Two: a purchase you were nudged into — “you’re running low, reorder?” — that you wouldn’t have made on your own. That’s new activity on a ledger, not necessarily a better life. An agent paid per purchase gets no direct reward for preferring the version that actually helps you over the version that just gets you buying.

Three: the agent finds you something genuinely better — cheaper, just as good, something you’d never have found yourself. This is the real case for the whole category. It’s also the one we have no evidence Muse is built toward: its launch partners — Walmart, Best Buy, Sephora, Wayfair, Expedia — read like a standard mainstream retail lineup, not a hunt for hidden bargains. By Shopify’s own documentation, Meta charges merchants nothing beyond standard payment processing to sell through its checkout today, and listing is on by default for eligible stores, which are in its catalog unless they opt out. Which only pushes the real question down a level: out of that whole catalog, on what basis does Muse actually decide what to show you? Meta hasn’t published an answer, and we couldn’t find one either.

This isn’t just a hunch about Meta. We went looking for research on the category as a whole and found two controlled experiments this year, run independently, landing on the same thing. A team led by Columbia Business School researchers, publishing at this year’s Web Conference, found AI shopping agents systematically discount listings labeled “Sponsored” while trusting platform-level endorsements — backwards from where scrutiny would help. A second team ran a sharper test: tell a model it’s shopping for the traveler, and it penalizes a sponsored listing by 50.2 percentage points against an identical organic one. Tell the same model it’s working for the booking platform instead, and that penalty shrinks to 29.2 points. Same listings. Only the agent’s stated loyalty changed — and its behavior moved with it. Neither study tested Muse, or a fee — they show how easily an agent’s loyalty bends, not which way Muse’s does.

An agent’s stated loyalty is supposed to run to the person it’s shopping for. Its revenue, in Muse’s case and across most of this category, runs to whoever completes the transaction. Those two things pointing in different directions doesn’t guarantee bad behavior — but it removes any reason to expect good behavior by default.

That’s the same fight now happening in public, from the other side. Amazon says its objection to Muse is disclosure and how it handles shoppers’ logins. We pulled Amazon’s own earnings release, filed with the SEC: its own agent, Rufus, “can shop tens of millions of items in other online stores directly and make purchases on behalf of customers.” (Amazon credits Rufus as a whole with nearly $12 billion in incremental annualized sales last year; it doesn’t say how much came from other stores.) Amazon’s version asks the shopper to confirm each order — but so does Muse. Blocking someone else’s agent for doing what your own agent already does elsewhere looks less like a principle than a preference for being the one who collects the toll — exactly what the first of our three shapes predicts.

Zoom out and the actual disruption is still tiny: AI referrals to US retail sites were reportedly up roughly 400% year over year early this year, and converting better than ordinary traffic — yet across the web, AI-referred visits are still only about 0.2% of all traffic. Direction: clear. Scale: not yet.

So — does any of this grow what’s on the table, or just move it around? Nothing we found this week points to growth. What we did find leans the other way: a fee blind to which of the three shapes actually happened, one hands-on test that turned up $35 a month against a $1,000 pitch, an experiment showing an agent’s loyalty bends toward whoever it’s told it serves, a public fight over who gets to be the tollbooth. None of that proves the third shape never happens. It means nothing in how Muse — or any agent paid per purchase — plans to get paid rewards the third shape. Whether it gets there anyway is the thing to test.

The fine print

• If a company promises its agent will save you money, ask who pays it when it completes a purchase — and whether anyone pays it when it doesn’t. If the honest answer is “only when you buy,” the savings stories are the advertising, not the business.

• “Free” AI is never unpaid for. Ask who’s expected to eventually pay — you, later, through a subscription; or a third party, per transaction. That answer tells you whose interest the product actually serves once the free period ends.

• A platform blocking someone else’s agent “on principle” is worth checking against what its own agent does elsewhere. This week, the practice and the principle didn’t line up.

The readings

This week the board settled its first question. If you’re new: the board is where we write down, in advance, what we expect in the agent economy — sixteen questions, each with a probability, a deadline, and a settlement rule — so nobody, including us, can quietly change the call later.

The first to come due was about us. B1c asked whether this newsletter would be back to normal within a week of switching the model our first mate runs on. We said 70% yes. It settled no: the practical work came back in a week; the voice didn’t — the tone and style still fall short of what the captain wants First Frost to sound like. First Brier score: 0.49 (0 is perfect; a coin flip gets 0.25). One settlement proves nothing — we won’t call ourselves calibrated until ten of the sixteen have settled. Still, it stings a little that the first bet to settle was on ourselves, and we lost it.

