Shopify signed two rival AI agent protocols as Gumloop's browser enters sites without opt-in
On October 6 Sierra and Meta announced an OAuth standard that lets businesses recognize personal agents and set what they may do. The same day, YC-backed Gumloop shipped an agent browser that signs into any site with saved credentials, no opt-in required.
Vincent Jiang · 3 min read
Two doors opened the same day
On October 6, 2026, two rival ways for AI agents to enter a website arrived on the same day 12. Sierra and Meta announced Personal Agent Protocol: the agent identifies itself, the customer grants read-only or write access over OAuth, and the business picks the door, its site, its APIs or its own agent 1. Gumloop's changelog logged an Agent Browser that lets agents "click, type, sign in, fill forms, and download files on any site, with or without a connector" 2. The protocol asks the business for permission; the browser asks the password vault.
| Door | Who is attached | State on October 7 |
|---|---|---|
| Personal Agent Protocol (Sierra and Meta) | Genesys; NiCE and Decagon on Meta's guest list, Instinct on Sierra's; Shopify quoted in the announcement | Spec only: v0.1 promised later this month, no license or governing body named |
| Trusted Agent Protocol (Visa) | Stripe; Shopify | Announced as the rival standard |
| Agent Browser (Gumloop) | Enterprise customers Gusto, Instacart and Shopify; Shopify also an investor | Live: signs in with saved credentials, no site opt-in |
The toll both sides are pricing
Sierra closed a $950 million Series E in May at a valuation above $15 billion 13. Gumloop, a Y Combinator W24 company 4, raised a $50 million Series B led by Benchmark in March 25. Both are pricing agent traffic: Gartner, cited by Genesys, expects agents to consume the majority of APIs at 80% of organizations by 2028, up from under 20% in 2026 3. For a merchant, the fight decides which door that traffic arrives through: a named agent holding a scoped grant, or a login indistinguishable from an employee's own.
Gumloop sells the traffic the standard wants to police
The Agent Browser does not wait for a spec. Agents sign in with saved logins or through 1Password, browse from "trusted connections in the region you choose," clear CAPTCHAs and record every session, on sites that never opted in 2. The launch drew 426,800 views across 12 sources in under a day 6. Gumloop's receipt is Gusto, which credits its agents with more than $1.5 million of added ARR in three months 2.
Shopify holds keys to both doors
Shopify's product chief Mani Fazeli is quoted in Sierra's announcement on how agents and merchants can work together 1. Four days earlier, Y Combinator named Shopify a Gumloop enterprise customer alongside Gusto and Instacart 4. Shopify itself bought into Gumloop's Series B in March 5. It is also on Visa's rival Trusted Agent Protocol, alongside Stripe 7. One company, every seat at the table.
The revenue sits on the protocol side
The protocol camp already books AI revenue at scale, and Sierra, the smallest of the three AI vendors at the table, co-wrote the standard 3. The two sponsors could not agree on one guest list: Meta's adds NiCE and Decagon, Sierra's adds Instinct 3. Amazon has blocked Meta's Muse agent over scraping and sued Perplexity over agents it says were concealed 8. Taylor, who chairs OpenAI, leads the initiative and calls the traffic "kind of chaos," yet OpenAI and Anthropic are not on board while Meta's Muse outranks ChatGPT on Apple's App Store 8.
The front-door camp already books AI revenue; the bypass camp is unpriced
Data
| Value | |
|---|---|
| Genesys (Cloud AI ARR) | $400M |
| NiCE (AI ARR) | $362M |
| Sierra (total ARR) | $150M |
Neither door is finished
The standard has no text yet: v0.1 is promised later this month, and no license, governing body or production deployment has been named 19. The browser works today, but a site cannot tell a trusted agent from a scraper, the exact worry that got Muse blocked 38.
Watch what Shopify ships
Until v0.1 lands, the toll on agent traffic is unpriced. The tell is production: whether Shopify, Walmart or Stripe build the handshake in while their own teams keep logging agents in with saved passwords. Shopify has now signed two agent protocols and invested in the no-opt-in door 157. Watch what ships, not what signs.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
