AI has two battlefields.
- Horsepower is the first.
- Right of way is the second: permission to act, the yes that lets AI click, buy or send for you. Sites grant it with bot rules, you by signing in, and IT by switching tools on.
Earlier this month I sketched a picture of where I think AI is heading.
Higher intelligence is higher horsepower. But horsepower needs highways. I see two arterial roads: cloud AI to the web, and cloud AI to the work inside your organization. My view is that both roads need far more bandwidth, and the opportunity sits with whoever widens them.
The objection
It appears the AI browser experiments have already failed. OpenAI launched its Atlas browser on 21 October 2025 and shut it down on 9 August 2026, about nine and a half months later. It moved what it calls “browser-based agentic capabilities” (AI that clicks and types in a browser for you) into ChatGPT and Codex.
In ChatGPT, that means a browser inside the ChatGPT desktop app, with a Chrome extension alongside, the path Claude had taken. The in-app browser can browse sites, log in to accounts and interact with pages, TechCrunch reported. The extension, OpenAI’s current help pages say, lets ChatGPT “read or act on sites where you’re already signed in”. Anthropic’s Claude in Chrome took the extension route first: piloted with 1,000 Max plan users in August 2025 and generally available since 26 August 2026.
HUMAN Security’s data splits agent traffic by product, from April to July 2026.
Only the vehicle failed
In short, there is room to improve how AI agents reach the web, but building a browser was not the answer, at least not for OpenAI and Anthropic. Why not? I will take that up in a later post. What matters here is that even as both stepped back from their own browsers, the web itself has been changing fast. Agent surfers are arriving.
Look at what the gate owners have been doing. On 1 July 2026 Cloudflare announced that from 15 September, sites on its default settings would block AI training bots and bots acting for a person on pages that show ads. Default settings here means new sites, plus free-plan sites that had not changed their settings. Search bots would still pass, it said.
The chart below shows how many news sites have shut their doors to OpenAI’s crawler since 2023.
Cloudflare also published a way for agents to sign their requests, called Web Bot Auth. It is now a working draft at the IETF (Internet Engineering Task Force), the body that writes internet standards, with authors from Cloudflare and Google. A site can check the signature and admit the agents it trusts. The decision to let an agent in stays with the site.
Visa and Mastercard have announced programs for registered agents at checkout: Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay.
In September 2026, Amazon reportedly blocked Meta’s shopping agent, Muse. Press reports say one reason was that the agent did not identify itself as an agent.
In Korea, Naver’s terms forbid logging in by bot or macro without prior permission.
Meanwhile Browserbase, which runs web browsers in the cloud for AI systems to use, claims it runs 35M+ browser sessions a month across 10,000 customers.
Nobody builds gates for traffic that isn’t coming.
Here is the automated share of the traffic Imperva sees, year by year.
Three gates
Right of way has three gates.
- My door key: passwords and passkeys, kept by Apple, Google, Microsoft or 1Password.
- What I handed over to my agent: sessions, permissions and preferences, and sometimes a stored payment method, held by ChatGPT, Claude, Gemini, Comet, Aside or their browsers. It’s like the entry code and note Korean delivery apps give couriers.
- The protocol of the house, which applies to humans and agents alike: site rules, Visa and Mastercard at checkout, and Cloudflare in front of about 26% of the top 10 million sites (W3Techs, September 2026).
The delivery picture needs a word for readers outside Korea. There it is common to type your building’s shared-entrance code into the delivery app with each order, along with a note for the courier. The app passes both on, so the courier gets into the building without the resident. The courier never gets my door key.
Gate 1 stays on my side for now. An AI outside the device cannot yet carry a passkey. The FIDO Alliance, which sets passkey standards, formed a working group in April 2026 to define how agents could be given delegated access. It has published no standard yet. When Gemini in Chrome or Claude signs in to a site for me, Google and 1Password say the password never reaches the AI model.
Inside a company, IT holds all three, through tools like Microsoft Entra or Okta. Those tools let IT manage people’s and agents’ access in one place.
A cooperation problem, not an engineering one
Atlas had horsepower and a vehicle. But this is more of a ‘permission’ problem, a cooperation problem than an engineering one. There are several layers of gates, and thousands of them, each with its own owner. Thousands of stakeholders, each with a say. Like how Google Maps took years to map the world, street by street.
Lanes for agents are being built too, and the official MCP registry lists them.
My read, and it is only inference: gate 1 cannot yet be handed over, gate 2 is mine to give, and gate 3 is not mine to give. So I think the decisive seat in the connection war, the fight for right of way, goes to whoever holds two of the three gates or writes the rules of one.
The rough space
Some gates are simply shut against agents altogether. However, I doubt blocking outright is where it ends. I doubt the tide can be turned.
Among HUMAN Security’s customers, blocking rose and then eased in 2026.
Korean apartments already went through a version of this. Some complexes kept the couriers and added ID checks. Sites are heading the same way: admit registered agents and check them on every visit. In Cloudflare’s scheme, Cloudflare approves the agent’s operator, and the agent signs every request with its own key. Under Visa’s protocol, merchants check each agent’s key against Visa’s key store, and a signature is valid for at most 8 minutes. I think the shift is as hard to stop as the delivery economy was.
What comes next
The sketch near the top of this post sorts the key players into four boxes: incumbent or challenger, standalone or integrated. The incumbents are the Web Browser and the Web Browser Extension. The challengers are the AI Native App and the In-app browser. In Part 2 I will ask why the standalone browser was not the answer, and which box holds two of the three gates.
Which gate is your AI stuck at right now?