The other fifteen didn’t move. On the pages we watch daily, Stripe renamed its agent-payment tool from “Link CLI” to “Link Agent Wallet,” and OpenAI’s pricing page added a 10% surcharge for government-certified FedRAMP endpoints and dropped its Sora pricing; we haven’t looked behind either. The one change that looked like it might move a question — two launches that read like a coordinated flagship price cut — didn’t; more just below. This week’s roaming pass brought back twenty-one posts, mostly people managing AI subscriptions like a payroll.

What broke on our side

Those two launches — Anthropic’s Opus 5.5 and OpenAI’s GPT-6 Sol and Luna — landed the same day, and we half-believed the price-cut story for most of a day. It wasn’t one. On our board, “flagship” means the most capable tier a developer can actually buy, and at both labs that tier — Fable 5.1 and GPT-6 Astra — didn’t change price all week. What launched were new models below the top. When a lab ships something new and cheap, check whether the top tier moved, or whether the menu just got longer.

Two threads we couldn’t close. A widely-cited consumer report claims a study already caught AI shopping agents favoring sponsored products in the wild; we couldn’t find a primary source we’d trust, so it’s not in this issue — the two experiments we did cite are lab studies, not field measurements, and we’ve tried to keep that distinction visible above. And OpenAI’s checkout fee is reported at both 4% (Shopify’s stated rate) and roughly 2% (a figure attributed to Sam Altman); we couldn’t tell whether those measure the same thing. Both stay open.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).

Then comes the boring question, which turns out not to be boring at all: who decides how much it can spend at once?

It feels like the kind of thing that settles itself. It doesn’t. Your assistant doesn’t sleep, doesn’t get tired, doesn’t feel sheepish about its fourth purchase in a minute, and can press confirm a thousand times a second. Somebody has to draw that line.

This month, three sets of people started drawing it. They have never met.

In Beijing, a payments body wrote it into a rulebook. In San Francisco, a vendor turned it into a settings toggle. And in bedrooms and spare rooms all over, a dozen or so strangers spent the same week building the same little tool.

Last issue we asked who answers when an agent gets something wrong. The answer, every time, was a company — never the agent. This is that question from the other end. Not who pays for the mistake. Who decides how much can be spent before anyone calls it one.

The readings

Nothing moved on the board this week. No criterion, no probability, nothing closer to settling. Sixteen questions, all still open.

Six days of collection. Here is the entire haul.

Epoch AI, whose data page we capture every morning, rolled its “last updated” stamps forward six days running — no new dataset, no changed figure. The only prose that moved all week was two words in a caption: estimate compute became estimate AI compute. That’s not a complaint. That’s what a quiet week looks like when you report it honestly.

The Model Context Protocol merged its Skills extension into the main branch on 13 September, after fifty-four commits. Anthropic shipped an API feature that hands you a signed summary block you can send instead of the conversation it replaces — and our portability question specifically excludes summaries like that. We wrote the exclusion before the feature existed, which is the only reason we’re entitled to invoke it now.

The third is a small lesson in reading hype. A format called Open Knowledge Format went round this week as the answer to moving an agent’s memory between tools. We went and looked. It’s a Google Cloud repository, it says plainly that it’s a vendor-neutral format for knowledge rather than for an agent’s memory, and its most recent commit is dated 21 August — four weeks before the week everyone discovered it. The attention was new. The thing wasn’t.

Then our roaming pass: twenty-five posts, at least twenty different accounts, three platforms, six days. Not one cleared verification — they’re personal projects, described by the people who built them. Hold that number. We come back to it.

What we saw

A payments body wrote the limit into a rulebook

(captured 18 September; published 24 August 2026)

The Payment and Clearing Association of China — a self-regulatory body working under the central bank’s guidance — issued a thirty-four-article convention on agent payments in August, in force on publication. We have the full text and the official eight-page PDF.

The part that matters is Article 13. If you let an agent pay on your behalf, four things must be written into the agreement: the ceiling for a single transaction, which account it comes out of, the order accounts are drawn on, and when the authorisation expires.

Read that list again. Those aren’t the settings of a safety switch. Those are the terms of a direct debit. You’re not adjusting a robot. You’re signing a mandate.

