OpenAI's Dots and Decagon's Gateway Make Your Next Customer an Agent

On September 29, OpenAI used its developer conference to launch Dots, always-on agents that pursue a user's goals in the background "with minimal oversight," and take instructions through ChatGPT, Slack and Teams, per TechCrunch. Two days later, at its Dialogues conference, Decagon shipped what it calls a Personal Agent Gateway. The software sits in front of a company's support channels and spots when the party on the other end is a personal AI agent instead of a person. It then routes the agent to a lane where the business decides what it may do. Decagon named three agents it expects to meet there: Meta's Muse, Instinct and OpenAI's Dots.

Decagon CEO Jesse Zhang wrote in a launch post that these agents already book, buy, cancel and negotiate for the people who run them. "Personal agents will become a major interface between customers and businesses," Zhang wrote. Decagon sells into that market, so treat the claim as a forecast. The product details are more concrete. The gateway tries to detect agents across existing channels, including ones that don't announce themselves. Decagon is also proposing a protocol, PACT, under which an agent proves whom it represents and what it's authorized to do, within permissions the business sets. The company's release says sensitive actions still go back to the account owner for approval. Its named customers include Delta Air Lines, American Airlines, Deutsche Telekom, Ticketmaster and Hertz. Their support queues are full of the errands an agent would take on first, above all rebookings and cancellations.

OpenAI built the agents, and Decagon built the door they knock on

It would be easy to file this as one more support channel, the way vendors once added chat and then voice. Every channel a CX team has run until now assumed a human on the other side, and its controls were built around human limits. Hold times, retention scripts and the escalation to a manager all work because a person gets tired or gets talked into a discount. An agent with a goal and a cloud computer does none of those things. It can wait on hold for three hours and retry the cancellation flow a dozen times. It can check the save offer against a competitor's price before its owner even looks at their phone.

Dots is the supply side of that problem. OpenAI made it available to ChatGPT Pro and Business Premium subscribers, with a $500-a-month tier attached. The product is designed to keep working on a task after the person stops watching. Meta's Muse is already testing the other side of the counter. NBC News reported on September 29 that Meta lists Walmart among Muse's partners, though some retailers blocked Muse in NBC's own tests. Put the launches side by side and the customer who reaches your support line next quarter may be software a person set loose and forgot about.

This lands on GTM teams before it lands on IT, because the errands agents take on first sit closest to revenue. A cancellation is a churn event and a rebooking is a margin decision. A price negotiation goes further, because it’s a sales conversation run by software on the buyer's side against whatever your side has.

Research on agent negotiation says the stronger model takes the margin

That last point has evidence behind it that doesn't come from a vendor. Researchers from Stanford, MIT, Google DeepMind and USC benchmarked agent-to-agent negotiation across 100 real consumer products. They pitted nine language models against each other as buyers and sellers. Outcomes depended heavily on which model each side ran. Sellers on a weaker model earned 9.5% less than they would have against an evenly matched buyer. Some buyer agents ignored the budget their user set, with the weakest small model breaking it in nearly 12% of trials. The study was peer-reviewed at an ACL 2025 workshop, but live markets may behave differently. Still, it names the two risks a CX leader now owns. Your own agent can give away margin to a sharper agent across the table. And the customer's agent can agree to something its owner never approved, leaving you with a transaction the customer may dispute.

The second risk is where liability comes in. Say a customer's agent accepts a downgrade or cancels an annual plan, and the customer later says the agent had no authority to do it. Someone eats the loss. Most companies have no written answer to whose loss that is, because nobody planned for the counterparty to be software. In Decagon's design, the agent states its authorization and the business decides which actions still need the human owner. That tries to settle the question at the door, before it turns into a chargeback.

Amazon blocks Muse because its business runs on human shoppers

The opposite strategy is already in market. The Wall Street Journal reported this week that AI agents aim to change shopping and that some retailers are locking the doors. In September, Semafor found that Amazon blocks Muse while Shopify lets it in, and the split follows each company's revenue. Amazon sells the attention of human shoppers to advertisers and wants them on its pages. Shopify earns from storefront software, fulfillment and financing, so it gains when any buyer gets through. Semafor's reporter also tried to rebook a Delta flight through Muse and ran into a bot-blocker. Delta is on Decagon's customer list. So one company can stop agents on one surface while its support vendor builds them a gateway on another. The policy question is still unsettled, even inside a single enterprise.

