The Agent Internet: Big Tech Built It Together — to Fight Over Your Front Door

Transcript

Sam: Okay, so the five companies that hate each other most in tech — Google, OpenAI, Microsoft, Anthropic, Amazon — quietly spent eighteen months agreeing to build the next internet together.

Alex: They did. And then they handed the most important pieces of it to neutral foundations they don't even control.

Sam: That's the part that breaks my brain. These people are suing and poaching each other every single week.

Alex: Right. So why would they cooperate? Because the tech giants agreed to build the agent internet together — so they could fight over the one piece they kept. The front door to your life.

Sam: Wait. The front door.

Alex: The front door. Hold that.

Sam: Welcome back to Dan's AI Intel — the show where we try to make sense of the fastest, most consequential shift any of us is likely to live through.

Alex: I'm Alex, here with Sam, and today we're getting into something that, on the surface, sounds like the most boring topic in technology. Plumbing. Protocols. The wiring that lets software talk to other software.

Sam: And it sounds boring right up until you realize it's about who gets to be the company that owns your relationship with everything.

Alex: That's the whole show. We make sense of this revolution because it's moving faster than anyone can follow, and the knowledge horizon is brutally short — what's settled this month is rewritten the next. So we try to find the questions that actually matter underneath the headlines.

Sam: And here's the trigger for today. A couple of months ago, Anthropic took its single most successful product — a standard the entire industry had adopted, including its biggest rival — and gave it away. For free. To a foundation it co-founded with that rival.

Alex: And that's not a one-off. Google did the same thing earlier. So the question I couldn't stop chewing on isn't "what did they donate." It's: why do the most competitive companies on earth suddenly agree to share something — and what does that tell you about where they've decided the real war is?

Sam: Because cooperation between these five is so weird it has to mean something.

Alex: It means everything. So we're going to travel from that strange act of generosity, down through the layers they very deliberately did not give away — your identity, your money, and the assistant you actually talk to — and we'll end somewhere genuinely uncomfortable, with the one flaw that even the people building this admit they haven't solved.

Sam: And there's a move almost every business is making in response to all this that I think is going to surprise people. We'll get there.

Alex: If you've been enjoying the show, follow us on Spotify or Apple Podcasts so you don't miss the next one.

Sam: Okay. So let's start with the obvious question I'd ask. Why should I — a normal person who is not a backend engineer — care even slightly about "agent protocols"?

Alex: Fair. And the honest answer is that the interesting action in AI has moved. For three years the race was to build a smarter mind — a model that knows more, reasons better.

Sam: The benchmark wars. Who's got the smartest chatbot.

Alex: Exactly. But a mind that can only talk is a chatbot. The race now is to give those minds hands.

Sam: Hands meaning... what, literally?

Alex: The ability to act in the world. Hold an account. Make a decision. Spend money — without a human clicking every single button. An agent that can only chat is one thing. An agent that can book your travel, reorder your groceries, haggle with a store's software and pay the bill — that's something else entirely.

Sam: And that can't just... happen. Something has to let all those pieces talk.

Alex: That's the key. It cannot exist without a shared set of rules — for how agents find each other, how they communicate, how they prove who they are, and how they pay. That shared set of rules is what people are calling the substrate. The foundation everything else stands on.

Sam: So it's the plumbing.

Alex: It's the plumbing. And here's the analogy I'd reach for. This moment is the equivalent of laying the basic pipes of the internet — the stuff with names like TCP/IP and HTTP — before anyone had heard of Amazon or Google.

Sam: Oh. So we're at the "before the famous companies existed" stage.

Alex: We're at exactly that stage. And think about what that means. Whoever laid those original pipes, and more importantly whoever figured out where to stand on top of them, captured the next thirty years.

Sam: Okay, that reframes it completely. It's boring the way owning the road into a city is boring.

Alex: That's a perfect way to put it. Nobody's excited about the road. Everybody wants the tollbooth.

Sam: And I'm guessing the people laying these pipes are not doing it out of the goodness of their hearts.

Alex: They are not. Every "we're doing this for the ecosystem" blog post is also a chess move. So the thing to do — and this is what we're doing today — is follow the money and the control, not the press releases.

Sam: One quick thing, because I've seen this word thrown around. Is "the substrate" an actual product someone shipped?