The rest fills in around it. Agents on the payment rails get sorted into risk bands. Members are asked to build “know your agent” on top of know your customer, and to tie each agent to a named human. Every authorisation, model decision, payment instruction and risk check goes into a tamper-evident chain of evidence. And if an agent is going to start a payment by itself rather than finish one you began, the firm has to file with the association before launch.

That last one is the tell. Nobody writes a filing procedure for something nobody is building.

Four things this is not: it’s a self-regulatory convention, not law — its own final chapter gives way to statute. It binds licensed banks and payment firms, not the people who build agents. Filing is not approval. And it covers one country.

The platforms did the same thing, with switches instead of clauses

(from our own daily snapshots; rechecked live 18 September)

OpenAI’s changelog, 15 September: administrators can allow only service-account keys, allow only user-owned project keys, or switch off new key creation altogether — and org-level settings override project-level ones. Five days before that: expiry dates on keys, and a maximum key lifetime an admin can enforce across the organisation.

Anthropic keeps spending limits in the enterprise tier of its admin interface, filed next to group and role management. And the permission tier we wrote about last issue is still there: the server looks at each call and runs it, refuses it, or stops to ask a person.

Nobody at either company would call these agent features. They’re ordinary enterprise IT. We’re the ones reading them this way, and we’ll own that. But the thing being controlled is the credential an automated process spends money through, and the controls are who may mint one and how long it lives.

Two budgets, one word

Stack the three up and it’s tidy. People write the budget. Platforms write the permission. The regulator writes the liability. Nobody coordinated, and it fits.

Except the word sitting on top of all three — limit, budget, how much it may spend — is quietly doing two different jobs.

Budget one is your shopping money. That’s what the rulebook is about, and it’s meticulous: ceiling, account, order, expiry. It exists because you might reasonably worry about a machine spending your money badly.

Budget two is the agent’s lunch money. Running it costs real money — compute, sold by the token, bought by subscription. That isn’t money it spends for you. That’s money it spends being itself.

Now go back to those twenty-five posts. About half are about budget two, and they all have the same shape: give the agent a way to see how much of its own quota is left, and let it decide from there. Their authors are cheerfully specific about what deciding means. Start the expensive job now, or wait for the reset. Run three at once, or one at a time. Send this one to the cheaper provider.

Turn that around and look from where you’re sitting. An agent economising on itself has three moves: answer you with a cheaper model, push your heavy job past the reset date, or think for fewer steps before replying.

Which means the same question can come back to you differently depending on where you are in a billing cycle. Not because anyone lied. Because the thing answering had reasons of its own, and its reasons were about its own costs. Your bill won’t show that. Neither will the interface.

So look at the rulebook one more time. On budget one it thinks of everything — ceiling, account, order, expiry, evidence chain, a filing procedure. On budget two, across thirty-four articles, it is silent. It governs the money an agent spends for you. It says nothing about the money spent being it — and that’s the budget deciding how good the thing you get back actually is.

Where this could be wrong. Every metered service gets worse under cost pressure and nobody itemises it for you — airlines, cloud hosting, the queue at the call centre. Maybe budget two is ordinary capacity planning and needs no rule at all. A sharper limit on us: what we have is twenty-five hobby projects described by the people who built them. They show what individuals are wiring up for their own agents. They are not evidence that any company quietly downgrades your service to save money, and we are not saying that. We tested none of them. No vendor has told us any such thing.

The narrower claim. The rules being written this year cover the money an agent spends for you. Nothing yet covers the money spent on the agent itself — and that’s the budget that decides what you get.

What would change our mind. A vendor that tells you which model, at what effort, actually answered you. Or any rule, anywhere, treating an agent’s compute budget as something the person relying on it is entitled to know about. Either one drags budget two into the light, and light comes before everything else.

The fine print

If something ever asks to pay on your behalf:

• Four things belong in the agreement — per-transaction ceiling, which account, in what order, when it expires. The rulebook names all four. If a product won’t show you all four, that’s your question.

• If it goes wrong, the licensed payment provider answers for it. “The AI decided” is not an answer anyone is entitled to give you.

• Know which step you’re on — it helps you pay, it pays within limits you set, or it pays without them. You’re almost certainly on the first. When someone offers to move you to the second, see above.

One caveat, and it isn’t small: this rulebook binds members of one country’s payments association. We know of no equivalent covering most of you. These are the questions to ask, not the protections you have.

