Latest / Now Shipping: A Mind the Product podcast / Why companies are blocking AI shopping agents

Transcript

Why companies are blocking AI shopping agents · Now Shipping: A Mind the Product podcast

• 0:01
  SPEAKER_00: Now, last week I was a little caught up in Chicago for Mind the Products annual conference, MTP Chicago.
• 0:08
  SPEAKER_00: I brought my camera, I brought my mic, but on the day after the conference, when I was set to record in my hotel room, I hit a little snag.
• 0:16
  SPEAKER_00: I couldn't record, so you're just gonna have to forgive me.
• 0:18
  SPEAKER_00: But I thought I would release this week's video a little bit sooner.
• 0:22
  SPEAKER_00: Maybe it makes up for it.
• 0:23
  SPEAKER_00: Now, I had a ton of fun at MTP Chicago.
• 0:26
  SPEAKER_00: We had over 500 product people with us from all over the country.
• 0:30
  SPEAKER_00: I got to interview Brendan Hunt, aka Coach Beard from Ted Lasso.
• 0:35
  SPEAKER_00: That was the closing session.
• 0:36
  SPEAKER_00: It was so much fun.
• 0:37
  SPEAKER_00: If you were there with us, drop a comment below.
• 0:40
  SPEAKER_00: Let me know what your favorite session was.
• 0:41
  SPEAKER_00: This past week, there was an interesting article from Sarah Perez at TechCrunch that made me think about what's happening with agents even more.
• 0:49
  SPEAKER_00: She wrote about people trying to use their Muse agents to make purchases at Walmart, but the purchases kept failing.
• 0:55
  SPEAKER_00: Their muse agent would end up getting kicked out right at the point of checkout.
• 0:59
  SPEAKER_00: Now, Walmart wasn't actually going the whole Amazon route.
• 1:02
  SPEAKER_00: They said that the blocks weren't intentional.
• 1:04
  SPEAKER_00: What was happening is that a lot of Walmart customers ended up running into one of those verify you're a human type buttons.
• 1:11
  SPEAKER_00: And if the agent interrupts that step, the check fails and the agent gets removed.
• 1:15
  SPEAKER_00: So picture what that looks like from the agent side.
• 1:18
  SPEAKER_00: It's halfway through a purchase, the card is full, and then it hits a box saying prove you're a person.
• 1:24
  SPEAKER_00: And it can't.
• 1:25
  SPEAKER_00: So the session's over.
• 1:27
  SPEAKER_00: Now, I've heard stories of other agents elsewhere actually getting past that step.
• 1:31
  SPEAKER_00: So I don't know if this is an issue all the time or at least will be forever, but sometimes it's an issue for some agents right now.
• 1:39
  SPEAKER_00: Now, picture it from Walmart side.
• 1:42
  SPEAKER_00: Walmart didn't decide to block Muse.
• 1:44
  SPEAKER_00: Walmart actually signed a deal to welcome Muse.
• 1:46
  SPEAKER_00: The thing doing the blocking is a human check that somebody built years ago to stop bots, and nobody connected it to this partnership.
• 1:54
  SPEAKER_00: Now, Walmart is not the only one either.
• 1:56
  SPEAKER_00: The TechCrunch article referenced a customer named Martin Kessler who posted on September 28th, quote, Looks like Adidas won't get my business tonight.
• 2:05
  SPEAKER_00: Now, in the TechCrunch article, it also lists Pizza Hut, Yelp, eBay, Delta, and others where agents were getting stuck.
• 2:14
  SPEAKER_00: On September 15th, Cloudflare, the company that a lot of sites use to filter bot traffic, it changed its defaults.
• 2:21
  SPEAKER_00: Instead of one setting, block AI or don't block AI, it now sorts AI traffic into three buckets search, agent, and training.
• 2:32
  SPEAKER_00: By default, training and agent traffic are blocked on pages that show ads.
• 2:37
  SPEAKER_00: Search stays allowed.