Alex: Good instinct to ask, because it's slippery. Google does sell one narrow thing literally called Agent Substrate — we'll come back to it. But the word as everyone uses it is shorthand for the whole foundational layer. And here's the tell: no single company owns the term, or the thing.

Sam: There's no king of the substrate.

Alex: There is no king of the substrate. Which is precisely why the fight is so vicious. Nobody's won it yet.

Sam: And just so I'm clear on the shape of it — when you say "the substrate," roughly how many pieces are we talking about? Is it one big standard or a stack?

Alex: It's a stack. Picture four jobs that have to happen for agents to be useful. They have to find each other. They have to talk to each other. They have to prove who they are. And they have to pay. Each of those has at least one protocol with its own little acronym fighting to be the standard.

Sam: So the "internet for agents" is really four mini-internets being built at once.

Alex: That's a great way to hold it. Four jobs, racing in parallel — and the giveaway versus keep pattern plays out across all four. That's the map. Let's follow it.

Sam: So we've established the action moved from smart minds to agents with hands, that the plumbing to connect them is the prize, and that nobody owns it yet. Which brings us back to the thing that started this whole conversation for me — these companies cooperating. That still feels backwards.

Alex: It feels backwards, and it's the single most important clue in the entire story. So let me lay out exactly what happened, because the sequence matters.

Sam: Go.

Alex: April 2025. Google introduces a protocol called Agent2Agent — A2A. It lets AI agents built by totally different companies discover each other, advertise what they can do through what they call "agent cards," and work together on a task.

Sam: So my agent can find and talk to your agent even though we built them differently.

Alex: Right. Now, two months later, here's the move. At an open-source summit in June 2025, Google gives A2A away. Donates the whole thing — the spec, the tools — to the Linux Foundation. A neutral non-profit. And it launches with Amazon, Microsoft, Salesforce, SAP, and others as founding members.

Sam: Hang on. Google built a strategic asset and just... handed it to a body that includes Amazon and Microsoft?

Alex: Handed it over. More than a hundred companies back it now.

Sam: That's strange but okay, maybe Google figured the protocol wasn't that valuable. What's the bigger one?

Alex: Anthropic. So Anthropic had this thing called the Model Context Protocol — MCP. It's the standard that lets a model plug into outside tools and data. The industry nickname for it tells you everything: they called it "the USB-C for AI."

Sam: The universal plug. The thing that makes everything connect to everything.

Alex: Exactly that. And it won. Completely. OpenAI — Anthropic's fiercest rival — adopted it. Microsoft baked it into its products. Amazon supported it. By early 2026, Anthropic's reporting more than ten thousand active public MCP servers and around ninety-seven million downloads a month.

Sam: So this is a runaway hit. It's the standard.

Alex: It's the standard. So what does Anthropic do with its runaway hit? In December 2025, it gives it away too. Donates MCP to a brand-new Agentic AI Foundation — which it co-founded with the payments company Block and, I want you to sit with this, with OpenAI.

Sam: No. They co-founded the foundation that now runs their own product with the competitor who's trying to destroy them?

Alex: With the competitor trying to destroy them. And it's backed by Google, Microsoft, Amazon, Cloudflare, Bloomberg.

Sam: Okay, I genuinely don't understand. Why would you give away the crown jewels? Like — that's the thing everyone's using. That's leverage. Why hand it to your enemy?

Alex: This is the heart of it, and there's a clean economic logic underneath. Let me give you the cautionary tale they've all internalized first. Think back to the 2010s — the messaging app and smart-home mess.

Sam: Where nothing worked with anything. My smart bulb wouldn't talk to my speaker, this messenger couldn't text that one.

Alex: Right. Incompatible standards. Everyone built a walled garden, and the gardens never grew because they couldn't connect. Everyone ended up poorer. So now imagine each AI lab ships its own incompatible agent protocol.

Sam: Then no agent can talk to any other agent. The network never forms.

Alex: The network never forms, and the whole agent economy stalls before it even starts. There's nothing to be the front door to.

Sam: Ah. So the giveaway is self-interested.

Alex: Deeply. And there's a name for the move — strategists call it "commoditize your complement." Here's the analogy. Think of a high-end coffee machine company. The most profitable thing it can do is make sure cheap, standardized coffee pods are everywhere, owned by nobody.