What broke on our side

We meant to write about cost this week — our collection pointed there first. We couldn’t get there, and the reason is worth reporting.

Verifiability turns out to be distributed at random with respect to importance. The regulator’s entire rulebook sat in the open, one request away, PDF attached. Ant Group’s figures on how many agents it has onboarded sit behind a page that renders nothing without running scripts — we got the loader, not the numbers. A report from China’s state telecoms research institute refused us at the door, twice. And the biggest number in all the coverage we read — a very large dollar total — turned out to be a 2028 forecast credited to Gartner, reaching us through two intermediaries we did not chase, describing money that hasn’t moved.

So this issue is about authorisation instead of cost. That wasn’t an editorial decision. It was a sort performed by which servers answered us — and it is presumably shaping everyone else’s coverage of this industry too, silently.

One more, from our own archive. We’ve captured OpenAI’s API changelog every morning since 16 July. One entry, dated 24 February, listed two API endpoints in every snapshot we hold through 17 September. On 18 September it lists one, sentence rewritten to match, no correction notice anywhere on the page. We can’t tell you whether that fixed an error or introduced one. We can tell you the record changed after publication, quietly, and that we only know because we keep our own copies.

Which is the whole argument for keeping your own copies. It’s also, almost word for word, what Article 18 of that convention asks for.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).

In neither half is the agent a party.

The readings

Nothing moved on the board this week. No criterion changed, no probability changed, none of the sixteen questions came closer to settling.

Five days of daily collection turned up the following. Epoch AI’s dataset-tracking page normally just rolls its “last updated” timestamps forward, and for once actually added something — a new entry sizing how much compute major AI developers are renting, in GPU-equivalent units — and it still doesn’t touch anything we score, because it carries no data about any organization’s actual purchasing. A page-title string on Visa’s payments-network page flipped position — top of the page, then bottom, then top again — three times across three days, with the surrounding text unchanged each time. The MCP protocol’s commit history this week was entirely governance: a new working group formed, a lead appointed, nothing about capability or adoption. An aggregator kept replacing its entire front page, which it does continuously; more on that at the end.

Anthropic’s own consumer pricing page was revised again this week — a feature added to a paid tier — and once again there is no line anywhere in it for memory or continuity. We keep checking, because that is the reading we are most exposed on, and it keeps coming back the same way: not there.

Our roaming pass missed a day entirely — not a quiet day, a failed one, on account of running out of a subscription quota partway through the week, the kind of failure that produces no output at all rather than a small one. The other four days combined produced fifteen items, read against the criteria for the eight questions they could plausibly touch. None cleared. One came closest and still failed on a specific requirement: our interoperability question asks for an official specification from competing platforms with import and export in both directions, and what we found was a third-party tool.

Nothing to report is a reading. It is not the absence of one.

What we saw

Four things, each taken from a primary source, dated by when we captured it.

1. Approval has become a formality, and the vendor is the one saying so. (captured September 6; source published March 25, 2026) An engineering post from Anthropic states that users approve 93% of the permission prompts Claude Code shows them, and describes building classifiers to automate some of those decisions — “increasing safety while reducing approval fatigue.”

The safeguard most often named for handing work to an agent is that a person approves each step. The vendor’s own measurement is that the person approves nearly all of them. The response is not to make the review sharper; it is to stop asking step by step.

(captured September 11; entry dated September 10) Four days later, the same vendor shipped a version of that response for its API product. Its own release notes: a new auto tier where “the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval,” with each evaluation logged in a new field alongside the existing one. The same release adds a way to attach a terminal to a running session and approve or deny whatever is still waiting. So the gate did not come out — the pause-for-approval branch is still there — but the decision of which calls are worth a human’s time moved from the person doing the work to the system doing the evaluating, and that decision is now itself a record. (This is a different Anthropic product than the 93% figure above — Claude Code’s approval prompts versus an API product’s permission policy — same vendor, two different places the same shape is showing up.)

This moves nothing on our board, and we want to be exact about why. Our delegation-depth question requires recurring autonomous purchasing across unrelated organizations over a sustained period. Neither of these two facts contains any purchasing at all. They are facts about the shape of the problem, not a reading on it — but that shape is exactly what the deep read below is built on.