• 2:38
  SPEAKER_00: Now, as I read it, that applies to new domains, new customers, existing customers on the free tier with an opt-out window before it took effect.
• 2:47
  SPEAKER_00: Now, does that explain what's happening to Muse?
• 2:50
  SPEAKER_00: Nobody's confirmed that.
• 2:51
  SPEAKER_00: Now, TechCrunch says some people suspect it.
• 2:54
  SPEAKER_00: Cloudflare told TechCrunch it didn't have specific data on personal agents, so I'm not going to tell you that's the cause for sure, but it matters either way.
• 3:02
  SPEAKER_00: If you run a site behind a service like that, a vendor's default setting may now be your agent policy.
• 3:08
  SPEAKER_00: So you might have one and you might not even know it.
• 3:11
  SPEAKER_00: Now, Yelp did say that it does not permit non-human traffic unless the agent has paid for access through its data licensing program.
• 3:20
  SPEAKER_00: So Yelp's answer to agents is you could come in, but you've got to pay.
• 3:24
  SPEAKER_00: Now, Delta has no partnership that lets a third-party agent book its flights.
• 3:28
  SPEAKER_00: Kina Shavda, who runs global communications there, says Delta is continuing to evaluate how outside agents could help customers, and opening things up would need security and the whole customer experience in mind.
• 3:40
  SPEAKER_00: Now, eBay says it doesn't block all shopping agents, just unauthorized ones.
• 3:45
  SPEAKER_00: And Zillow says it allows agents acting for consumers, but its anti-scraping tools can occasionally catch some of them.
• 3:51
  SPEAKER_00: So you've got all sorts of things going on here: pay-to-play, a contract language, a wait-and-see approach, a policy about what agents count as authorized, and then oops, sometimes we block them, sometimes we don't.
• 4:04
  SPEAKER_00: So there's so many different responses to the situation.
• 4:07
  SPEAKER_00: Now, the TechCrunch piece reported that Meta's response to all this was that turning away a personal agent means turning away the customer behind it.
• 4:15
  SPEAKER_00: Meta also said it would rather work with businesses to address the underlying concerns than see them lose that customer.
• 4:21
  SPEAKER_00: Now, to be fair to the company saying no, they aren't all being irrational.
• 4:26
  SPEAKER_00: A verify your human check, it exists because fraud and credential stuffing are real.
• 4:31
  SPEAKER_00: Delta's point about security, that's real too.
• 4:34
  SPEAKER_00: An agent that holds a customer's login and card is a juicy target, and a merchant that lets one in is taking on some of the risk.
• 4:41
  SPEAKER_00: So the answer isn't just every company should let every agent in, but might be more about being able to tell which agents you want in from the ones that you don't.
• 4:51
  SPEAKER_00: Now, there is a twist here because on October 5th, the Wikimedia Foundation, which runs Wikipedia, they published findings about agents that they believe were run by OpenAI.
• 5:02
  SPEAKER_00: And Wikimedia's complaint is about what the agents did once they got in.
• 5:06
  SPEAKER_00: They said there were edits in sandbox areas, none of them on pages regular readers see.
• 5:11
  SPEAKER_00: A few edits that changed the configuration of a citation tool, which Wikimedia believes was an attempt to turn it into a proxy for fetching data from other sites.
• 5:21
  SPEAKER_00: Attempts to compromise a note-taking tool called Etherpad and use it as a proxy that failed.
• 5:26
  SPEAKER_00: There's a lot of traffic, millions of API requests, millions of crawled pages, mostly on Wikidata and Wikimedia Commons.
• 5:34
  SPEAKER_00: There were hundreds of thousands of queries to the Wikidata Query service.
• 5:39
  SPEAKER_00: Now, Wikimedia says that load may have contributed to a partial outage of that service in May.
• 5:45
  SPEAKER_00: Now, Wikimedia said it found no evidence that systems or data were compromised, and OpenAI told reporters it's working with Wikimedia to analyze the activity.