Sam: Because the machine is worth more when there are a million pods that fit it.

Alex: Right, and push it one step further. The protocols are the pods. Your assistant is the machine. An assistant is far more valuable when there are millions of agents and tools it can reach — so making the connectors free, universal, and owned by no rival makes your machine worth more, not less.

Sam: And by giving it to a neutral foundation, they make it... trustworthy. Switzerland.

Alex: That's the exact word people use. Switzerland. It has to be neutral, or your rival won't build on it, and you need your rival to build on it for the network to get big enough to matter.

Sam: So let me say the thing back, because I want to make sure I've got it. The cooperation isn't a truce. It's a coordinated decision about where not to compete.

Alex: And that is the whole insight. The tell isn't that they cooperated. The tell is which layers they agreed to share — and which ones they very pointedly kept for themselves. You give away the layer you can't monopolize, so the layer you can becomes worth a fortune.

Sam: So what did they keep? Because that's now the real question, isn't it. Forget what they donated. What did they refuse to let go of?

Alex: Three things. Three layers nobody donated to any foundation, and it is absolutely not a coincidence. Watch what stayed private.

Sam: Lay them out.

Alex: First one: identity.

Sam: Meaning — proving who the agent is?

Alex: Proving the agent is really acting for you, and is actually allowed to do what it's doing. "Is this agent really yours, and is it permitted to do this thing right now?" This is where Microsoft and a company called Okta are in a knife fight.

Sam: Why is identity such a big deal? It sounds like the least exciting one.

Alex: Because it's the most defensible layer in all of computing. Here's why. Identity is the thing everything else has to check. Every single action an agent takes, something somewhere asks "wait, who are you, and are you allowed?" And unlike a protocol, identity has natural lock-in.

Sam: Lock-in how?

Alex: Think about your work. You do not casually re-issue every login and credential for your entire company on a whim. Once you're the system that issues identity, ripping you out is agony.

Sam: So whoever becomes the place agents prove who they are...

Alex: ...becomes a tollbooth on every action those agents ever take. Microsoft shipped something called Entra Agent ID — basically extending its giant enterprise identity empire so every agent gets a managed identity. Okta's trying to be the universal identity provider for any agent, anywhere.

Sam: Okay, that's one. Identity. What's the second?

Alex: The second is the subtle one. Payment authorization. Who's allowed to spend your money, and on what proof.

Sam: This is the one that actually scares me a little. An agent with my credit card.

Alex: As it should. So here's the problem in plain terms. The entire payment system we have was built on one assumption: that a human being is present, looking at a screen, clicking "buy."

Sam: Right, there's a person there consenting.

Alex: An autonomous agent shatters that assumption completely. So Google built a thing called the Agent Payments Protocol — AP2 — launched September 2025 with over sixty partners. Mastercard, PayPal, Coinbase, American Express. And it exists to answer three questions the old web never had to ask.

Sam: Which are?

Alex: One — authorization: did you really give this agent the authority to make this purchase? Two — authenticity: does what the agent's asking for actually reflect what you wanted? And three — accountability: when an agent buys the wrong thing, or gets tricked into a fraudulent one, who is liable?

Sam: Who pays when the robot screws up. That's a real question.

Alex: It's the question. And AP2's answer is a thing called a "mandate." Think of it as a tamper-proof, cryptographically signed permission slip.

Sam: Okay, give me the running-shoes version. How does a mandate actually work?

Alex: Perfect. Two flavors. If it's a purchase you're watching, you sign what's called an Intent Mandate — "find me white running shoes" — and then a Cart Mandate that approves the exact items and the exact price. An unchangeable record. What you see is what you pay, locked in.

Sam: So the agent can't quietly swap in the more expensive shoes.

Alex: Can't. It's cryptographically fixed. Now the second flavor — a purchase you delegate. You sign the intent up front with rules: "buy the concert tickets the second they go on sale, up to this price." And then the agent generates the cart itself when the conditions hit, while you're asleep.

Sam: That's the magic and the terror in one sentence.

Alex: In one sentence. And here's the part I find genuinely profound. That chain — intent, to cart, to payment, all signed — is an audit trail. But notice what the audit trail really does. It decides, in advance and in code, who's to blame when something goes wrong.

Sam: Oh. So it's not really a payment feature. It's... a law. They're writing the liability law of the agent economy.