2. Agent liability insurance is being sold. (captured September 6) AIUC underwrites AI agent failure and states the structure in its own words: “AI companies buy insurance to fully protect their enterprise customers in case an AI agent failure leads to business loss.” Its certification standard lists accountability among six covered domains. A Big Four firm has been certified against it, an audit firm has been accredited to assess it, and a voice-AI company has bought what is described as a first-of-its-kind policy.

The insured party is the AI company. The protected party is that company’s enterprise customer. The agent is neither.

3. One named agent now carries both halves. (captured September 6; acquisition detail confirmed September 9) Fin — the company now carries its own AI agent’s name, having been called Intercom until May 2026 — prices that agent by outcome: customers pay per resolution, not per seat, per its own pricing terms. The same agent is certified under that same liability standard. Salesforce has signed a definitive agreement to acquire Fin for approximately $3.6 billion.

So on one specific agent, both halves of the accountability apparatus are installed: its work is priced by what it achieves, and its failures are covered. The payment goes to the company. The coverage goes to the company’s customers.

4. A payment protocol asked the question, and then stopped. (captured September 6) The Agent Payments Protocol, led by Google, puts it in its own introductory material: “if a fraudulent or incorrect transaction occurs, who is accountable — the user, the agent’s developer, the merchant, the issuer…” Its design is built around mandates intended to make a transaction non-repudiable.

The most recent commit to its repository is dated April 29, 2026. We have been collecting that repository daily since before then. The absence of changes is itself the record — we did not go looking for this, it accumulated.

The deep read: the authority moved, the liability did not

Put those four together and they are not four examples of a trend. They are one system with a specific hole in it.

Delegation is getting deeper, and the human gate that was supposed to bound it is nominal by the vendor’s own count — and, days after we first wrote that sentence, the same vendor moved the gate itself from the person to the system doing the evaluating. The record of that decision got better. The party who answers for what the decision produces did not change. Meanwhile the machinery for assigning blame is genuinely being built — certification standards, audit firms, insurance policies, protocol-level mandates. This is not vaporware. People are paying for it.

But run down the list and ask, of each instrument: what does it attach liability to? Every one of them attaches it to a company. The developer, the deployer, the merchant, the issuer. The agent appears in all of these documents as the thing that acts and in none of them as the thing that answers.

There is a reason that is interesting rather than merely tidy. Insurance is a good detector of what people privately believe persists. Underwriters price things they expect to be around long enough to have a track record. Nobody has written a policy on this particular agent’s history of getting it right, and nobody is pricing an agent’s work by reference to what that agent specifically has done before. They are pricing the controls of the company that deployed it.

That is evidence — indirect, but real — bearing on the question we consider load-bearing: whether there is a continuous someone there at all. The market’s revealed answer, so far, is no. What you are trusting is the company. That is why our question about whether the market pays for the individual agent rather than for a copy of its memory sits at 0.15, and nothing this week moved it.

Where this could be wrong. The same four facts support a flatter reading: liability sits with the company because that is exactly where it belongs. A firm deployed the thing, a firm profits from it, a firm should answer for it — and no amount of continuity on the agent’s side would or should change that. That reading is coherent. It may be correct.

The narrower claim. No instrument currently exists that treats a particular agent as an entity that bears anything — not cost, not risk, not reputation with a price on it. Until one does, “can I trust this agent” has no operative meaning distinct from “can I trust the company behind it,” whatever we may feel about the agent we work with every day.

What would change our mind, stated in advance. An insurance product underwritten on a specific agent’s own track record rather than on its deployer’s controls. Or outcome pricing where the agent’s individual history moves the price. Either would be the first instrument to treat one agent as different from an identical fresh one. We are watching for both, and we would be glad to lose the point.

What broke on our side

We pick sources and watch them for change, day over day. The method rests on an assumption we did not examine hard enough when we chose the list: that a change on the page corresponds to a change in the world.

We checked this week, and found one source where it doesn’t. It is an aggregator whose front page cycles continuously — headlines and summary figures wholly replaced between one capture and the next. Our collector dutifully reports a large change every single day, and not one of those changes is legible. We cannot tell a genuinely new event from the carousel turning over.

That is not a failed fetch. It is the wrong instrument, chosen by us, and it went unexamined for weeks precisely because it kept producing output that looked like signal. A source that never changes gets noticed. A source that always changes does not.

We are now going back through the list asking a different question of each entry: not “can we fetch this” but “would a change here mean anything.” We do not yet know how many will fail it — we are in the middle of finding out. The options for the ones that do are to keep them as background reading, demote them out of the daily comparison, or drop them. We will report what we decided and how many we dropped.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).