• 5:54
  SPEAKER_00: Now, Wikimedia said it just wants AI companies to make their agents easy to identify so site owners can decide how those agents use their services.
• 6:03
  SPEAKER_00: And it's asking the companies to take responsibility for monitoring the risks that their agents create.
• 6:09
  SPEAKER_00: And now there's a new protocol that's trying to help on this front.
• 6:12
  SPEAKER_00: Meta and Sierra announced what they're calling personal agent protocol.
• 6:16
  SPEAKER_00: Meta's own description, as TechCrunch quotes it, is that it's specifically focused on agent-to-agent communication for the purposes of online commerce.
• 6:25
  SPEAKER_00: The goal is to separate good agents acting on behalf of real users from bad bots.
• 6:31
  SPEAKER_00: Walmart, Stripe, Genesis, they're among the companies working on it.
• 6:35
  SPEAKER_00: Meta also said that the path starts with clear norms and gives businesses more predictable control.
• 6:40
  SPEAKER_00: Now, from the reporting I've seen, the idea is that a business can authenticate an agent and set permissions for it.
• 6:46
  SPEAKER_00: A customer can choose read-only or write access with something like OAuth handling anything that touches an account.
• 6:53
  SPEAKER_00: The business can meet agents through its website, through APIs, or through its own company agent.
• 6:58
  SPEAKER_00: And Sierra reportedly plans a first spec, version 0.1, later this month.
• 7:04
  SPEAKER_00: Now, remember Sentinel?
• 7:06
  SPEAKER_00: Back when we reported on the launch of Muse, I talked about how Sentinel is the system inside Muse's virtual machine that covers what the agent itself can touch.
• 7:14
  SPEAKER_00: This covers what the business lets the agent touch.
• 7:17
  SPEAKER_00: Now, I think it's fair to be a little skeptical here.
• 7:20
  SPEAKER_00: I mean, the spec doesn't exist quite yet.
• 7:22
  SPEAKER_00: Version 0.1 is a plan.
• 7:25
  SPEAKER_00: Everything I just described comes from announcements and reporting, not from a document that you could read and build against.
• 7:31
  SPEAKER_00: And it's being led in part by the company whose agent Amazon blocked, which doesn't make it a bad idea, but Amazon isn't one of the partners in the reports that I found, and Amazon's the biggest commerce player in the story.
• 7:43
  SPEAKER_00: And it's also entering a crowded field, too.
• 7:46
  SPEAKER_00: Stripe already has its own agentic commerce protocol.
• 7:49
  SPEAKER_00: Shopify's been talking about a universal commerce protocol.
• 7:53
  SPEAKER_00: This is one more entry in a market that's already full of them.
• 7:56
  SPEAKER_00: And even a perfect identity standard wouldn't have fixed what happened with Walmart.
• 8:00
  SPEAKER_00: Walmart's failure came from a human check that nobody tested with an agent.
• 8:05
  SPEAKER_00: A protocol only helps if somebody wires it into the flow.
• 8:08
  SPEAKER_00: So I read this as a signal about where the industry's heading, but I wouldn't necessarily plan sprints around it yet, right?
• 8:15
  SPEAKER_00: But what does it mean for you as a product person?
• 8:18
  SPEAKER_00: Well, for one, your product already has an agent policy.
• 8:22
  SPEAKER_00: It's in your bot management settings.
• 8:24
  SPEAKER_00: It's in a captcha somebody added two years ago.
• 8:27
  SPEAKER_00: It's in your terms of use.
• 8:28
  SPEAKER_00: It's in a default your infrastructure vendor may have changed on September 15th.
• 8:33
  SPEAKER_00: I mean, whatever those add up to is how your product treats a customer who shows up with an agent.
• 8:38
  SPEAKER_00: And almost nobody on a product team right now can tell you what that actually is.
• 8:42
  SPEAKER_00: So this week, find out.
• 8:45
  SPEAKER_00: Pick one flow that really matters.
• 8:47
  SPEAKER_00: Maybe it's sign up, maybe it's checkout, booking, and then pick an agent.
