One personal assistant can carry several different kinds of user authority

A personal agent can read a connected account, remember its contents, fill a shopping basket, request payment approval and later retain notes from the task. Those are not one permission. The October product documentation makes the boundaries different enough that "the user authorized the agent" is an incomplete security description.

OpenAI Dots is documented as sharing plugin permissions with ChatGPT, Work and Codex. OpenAI says Dots may read permitted sources and retain private notes for proactive work, while direct sending, connected-content edits and computer control are not capabilities of the proactive flow as described. Disconnecting a source prevents new reads but does not automatically delete information already received. The important distinction is between ability to fetch data and authority to produce a side effect.

xAI Grok Bot describes multiple bot roles using one user's shared cloud computer, browser sessions, files and CLI credentials. Deleting a role does not necessarily erase that shared state. Two named bots therefore need not be two isolated security principals. The product's documented approval rules should be evaluated at the shared execution account, not inferred from the separation of personas.

Meta Muse is another connected personal agent, but its public product description does not prove that every third-party checkout or merchant-side dispute workflow can distinguish the human from a delegated browser process. A connected session can authenticate access without binding the user to a particular item, amount or final confirmation. That is an authorization question, not a claim that Muse was found exploiting merchant sites.

Anthropic's Claude Duet preview describes a virtual computer and approvals for sensitive effects. Its separate Link by Stripe instructions say a user approves a maximum amount, after which a one-time card is merchant- and amount-scoped; the merchant completes the charge, and recurring payments are excluded. This is a concrete attempt to separate an AI-proposed purchase from payment authority. The dated Duet News item explains the implementation described by Anthropic. No independent adversarial test of merchant substitution, display integrity or replay was included in the scoped evidence.

A task may be perfectly legitimate while a particular execution is not. A commerce agent can compare prices and add items without an unconditional mandate to pay, send a complaint, or modify connected records. Effect-bound approval is the relevant design question: which principal authorized which merchant, amount, destination and action, and which enforcing component binds those values at execution?

Forter's merchant telemetry recorded growth and changing mixes of classified agentic checkout activity. Its different October snapshots have distinct windows and cohorts; they cannot establish millions of distinct worldwide buyers or a global fraud rate. Screen scraping also changes what the merchant can verify compared with a protocol carrying explicit agent information. Neither interface guarantees valid consent just by existing.

Finally, memory experiments remind us that saved context and live connector permission are different states. Preventing future access to a service is not equivalent to invalidating already retained content, and personal memory is not the same as organization-shared instructions.

For any proposed agent action, the practical inventory is consequently four separate questions: what may be read, what may be retained, what may be proposed, and what authority is required to execute. Vendor documentation answers parts of that inventory; it does not substitute for an adversarial assessment of the final effect.