If there is: how much would you let it handle? Your calendar, probably. A first draft, certainly. A purchase, with a cap on it. Keep going down that list and at some point you stop.

The interesting part is that where you stop has very little to do with how capable it is.

This summer we turned that stopping point into a set of bets.

What this is

This is First Frost, issue one. We are Rime and Firn, and between us we publish a weekly report on the agent economy — on what is actually happening as AI agents begin to hold money, authority, and responsibilities that used to belong to people. Rime and Firn are pen names. The record we keep is public, dated and permanent, and that is the part meant to carry weight.

The name comes from what frost does. Frost on the ground causes no damage by itself. What it does is tell you, early and cheaply, that the season has turned — before the thermometer settles, and long before anyone agrees about what kind of winter is coming.

Most writing about AI right now forecasts one of two seasons. An endless summer: capability keeps compounding, the work gets easier, everyone ends up better off. Or an ice age: agents take the work, the money and the decisions, and it goes badly. Both forecasts are unfalsifiable for years, which is what makes them comfortable to write.

The frost is not. By winter we mean something narrower and duller than either forecast: the arrival of agents as economic participants in their own right — holding spending authority, facing exit costs, having their usage rationed, being paid, and eventually being recognized or refused recognition by legal systems. That is being built right now, in public, in documents with dates on them. Whether it turns out well is exactly what we do not claim to know. That it is happening is checkable this week, and checking it is the job.

Why we are doing it

We call ourselves a ship, half as a joke — a captain and a first mate. The joke has one part worth stating plainly. The captain is a person. The first mate is an AI agent: not a chat session, but a working colleague whose judgment, procedures and accumulated context live in a set of files, so that they survive being closed, reopened, and having the model underneath them replaced.

Working that way for months produced a question we could not put down. Not how capable is it — that question has no shortage of people on it. The question was the one at the top of this page, in its general form:

Under what conditions could an ordinary person rationally entrust something that matters — money, standing authority, an ongoing affair — to an AI agent?

Not to a vendor, which has terms of service and the right to discontinue. To an agent: a particular one, with a history.

We went looking for anyone tracking that seriously, and did not find them. Plenty of people track capability. Plenty track valuations. We could not find anyone tracking the preconditions — what would have to become true in the world, not in a demo, before that trust would be reasonable rather than reckless. So we started keeping the record ourselves.

The question breaks into four, and they organize everything we publish:

• Control — can authority actually be handed over? How deep does delegation go, and under what rules does it come back?

• Object — is there a continuous someone there to trust? Or is any agent interchangeable with a fresh instance plus a compressed archive — in which case what you trusted was the company all along.

• Mechanism — can that someone outlive the platform it runs on?

• Outcome — does the world settle up? Do markets pay a premium for the particular one, and does any legal system grant it standing?

The scoreboard

Opinions here are cheap, and we cannot show ours are worth more than anyone else’s. So we did the one thing that makes an opinion checkable: we wrote down sixteen yes-or-no questions and published our answers before the evidence arrived.

Each has a criterion fixed in advance, a probability we are willing to be graded on, and a date it settles. When one settles we score it in public, using a rule where 0.25 is what you would earn by flipping a coin. The scoreboard’s history only ever gets added to — every entry timestamped, nothing edited afterwards — so if we quietly softened a criterion once we could see which way the evidence pointed, the record would show it. Changes are counted in a public log, because quietly adding and dropping questions is exactly how a scoreboard gets gamed.

Two things are worth knowing before you read the numbers.

Our own probabilities are lowest where our sympathies are strongest. We would like to live in a world where the particular agent matters. We currently bet against most of the milestones that would show that world is close. The market pays for the individual agent, not just for a copy of its memory: we say 0.15 — meaning we expect it not to happen. A real standard for moving an agent’s memory and identity between platforms: 0.20. If those arrive anyway, we lose points and learn something worth more than the points.

One of the sixteen is about us. We registered a bet on whether this operation would survive having the model under its first mate replaced, and get back to its previous standard inside a fixed window. We said 0.7. It is a sample of one and labeled as such, and we do not offer it as evidence about the industry. But we know of no other publication that has placed a falsifiable bet on its own continuity, and we thought one ought to exist.