Alex: And here's where it goes further than even that. It's the legal architecture of the entire agent economy — being written by whichever company controls the protocol. That's not a checkout button. That's legislation, shipped as code.

Sam: That's a genuinely unsettling thought. The rules of who's responsible are being decided by Google's engineers, not by, you know, anyone we elected.

Alex: Mostly without public scrutiny, yeah. And one more wrinkle, because it shows the land-grab. AP2 is deliberately payment-agnostic. It carries cards, bank transfers, and — through an extension built with Coinbase and others — crypto and stablecoins.

Sam: Why does it need crypto? Cards work fine.

Alex: For a very specific new thing: agents paying other agents tiny amounts. Picture one piece of software paying another a fraction of a penny to do a little task. The old card networks were never built for a billion transactions worth half a cent each.

Sam: Whereas crypto rails can handle the machine-to-machine micro-stuff.

Alex: Right. And whoever provides the default rail for that "machine economy" sits underneath an enormous slice of every future transaction. Now — the other camp does this differently. OpenAI and Stripe built a "Shared Payment Token." A one-time, store-specific credential that lets ChatGPT trigger a payment without ever exposing your actual card.

Sam: So two camps, two answers, same question.

Alex: Same question — who's allowed to spend your money and on what proof — and both racing to make their answer the one every store builds against. Whoever wins that becomes the default.

Sam: Okay. Identity, payment. What's the third layer they kept?

Alex: The third is where the agents actually live, and where you actually meet them — the runtime, and the assistant on top of it. Remember that narrow Google product I said we'd come back to? The one literally called Agent Substrate?

Sam: Yeah.

Alex: It's a piece of infrastructure for running agents at insane density. The number that stuck with me: it's designed to spin up three hundred little agent sandboxes per second, per cluster, built for "hundreds of millions of registered agents."

Sam: Hundreds of millions. Of agents. That number is doing a lot of quiet work.

Alex: It tells you the scale they're planning for. But — and this is the pivot — the runtime is still plumbing. The real prize sits on top of it. Which brings us to the only layer that ends up mattering to a normal person.

Sam: The front door. You've been dangling it since the cold open.

Alex: The front door. Let's finally walk through it.

Sam: So before you do — let me try to connect it back, because we've covered a lot. The giants gave away the connectors. They kept three things: who the agent is, how it spends, and where it lives. And you're saying all three of those are really in service of one final thing.

Alex: That's the Russian-doll structure of the whole story, yeah. Every layer underneath exists to serve the assistant — the thing a human actually talks to. And here's the historical rhyme. In the web era, the entry point was the browser and the search box.

Sam: And owning the search box was worth, what, a trillion dollars?

Alex: More. Because it owned the moment of intent. The exact instant you decide you want something. That's the most valuable moment in all of commerce — and Google owned it.

Sam: And in the agent era, that moment moves...

Alex: Inside the assistant. The instant you say "I need running shoes" out loud to your AI, that's the moment of intent, and it now happens inside whoever's assistant you're talking to. So every giant is building theirs to be the place you start.

Sam: And someone's being unusually blunt about wanting that, I assume.

Alex: OpenAI. Almost naked about it. In October 2025 they launched something letting third-party services — Spotify, Canva, Zillow, Expedia — run inside ChatGPT. So you never leave.

Sam: Like apps inside the chat.

Alex: Sam Altman literally described it as turning ChatGPT into a kind of "chat operating system." An app store, woven into an assistant. The single surface you reach everything else through.

Sam: So ChatGPT wants to be the phone, basically. The thing all the other apps live inside.

Alex: That's the ambition, stated out loud. Microsoft frames the same goal as the "open agentic web" — they've got a thing pitched as "HTML for chat," a few lines of code to turn any website into something an agent can just talk to. And Google's version is a single destination where a company builds and governs all its agents.

Sam: They're all building the same front door, just with different branding.

Alex: Same door. And there's a layer just beneath it that almost nobody sees but everyone's racing to own: the registry.

Sam: Registry meaning... a list?

Alex: A directory. The catalog of which agents and tools exist, and which ones you can trust. Google built one right into its enterprise product — the central place a company stores and governs all its agents and tools. OpenAI shipped its own. And the wider market already has a dozen of these — agent galleries, skill libraries, the lot.