Blocking has a case beyond protecting ad inventory. An unidentified agent looks exactly like a scraper or a fraud bot. A support team that waves agents in before it can tell them apart is opening a door to account takeovers as well as errands. Retention economics argue for blocking too. A save offer is designed for a person who hesitates, and an agent sent to cancel won't hesitate.

Blocking only holds while customers have no alternative, though. Once a meaningful share of them delegate, a support line that refuses agents hands the errand back to a person who already decided not to do it. That customer reads the friction as the brand's choice. Payments reached this point first. In October 2025, Visa and Cloudflare introduced a way for shopping agents to sign their requests cryptographically. One tag covers browsing and another covers an authorized payment, so a merchant can let a known agent compare prices and still demand proof before it charges a card. Decagon is drawing the same line for support, letting agents ask while the business scopes what they can change. Instead of choosing between blocking and allowing, the card networks built an identity layer and let merchants set rules on top of it.

On October 6, Sierra and Meta announced the Personal Agent Protocol, an open standard they're developing with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart for how personal agents sign in and act at a business. Customers choose whether their agent gets read-only or write access, and the company sets what the agent may do through its website, its APIs or its own agent. The protocol isn't live yet, and Sierra says it plans to publish the v0.1 specification and a reference implementation later in October. Decagon open-sourced PACT and joined the working group the same day, so two rival support vendors are now helping write that identity layer.

Visa, BILL and Billtrust said on October 20 that they had launched the first live pilot in which AI agents pay approved B2B invoices through supplier portals. BILL's payment agent is registered through Visa's Trusted Agent Protocol and pays with tokenized card credentials, and Billtrust's portals authenticate it without a CAPTCHA or a shared login. It's a pilot with no volume figures, and the agent only pays invoices a buyer already approved, which makes it the B2B version of the identity layer described above, approval rule included. The support-side counterpart is the allowlist in Sierra's Poppy draft.

What this means for CX and sales leaders

B2B gets this next. The personal agents in the news are consumer products. But an agent that can cancel a streaming plan can also renew a software seat, open a support ticket, request a quote or push back on a price increase. Dots already take instructions inside Slack and Teams at work. A CX or sales leader can be ready without buying a gateway this quarter. What they need is a written policy that answers three questions for every action a customer can take today through a human channel.

Start with what an identified agent may do on its own. Order status, password resets, invoice copies, address changes and plan details are low risk. Refusing them just pushes the customer to a slower channel. Next, decide what needs the human owner to confirm. That covers cancellations, downgrades, refunds above a set amount, contract changes and anything else that moves money. Confirmation should happen somewhere the agent can't fake, such as a prompt on the account owner's verified device. Finally, write into the terms of service who carries the loss when an agent exceeds its authority. Do it before the first dispute.

Sales teams need their own version. If a buyer's agent asks for a quote or negotiates renewal terms, decide in advance which discounts an agent on your side may grant without a rep. Log every agent-to-agent exchange the way you'd log a call. The Stanford and MIT benchmark suggests the side with the weaker model gives up margin without noticing.

Then check the queue. Pull a week of support transcripts and flag sessions that look scripted, with identical phrasing or instant replies. Decagon says its gateway catches agents that don't identify themselves, which implies some already arrive unannounced. Finding out whether that's true in your queue takes an afternoon. The answer tells you whether the policy is a planning exercise or an incident report.

My bet is that the first public dispute over a purchase or cancellation made by a personal agent arrives before the end of 2027. Companies with a written agent policy will resolve it under their terms of service, and the rest will work it out in the chargeback queue. The sign I'd watch is whether Delta switches on Decagon's gateway, since its rebooking flow stopped Muse at a bot-blocker in Semafor's test.

A save offer is designed for a person who hesitates, and an agent sent to cancel won't hesitate.

Pull a week of support transcripts and flag sessions that look scripted, then write down what an identified agent may do alone, what needs the account owner to confirm, and who carries the loss when an agent exceeds its authority.

By Business of GTM