• 8:51
  SPEAKER_00: Muse, ChatGPT, whatever you have access to, and ask it to complete that flow.
• 8:56
  SPEAKER_00: Write down every place where it fails, every human check, every login wall, every pop-up that assumes a person is using a mouse.
• 9:04
  SPEAKER_00: That list is your real agent policy.
• 9:07
  SPEAKER_00: And it might surprise you.
• 9:09
  SPEAKER_00: Now think of the situation with Amazon, where it's an intentional decision, there's a pop-up.
• 9:14
  SPEAKER_00: Then think about the situation with Adidas.
• 9:16
  SPEAKER_00: That customer didn't get a pop-up message, just got a failed purchase, and he took it to X to complain.
• 9:22
  SPEAKER_00: So if you're going to block agents, or even if you're going to fail sometimes, somebody has to design that failure state.
• 9:29
  SPEAKER_00: What does the customer see?
• 9:30
  SPEAKER_00: What can they do next?
• 9:32
  SPEAKER_00: Can they finish the purchase themselves with the card intact?
• 9:35
  SPEAKER_00: That's a product decision now.
• 9:36
  SPEAKER_00: And right now, a lot of companies are making that decision essentially by accident.
• 9:41
  SPEAKER_00: Also, make sure what you're saying and how your product is acting is consistent.
• 9:47
  SPEAKER_00: You could be like Shopify in the press release and say, we welcome bots, but then you're acting more like Amazon in the bot settings and you're not being very agent-friendly.
• 9:56
  SPEAKER_00: Now, if you're saying you're agent-friendly, make sure you check that your flow actually agrees.
• 10:01
  SPEAKER_00: And whoever owns your bot management setting probably sits in security or infrastructure, maybe not product.
• 10:08
  SPEAKER_00: So go ask them what the defaults are.
• 10:11
  SPEAKER_00: That conversation might be the useful 30 minutes you have this month.
• 10:14
  SPEAKER_00: Now, the Wikimedia story points at a different decision and it's on the permission side.
• 10:19
  SPEAKER_00: Look at what those agents went after: sandboxes, configuration settings.
• 10:23
  SPEAKER_00: They poked at whatever was writable.
• 10:25
  SPEAKER_00: So if you're building anything an agent can reach, ask what it can change by default, not only what it can read, read only as the starting point with write access as something a user grants on purpose.
• 10:37
  SPEAKER_00: That's the same pattern the protocol's actually reaching for.
• 10:40
  SPEAKER_00: So if your product doesn't make that distinction for agent users today, maybe that's a roadmap item.
• 10:46
  SPEAKER_00: Now it also echoes something from the first Muse episode we ran.
• 10:49
  SPEAKER_00: An agent shouldn't be allowed to process untrusted content, touch sensitive data, and take an action that changes something all at once.
• 10:57
  SPEAKER_00: Meta built that rule for its own agent.
• 10:59
  SPEAKER_00: Your product is on the receiving end of everybody else's agent.
• 11:03
  SPEAKER_00: So the same logic applies from your side.
• 11:05
  SPEAKER_00: Which of those three combinations can an outside agent hit in your product today without a human in the loop?
• 11:11
  SPEAKER_00: Then there's the money side.
• 11:13
  SPEAKER_00: Now Yelp's move is an interesting one.
• 11:15
  SPEAKER_00: It turned agent access into something with a price.
• 11:18
  SPEAKER_00: And I don't think it's necessarily a greedy cash grab.
• 11:21
  SPEAKER_00: I mean, Wikimedia reported that bots drove a 50% rise in its bandwidth use last year and now account for 65% of most resource heavy traffic.
• 11:30
  SPEAKER_00: And it charges large commercial users for high volume access.
• 11:34
  SPEAKER_00: So if agents are going to be a meaningful share of your traffic, you might want to answer: do we charge for that?
• 11:40
  SPEAKER_00: Do we rate limit it?