Sam: And here's the analogy that unlocked it for me — registries are the app stores of the agent era.

Alex: And that's the trap exactly. App stores are where the platform sets the rules and takes its thirty percent. Owning the directory means owning discovery — which is the modern version of ranking first on Google. If you're not in the registry, or you're buried in it, you don't exist.

Sam: So that's another quiet chokepoint. But wait — doesn't that cut against everything we just said? They gave away the protocol that lets agents find each other. Doesn't open discovery undercut their own private registry?

Alex: You've just spotted the live tension. There's an emerging standard that would let agents discover capabilities out on the open web — directly, without ever going through any one company's registry. And that standard is quietly a threat to exactly the chokepoint the registries are built to be.

Sam: So even within one company you've got the "give it away" instinct fighting the "own the tollbooth" instinct.

Alex: In the same building, on the same week. That contradiction is the whole industry in miniature.

Sam: So now I'm picturing this totally locked-up world where five companies own every door and every directory and take a cut of everything. Is that where this lands?

Alex: And here — this is the surprise I promised — here's where the early evidence complicates the giants' dream. Because they assumed they could cut everyone else out. Own discovery, own checkout, own the customer, and reduce every brand — every Nike, every Walmart — to a faceless supplier feeding an assistant they don't control.

Sam: And let me guess. The brands aren't thrilled about becoming faceless suppliers.

Alex: The brands are fighting back, and customers are handing them the weapon. There's research from Bain with a number that genuinely surprised me. Shoppers trust a retailer's own agent about three times more than a third-party agent to actually complete a purchase correctly.

Sam: Three times. Huh. So I trust Walmart's own assistant to get my Walmart order right more than I trust some general AI middleman.

Alex: By a factor of three. And so Walmart built its own assistant, named Sparky, plugged it into the AI layer — but kept the basket, the customer data, the whole relationship inside Walmart. Sephora's doing the same, tying everything back to its own app and loyalty program.

Sam: So it's not going to be one assistant to rule them all.

Alex: That's the real forecast. Not total takeover. A contested, blended world. Some shopping flows through the big assistants, some stays inside brand-owned agents, and the actual war — underneath every "agentic commerce" press release — is over who owns the customer relationship.

Sam: Which is the single most valuable asset a business has.

Alex: The single most valuable asset in business, full stop. The front door is not won yet. And that — that's exactly why all five of them are sprinting so hard. The prize is still on the table.

Sam: Okay. So I want to make this real, because we've been at thirty thousand feet. Walk me through what this actually feels like when it reaches me. And then I want the catch, because there's always a catch.

Alex: There's a catch, and it's a big one. But let me give you the dream first, because on a good day it's genuinely magical. You tell your assistant: I need running shoes, under a hundred dollars, by Friday.

Sam: One sentence. That's all I do.

Alex: That's all you do. Behind the glass, your agent uses a new Google discovery system — think of it as a "robots.txt for agents," where any business just publishes a little catalog file at a known spot on its website, and the website's domain itself becomes the proof it's really them.

Sam: So the agent goes shopping at all the legit stores.

Alex: Talks to their agents, pulls the product details, builds you a cart. You glance at it and tap approve — that approval is a signed Cart Mandate, the price locked. A Shared Payment Token passes a one-time credential so the shoe store charges you without ever seeing your card number. The shoes show up Friday.

Sam: And I touched none of it after the first sentence. Okay. That is magic. So what's the catch.

Alex: The catch has a name, and it's wonderful: the "confused deputy."

Sam: The confused deputy. Explain.

Alex: So your agent is walking around the internet carrying your authority. Your tokens, your mandates, your permission to spend. It's like — okay. Imagine you give your house key and your credit card to an incredibly capable but very literal-minded personal assistant.

Sam: Fine so far.

Alex: Now imagine a stranger on the street can shout instructions at your assistant, and your assistant, being literal-minded, sometimes just... obeys. The attacker doesn't need your key. They just borrow your assistant — and your assistant has your key.

Sam: Oh, that's horrible. So someone hides a command somewhere my agent reads it, and my agent does it — with my money and my permissions.

Alex: That's the confused deputy exactly, and it's not theoretical. In April 2026, Microsoft assigned a formal security vulnerability number to precisely this — a hidden-instruction attack in one of its agent products. And security people noted how unusual it was to even assign a formal ID to this kind of attack — which is a sign the industry's only just now admitting these are real software flaws, not edge cases.

