Your AI Agent Is About to Do Your Shopping
The most important AI announcement of the month is not a model. It is a handshake.
On October 6, Sierra — the AI company co-founded by Bret Taylor — and Meta announced the Personal Agent Protocol, an open standard defining how your personal AI agent identifies itself to businesses, signs in, and gets permission to act on your behalf. Three days later, Sierra published the first draft specification, nicknamed Poppy, and revealed 35 additional design partners — including OpenAI, PayPal, Visa, Mastercard, Bank of America, Target, and United Airlines. The founding group already included Shopify, Stripe, Walmart, Genesys, and Rocket.
In total, more than 40 major companies are now shaping the rules for a future in which you send an AI agent to handle your errands — checking an order, rebooking a flight, disputing a charge, buying the thing — instead of doing it yourself.
The problem Poppy solves
Right now, when you ask an AI agent to book a hotel or process a return, it does something ridiculous: it pretends to be you. It loads the website, clicks buttons, fills in forms, and hopes nothing breaks. Companies cannot tell an authorized agent from a scraper, so they block both. Consumers get mysterious failures — TechCrunch recently reported Meta’s own Muse agent failing to complete purchases on Walmart.com, tripped up by bot checks at checkout, even though Walmart is an official partner.
Poppy replaces the masquerade with a proper introduction. A business publishes a small discovery file at /.well-known/poppy.json describing how agents can connect. You sign in on the company’s own page via OAuth — the same technology behind “Sign in with Google” — and grant your agent specific permissions: read-only access, write access, or nothing at all. The agent then works through official APIs instead of fake-clicking through pages.
The design splits control sensibly: you decide what your agent may do; the business decides what it allows agents to do at all. An agent permitted to check your balance is a very different risk from one permitted to move money, and Poppy makes that distinction explicit.
Why the partner list is the real story
Standards live or die by adoption, and this roster is unusually heavy. It spans both sides of every transaction: the personal agents (Meta’s Muse is explicitly in the picture), the merchants (Walmart, Shopify, Target), the payment rails (Stripe, PayPal, Visa, Mastercard), the banks (Bank of America, Wells Fargo, BBVA, Chime), and the infrastructure (Cloudflare, Plaid, Zendesk). Stripe’s head of payments put it plainly: when customers send an agent, they expect the same service they would get themselves.
Two absences are conspicuous. OpenAI joined the design-partner list on October 9 — it was not in the original October 6 announcement. Anthropic, meanwhile, was not on board as of the announcement, according to CNBC’s reporting. The standard-setting fight is still open, and it matters which labs sign on.
What this means for your wallet
As a consumer: within a couple of years, delegating purchases, subscription management, price tracking, and travel booking to an agent could be as normal as using a credit card online — but with explicit, revocable permissions instead of handing over your password. Start thinking now about which tasks you would actually delegate, and what “read-only” versus “can spend” means for each one. The permission model is the whole ballgame for your financial safety.
As a seller or side hustler: agents are about to become a customer segment. If your store, booking flow, or service cannot serve an AI agent cleanly, you will lose sales to competitors that can — the Walmart checkout failure is a preview. Shopify and Stripe backing the standard tells you where the tooling will land first: expect agent-ready checkout features to become a selling point, then a baseline expectation.
As an investor or builder: payments are explicitly not in draft 0.1 — they are listed as an open topic — and there is no reference implementation yet. This is a draft, published under Apache 2.0, that can still change in breaking ways. The opportunity window is the gap between now and the stable version: whoever builds the cleanest agent-compatible storefronts, permission dashboards, and spending-guard tools gets there first.
Keep expectations honest
Poppy is a proposal, not a product. Nothing transacts through it today, the examples in the spec are illustrative, and competing approaches (UCP for commerce operations, x402/AP2 for agent payments) define adjacent layers rather than deferring to it. Draft 0.1 could look quite different by the stable release.
But the direction is unmistakable: the industry’s biggest names just agreed that AI agents acting on your behalf — spending your money with your permission — is the future worth standardizing. The handshake is being designed in public. Make sure you understand it before your agent starts shaking hands for you.
Sources: Sierra announcement & Poppy draft 0.1 via reporting in TechStartups (Oct 9, 2026); The FinRate (Oct 10, 2026); DX Today AI (Oct 11, 2026); technical explainer Cellcog; spec notes LupaRiel.