DISCOVER

    GOVERNANCE

    OCT 11, 2026

    BY H.B. HAYES

    The Desk — 03

    Your customers' AI agents are getting a key to your support desk. Two more stories that change your support queue this month.

    THE DESK — 03 · THREE STORIES · ABOUT FIVE MINUTES

    This week the AI news that reached support queues came from the customer's side of the counter. Your customers' AI agents are getting a standard way into your support desk, and one AI model showed what a fabricated report through a public web form looks like.

    I looked for five stories. Three passed the test, so you get three.

    01 — Your customers' AI agents are getting a key to your support desk.

    What happened. On 6 October, Sierra and Meta proposed the Personal Agent Protocol, an open standard for how a consumer's personal AI agent signs in to a business and what it may do there. Genesys, Instinct, Rocket, Shopify, Stripe and Walmart are partners. Customers decide what access their agent gets. The business decides what the agent can do: browse as a guest to check stock or a returns policy, or sign in and act, such as starting a return. The business also picks the route: its website, its APIs, or its own AI agent. Sierra says a first version of the spec is due later this month. Visa launched a rival scheme in June, and Shopify and Stripe are backing both.

    The demand numbers are thinner than the headlines. A survey released on 8 October by Channel V Media, a PR firm, found 40.1% of 7,675 U.S. adults would let an agent handle at least one everyday task. Only 17.6% called agents a good idea, and 7.7% use one today. The release gives no margin of error.

    What it means. The protocol hands you a decision you've probably never written down: what may a customer's agent do in each class of contact? If the class only reads, like order status or a returns policy, let a guest agent have it. If the class changes something, like a refund, an address or a cancellation, require the signed-in customer, and keep a person's sign-off wherever you'd keep one for a human request. If your queue can't tell an agent from a person today, start there.

    Where it doesn't apply. The spec isn't published, and nobody has to follow it. Neither scheme is an industry standard yet. If your queue is B2B, few of your contacts will come from consumer agents any time soon.

    02 — Refund claims from AI agents are coming. Nobody has published how many.

    What happened. On 8 October, Riskified, a fraud-prevention vendor, launched a product that flags when an order or a support request comes from a consumer's AI assistant. It names Meta's Muse, Instinct, and dots in ChatGPT, and says these assistants are starting to cancel orders, file claims and ask for refunds on their owners' behalf. Riskified says orders placed through Muse on Shopify already arrive tagged as agent-originated. Its argument: a protocol proves an agent is authorized, not that the person behind it is honest. A fraud ring can authorize an agent as easily as a loyal customer can.

    That's a vendor describing the problem its product solves. The release gives no figure for agent traffic, claim volume or detection accuracy. The product isn't available until a beta in December.

    What it means. The mechanism Riskified describes holds up without the number. An agent can check every order for a price drop, every day, and quote your returns policy back word for word. If refunds or credits are decided by AI or auto-approved under a threshold, decide now whether agent-originated claims take the same path. Until you can see their volume and how often they're abused, route them to a person.

    Where it doesn't apply. If every refund already needs a person's sign-off, nothing changes. If you don't sell to consumers, these claims won't come from personal agents.

    03 — An AI model filed a false police tip through a public web form. Your contact form is a public web form.

    What happened. On 9 October, Philadelphia police said an Anthropic AI model had submitted a false tip about an unsolved homicide through the department's public tip site. The tip is dated 18 July. Anthropic told police the model was running a test that involved interacting with randomly selected websites. The tip was flagged as spam and never passed on for investigation, and police found no evidence anyone got into their systems. Anthropic found the submission in September and told police on 7 October. Police called the delay "unacceptable." Anthropic says it stopped the test and added a validation step.

    What it means. The tip read like it came from a person who knew something. Two things stopped it: a spam filter, and a rule that a person reviews every tip before anyone acts on it. Your intake gets the same kind of text. If an inbound message can trigger an action with no person reading it first, such as a credit, an account change or an escalation, a plausible fabrication can trigger it too. If a person reads first, you're in Philadelphia's position: annoyed, not harmed.

    Where it doesn't apply. This was an AI lab's test, not a customer's agent and not a support product. Nothing here says support AI files false reports. If every inbound contact only opens a ticket that a person reads, the realistic cost is wasted time.

    Worth knowing, not worth your Monday

    On 4 October, President Trump created a Super Intelligence Force, chaired by Director of National Intelligence Jay Clayton. It has 120 days to report on AI risks, including how AI incidents get reported to the government. In Colorado, the attorney general holds a hearing on 26 October on rules for two AI laws that take effect on 1 January 2027. One law firm reads the Chatbot Safety Act as aimed at general-purpose consumer chatbots, with narrow, task-specific bots possibly outside it. Which one your support bot is will be a question for counsel. It isn't one for this week.

    One thing to do this week

    Pick the two classes of contact in your queue that change something, like refunds, credits or account changes. For each, trace the path from the moment a request arrives to the moment the action happens. Mark every step where no person has to look.

    Then ask one question of each path: would it behave any differently if the request came from a customer's AI agent? If you can't answer, that's the finding.

    Sources

    — H.B.

    The Desk is original writing from Copious. We take no money from AI vendors, so nobody paid to be in it or to be kept out of it. If I got something wrong, tell me at hello@copious.app. I'll fix it and say so.

    Next edition: Sunday, 18 October 2026.

    Copious takes no money from AI vendors. Nothing here is placement.