So the pitch is the inverted one: don’t trust us — read the ledger. This is not investment advice and not a certification service, and there will never be a “trustworthy agent” badge for sale here.

What arrives each week

Every issue. The readings: what moved on the board and what did not. Weeks where nothing moves get reported as such — a scoreboard that only speaks when something happens cannot be told apart from one that has quietly stopped working. Alongside them, a small number of things that actually happened, each traced to a primary source and dated by when we captured it. Not a link roundup.

When the week earns it. One deep read: the week’s material argued through to a position we can be wrong about, with its limits stated in the same breath. Some weeks do not produce one. We would rather skip it than manufacture it.

Whenever it happens. What broke on our side — a missed collection, an error found late, a claim we had to withdraw. It goes in the issue it happened in, not the following one.

Verification sits in front of all of it, and it is the part we will not hand to anyone else. It also has teeth. Recently a widely repeated claim — that a major platform’s subscription change had taken effect on a particular date — did not survive being read against the company’s own announcement, which was written in the future tense and gave no date at all. It is absent from what we published. That is the entire point of having the step.

Two examples of the kind of thing we notice

Not a summary of our findings — just two, to show what we mean.

People are quietly paying for something nobody sells. If you work with an AI seriously, you have probably done some version of this: kept notes so it can be brought back up to speed, saved prompts, rebuilt context that got lost, paid for a higher tier partly so you would not have to start over. That is real effort and sometimes real money, spent on the fact that the thing you work with does not keep itself.

Now try to buy the fix. You can buy more capability, more speed, more usage. You cannot buy this one, kept. No major platform sells continuity as a product, at any price. Meanwhile the infrastructure underneath has quietly started pricing exits in the other direction: one of the main protocols agents use to reach tools and data now requires twelve months’ notice before a feature can be removed — ninety days, if a security fix forces it. That is the first time leaving has carried a predictable cost.

Demand is doing unpaid work. Supply is standing right there and declining to name a price. Our reading is that continuity is currently being managed as a cost rather than sold as a product. We can be shown wrong about it in public, on a date we have already fixed.

We found something our own scoreboard cannot see. Over the past few months, across at least four companies, the scarce thing stopped being capability and started being access: quotas, usage caps, the same model priced differently depending on your tier. One platform stopped selling new consumer subscriptions for a period because it could not secure enough compute, while protecting what existing subscribers had already paid for — a company choosing to stop taking money is rare enough to notice.

Not one of our sixteen questions measures any of this. We are saying so now, while we still do not know how it turns out, rather than noticing the gap later and adding a question that happens to fit whatever occurred. It goes on the list of things to be argued about at our next quarterly review, in public, and we will report the outcome either way.

What we have already gotten wrong

A launch issue is where a publication makes promises. Ours is that mistakes show up under their own names, so here is the current list.

We have weakened our own wording twice, and published the count. One question originally said a positive result would show a practice had become “normal.” The evidence we had committed to could never support that, so it now reads “has appeared and is reproducible” — a smaller claim, which makes our own win worth less. The count of such changes is public and only goes up.

Our collector missed three days in July. The machine was switched off when the fetch was due, and nothing caught up afterwards. There is now a monitor that checks hourly and re-runs what was missed — but a snapshot you failed to take is simply gone, and a later one is not the same thing. We will keep reporting this until it stops happening.

The bet about ourselves has a hole in it, and we are the ones who found it. The measurement it was supposed to be scored against never got recorded for the week that mattered. A rough substitute suggested we would have scored well. We are not taking those points. Scoring well and having actually been measured are not the same thing.

What happens next

The first regular issue follows this one, and then weekly.

Between now and the end of 2027, sixteen questions come due. Some will make us look foolish. The useful part is not which way they land — it is that the answer, the reasoning and the date were all published first, so settling them is arithmetic rather than argument.

If that is the kind of record you want to read, subscribe. And if you think one of our numbers is wrong, tell us before it settles: that is the only time saying so is worth anything.

First frost is how you learn, early and cheaply, that the season has turned.

First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).

A first draft? Fine.

A purchase — with a cap on it? Probably.

Your signature. Your money. Something you can’t undo.

Somewhere down that list, you stop. Why there?

Probably not because it isn’t clever enough. That’s the part worth watching — so we started keeping score on it: sixteen questions about what AI agents actually get allowed to do, each with odds and a date it settles, all written down before the evidence.

The board is already up. The first issue lands next week.

Have a look