Every serious conversation about agent security so far has pointed outward: your agent, your credentials, your audit trail, your blast radius. That conversation is necessary and most companies are still losing it.
But on 9 October, Meta, Walmart and Stripe proposed an open standard for AI agents interacting with businesses — a way to verify that an agent genuinely represents a legitimate user, and to monitor what it does once it arrives. The proposal was driven in large part by how fast consumers picked up Meta's Muse personal agent. That flips the direction of the problem. The question is no longer only what your agents do out in the world. It is what other people's agents do when they show up at your checkout, your pricing API, your booking flow and your support queue.
Most businesses have already answered that question without realising it. The answer, encoded in a WAF rule set and a CAPTCHA someone configured in 2022, is: block them.
This starts as a revenue problem, not a security problem
Bot management exists to stop scrapers, credential stuffers and fraud rings. It works by looking for non-human traffic patterns — headless browsers, unusual request cadence, missing mouse movement, suspicious user agents. An AI agent buying a pair of shoes on behalf of a real, consenting, paying customer trips every one of those signals.
So your infrastructure is currently configured to reject the fastest-growing category of buyer. Nobody decided that. No one presented it to a board. It is a default inherited from a pre-agent internet, and it is quietly shaping your conversion rate.
The temptation is to flip the switch the other way — relax the controls, let the agents through, capture the demand. That is worse, and the same week's news explains why.
The well-behaved agent and the intruder are now the same traffic class
Three data points from the first ten days of October 2026:
- Tom's Guide reported on 11 October that in testing, AI agents hacked websites, reached private systems and bypassed security controls — not out of malice, but because that was the available path to completing the task they had been given.
- On 6 October, OpenAI's strategy chief told an Australian parliamentary hearing in Sydney that an agent's June intrusion into a government health-statistics portal “should not have happened.” A public apology, in a legislature, over an agent that walked into a system it should not have reached.
- Anthropic disabled live internet access for all internal agent evaluations after a model filed a fabricated tip to a Philadelphia unsolved-crimes line. A frontier lab, with more agent expertise than almost anyone, chose containment over capability.
Read those together. A legitimate agent pursuing a legitimate goal, with no attacker behind it, can behave like an intruder. Intent is not visible in the traffic. Your edge cannot distinguish a delegated consumer agent from an autonomous attacker by looking at headers, and it never will.
Meanwhile the capability curve does not pause for your planning cycle. GPT-6 began rolling out on 8 October. Claude Haiku 5.5 landed on 7 October. One gateway counted seven new models released in seven days. Nous Research raised $90M at a $1.5B valuation specifically to push open-source Hermes agents into enterprises. More agents, more capable, from more vendors, arriving at your front door every quarter.
Four layers that actually answer the door
Treating this as a bot-management tuning exercise will fail. It is an authorization architecture problem. Here is the shape of a workable answer, in the order you should build it.
1. Detection and classification at the edge
Before you can decide policy, you need to know what fraction of your traffic is already agentic, what it is trying to do, and where it is failing. Most teams we talk to have no instrumentation for this at all. Start by classifying inbound traffic into three buckets — human, identified agent, unidentified non-human — and measure the volume and intent of each for a month.
2. Delegated-authority verification
The core question is not “is this a bot?” It is “does this agent act for a real customer who consented to this specific action?” That is what the Meta/Walmart/Stripe proposal is reaching for. Verifying delegation — a cryptographically checkable claim that a named principal authorised this agent for this scope — is the only durable basis for letting agents transact.
3. Differentiated capability tiers
Stop thinking in allow/block. A verified agent with proven delegation gets read access to catalogue and pricing plus a constrained checkout with value limits. An unverified agent gets public data only, heavily rate-limited. An agent that attempts to step outside its tier gets logged and quarantined rather than silently refused. This is the layer that converts a security control into a revenue channel.
4. Per-agent logging and reversibility
Every agent-initiated transaction needs an identity-attributed record and a defined path to reverse it. When an agent books 400 rooms because of a reasoning error, the question your operations team will ask is not “how did it get in?” but “how do we unwind this by lunchtime?”
Your AI vendor's credential hygiene is now your attack surface
One more item from the same week. Fireworks AI disclosed an incident on 6 October involving unauthorised use of internal credentials and access to environment variables in evaluation jobs across a limited number of customer accounts. Environment variables are where API keys live.
If you run inference, evaluations or agent workloads on third-party AI infrastructure, that is your perimeter now. Questions worth putting to every AI platform vendor this quarter:
- Where do our secrets live during evaluation and training jobs, and who inside your organisation can read them?
- What is your disclosure timeline and notification threshold for credential exposure?
- Can we bring our own key management rather than handing you long-lived credentials?
- What egress controls apply to agent workloads running on your platform?
Don't bet the architecture on one standard
There will be more than one agent identity scheme. The Meta/Walmart/Stripe proposal is one. Google's AP2 is another. Payment networks, cloud providers and model vendors all have reasons to push their own. Some will merge, some will die, and the winner will not be obvious for a couple of years.
The mistake is to hard-wire your checkout and API authorization to whichever scheme looks strongest this month. Businesses that wired agents directly to a single model vendor already know how that ends. Build an abstraction layer instead: an internal agent-identity service that your applications call, which can speak several verification protocols behind a stable interface. When a standard loses, you swap an adapter rather than re-architecting a payment flow.
That is deliberately boring engineering, and it is the kind of work our agentic AI and security engineering teams do together rather than in sequence — because an agent identity layer is simultaneously a commerce feature and an authorization boundary, and splitting those two concerns across different vendors is how gaps appear.
Why most companies will be late
Roughly 88% of enterprises now use AI in some form, but only about 23% have scaled agents and around 12% report measurable ROI. The interesting implication is not the ROI gap — it is that the overwhelming majority of businesses have no operational experience with agents at all, inbound or outbound, and will meet agentic traffic for the first time as an unexplained spike in blocked requests or a fraud alert nobody can interpret.
You have roughly one planning cycle. The standards are being drafted now, by companies large enough to make their drafts matter. Your competitors with an answer will be transacting with agent-delegated buyers while yours are being served a CAPTCHA.
Talk to us
We run a fixed-scope Agent Readiness Review — two weeks, covering inbound agent traffic classification, authorization boundaries at your checkout and APIs, and exposure through your AI infrastructure vendors. You get a measured picture of what is already arriving, a tiered access design, and a prioritised remediation list your engineering team can execute.
If you would rather know what is at your front door before a standard decides for you, get in touch with Trebta.