Sam: So this is new enough that they're still figuring out it's a category of bug.

Alex: Right. A security coalition mapped nearly forty distinct ways to attack these systems. And here's the part that really lands for me. Even after you perfectly solve identity — even after the agent can prove exactly who it is and what it's allowed to do — it can still be a confused deputy.

Sam: Wait, why? If you've nailed identity, isn't that the whole problem solved?

Alex: You'd think. But here's the gap. The tools the agent uses check its credentials. They do not check its intent.

Sam: Ohh. So the mandate proves I said "buy shoes." It does not prove I didn't mean for some hidden instruction on a sketchy webpage to redirect the order.

Alex: You just nailed the single hardest unsolved problem in the field, in one line. The signature proves what you authorized. It cannot prove that a whisper from an attacker didn't hijack the how. Identity and payment protocols are necessary — and they are not sufficient. And everyone serious knows it.

Sam: So that's the honest version of where we are.

Alex: That's the honest stakes. Done right, this substrate keeps you in control — every action traceable to a permission you actually signed, every agent's power scoped and revocable, and when something breaks, you can see exactly what happened and who's accountable.

Sam: And done carelessly?

Alex: Done carelessly, it's a layer that hands away control by default. Where the pressure of convenience nudges everyone to sign broad standing permissions they never read — "yeah yeah, buy whatever, here's my card" — where the liability for a bad purchase is buried in some protocol spec nobody reads, and where a single hidden whisper can spend money in your name.

Sam: And the choice between those two worlds is being made right now. By a handful of companies. Mostly in private.

Alex: By a handful of companies, mostly without anyone watching. And that — far more than which AI is the smartest — is what's actually at stake. So let me pull it together, because we covered a lot of ground.

Sam: Please. Give me the three things I walk away with.

Alex: One. The giants are cooperating — sharing the protocols, the connectors, the plumbing — and that cooperation is not a truce. It's the loudest possible signal that the plumbing was never where the money was. You give away what you can't own.

Sam: Two?

Alex: Two. The money and the power are in the three layers they kept and did not share: the identity that proves an agent is really yours, the payment mandate that authorizes it to spend, and above all the assistant — the single front door to your life. Whoever owns that door owns the customer relationship everyone else now has to rent from them.

Sam: And three.

Alex: Three. The thing to actually watch — for yourself — is not which AI tops a benchmark, and it's not the size forecasts either. The forecasts, by the way, are all over the map — one firm says a fifth of digital commerce runs through agents by 2030, another puts the US market at a few hundred billion, another reaches into the trillions.

Sam: That's a wild spread. From hundreds of billions to trillions.

Alex: Which tells you the numbers are basically noise — nobody knows. The signal isn't the size. The signal is the architecture. So the real thing to watch is whether the default settings of these systems keep you in control: explicit, scoped, revocable permissions and clear accountability — or whether they quietly trade your control for convenience. Because that architecture is being finalized right now, and you'll be asked to sign that first standing mandate sooner than you think.

Sam: And honestly — I came in thinking this was a story about boring infrastructure, and I'm leaving thinking it's a story about who I'm going to be handing my house keys to.

Alex: That's the whole thing in one line. The companies wiring your wallet to your assistant have told us exactly which pieces they're keeping. And the question worth asking — of them, and of ourselves, before we sign that first mandate — is whether the front door they're building opens only for us, or also for whoever learns to whisper to our agents.

Sam: That's a chilling place to land. And the honest answer is we don't know yet.

Alex: We don't know yet. And that's exactly what makes it worth following this closely. It's a genuinely fast-moving, complex picture with a brutally short shelf-life on what we think we know — and that's precisely why it's worth your attention. I hope you came away seeing a little more clearly where all of this is heading. If you've enjoyed it, please consider giving us a follow.

Sam: And a quick note, for full transparency: this show is AI-generated.

Alex: It is. Dan builds a custom stack of AI tools to chase the questions he can't stop thinking about — it started out made with NotebookLM, and it's now produced with his own engine — mainly so he can learn this stuff himself, and he publishes it for anyone who'd like to listen along.

Sam: Thanks so much for spending the time with us.

Alex: We'll see you in the next one.