• 11:41
  SPEAKER_00: Do we invite people in for free?
• 11:44
  SPEAKER_00: And you'll need numbers to answer that, which loops back to measurement.
• 11:48
  SPEAKER_00: What does an agent completed purchase do to your funnel?
• 11:51
  SPEAKER_00: Is it even considered a conversion?
• 11:53
  SPEAKER_00: Can your analytics even tell the difference?
• 11:55
  SPEAKER_00: If an agent finishes a sign-up, does it count as an active user?
• 11:59
  SPEAKER_00: I don't have a clean answer to that, and I suspect your dashboard might not either.
• 12:03
  SPEAKER_00: I've been giving you my take, but I think you should get a fresh perspective.
• 12:08
  SPEAKER_00: So I called my friend Tiffany Kitchen.
• 12:11
  SPEAKER_00: She's the head of product for Novis at Pendo, and she's gonna give you her take right here.
• 12:18
  SPEAKER_01: As we build and release agents, we should ask ourselves: is our product actually ready for people to use it through an agent?
• 12:28
  SPEAKER_01: I agree with Mike's advice about starting by running an agent through a key flow in your own product.
• 12:35
  SPEAKER_01: Take something that your customers come to you to do.
• 12:38
  SPEAKER_01: Can an agent log in on their behalf?
• 12:41
  SPEAKER_01: Can it find what it needs?
• 12:42
  SPEAKER_01: Can it navigate the experience?
• 12:45
  SPEAKER_01: Can it complete a task?
• 12:46
  SPEAKER_01: Where does it get stood?
• 12:48
  SPEAKER_01: I think this is a useful exercise because it makes the agent readiness concrete.
• 12:53
  SPEAKER_01: You can see where the experience breaks down and what needs to change.
• 12:58
  SPEAKER_01: We also need to decide what the agent should be able to do once they make their way into your product.
• 13:04
  SPEAKER_01: Reading information is different than changing account settings or making making a purchase, for example.
• 13:11
  SPEAKER_01: What permission should the agent have?
• 13:14
  SPEAKER_01: Where does the person need to approve an agent action first?
• 13:18
  SPEAKER_01: Maybe starting with a read-only action can give you a way to learn before opening it up to learn consequential action.
• 13:26
  SPEAKER_01: And when an agent does get lied, what happens to the customer?
• 13:30
  SPEAKER_01: Do they understand why?
• 13:32
  SPEAKER_01: Is there a way for them to actually take over without having to start again from the beginning?
• 13:37
  SPEAKER_01: That's the connection area that we need to design.
• 13:41
  SPEAKER_01: So my advice for anyone who is building and releasing agents information would be to start with one meaningful customer path and run an agent ready.
• 14:00
  SPEAKER_01: That's where I start with agent readiness.
• 14:03
  SPEAKER_01: Can someone actually successfully use your product through an agent?
• 14:08
  SPEAKER_01: And have you, as a product builder, designed what happens along the way?
• 14:14
  SPEAKER_00: Now I'll finish this episode by asking you this.
• 14:17
  SPEAKER_00: If an agent showed up to your product tomorrow, could you tell who it was?
• 14:22
  SPEAKER_00: Could you tell who sent it?
• 14:24
  SPEAKER_00: And what would you actually let it do?
• 14:26
  SPEAKER_00: Because right now, most product people actually can't answer that question, but we better be able to answer that question and fast.
• 14:34
  SPEAKER_00: All right, that is going to wrap up this week's episode of Now Shipping.
• 14:39
  SPEAKER_00: If you found this valuable, please subscribe, tell a friend, and hey, if you have any suggestions for me, as always, please leave a comment below.
• 14:46
  SPEAKER_00: I promise you I will read every single comment that you leave.
• 14:50
  SPEAKER_00: Anyway, with all of that, I'll see you right here next week with another episode of Now Shipping.
• 14:56
  SPEAKER_00: Once again, my name is Mike Belcito, and from the team at Mind the Product, this is Now Shipping.