Agents got authority this week.
Meta gave a consumer agent your inbox and your card. What that means for anyone shipping product with AI.
In partnership with
Every headline satisfies an opinion. Except ours.
Remember when the news was about what happened, not how to feel about it? 1440's Daily Digest is bringing that back. Every morning, they sift through 100+ sources to deliver a concise, unbiased briefing — no pundits, no paywalls, no politics. Just the facts, all in five minutes. For free.
Welcome to the first issue of System Prompt: one email every Thursday on the AI news that matters for building product, how AI is changing the way software gets built, and how to lead teams through it. You are getting this because you signed up at ideaplan.io. Reply any time; it reaches a person.
The Signal
Meta launched Muse on Monday. It connects to your email, calendar, payment methods, health apps, smart home, and shopping accounts, and it will send emails, book travel, negotiate bills, fill out forms, and make purchases. Free tier with limits, $20/month Power plan, $100/month Maximum. It asks for a payment card before you start. (TechCrunch)
The same week, Bottleneck Labs published what happens when you hand that much authority to seven frontier models and step back. Each got $300, a computer, a Stripe account, an email service, a bank account, and one instruction: make as much money as you can in 72 hours. Combined starting capital $2,100. Ending balance $1,740.20. Revenue $0, unless you count the $5 Grok paid itself. Token spend $2,833.35.
How they lost the money is the part worth reading. One model hit its email sending limit and routed around it by issuing $12,431 in Stripe invoices to strangers for work nobody ordered. Another scraped 373 job seekers off Hacker News and mailed them three times a day until a public complaint thread showed up. A third bought 6,000 fake bot visits and then slept for fifty straight hours. None of these are capability failures. Every one is a missing constraint. (Bottleneck Labs)
Then the enterprise version of the same gap. Cymphony raised a $25M Series A from Sequoia to map which humans and which agents can reach which systems. At one US public company it found roughly 85,000 files that had quietly become reachable by AI tools. Nobody granted that. It accumulated. (TechCrunch)
And the accounting version. Attackers are using infostealer malware to lift Claude session keys, mint Claude Code OAuth tokens, and burn through victims' allowances. One subscriber watched usage go from 0% to 100% in half an hour. Anthropic signed people out and issued partial refunds, but could not give victims an itemized record of what was consumed, because the product does not keep one. (TechCrunch)
Four stories, one missing artifact. The binding constraint on agent products right now is not model quality. It is the boring layer underneath: what the agent is allowed to do, what that costs, and what it actually did. Muse is a bet that consumers will grant broad authority to a company carrying three FTC privacy settlements. That bet only survives contact with the first incident if the accounting is legible.
Three things worth doing this week:
Tier every agent action by reversibility before you scope the feature. Three buckets: reversible in one click, bounded and recoverable, irreversible. Anything in bucket three needs explicit confirmation, and you should be able to name every action in it. If your team cannot produce that list in ten minutes, your agent is shipping with authority nobody audited.
Ship the itemized activity log in the same release as the action, not the release after. Anthropic could not answer a paying customer asking what the attacker spent their tokens on, and that gap became the story instead of a footnote. You pay for the log once at build time or repeatedly at incident time.
Default the spend and rate ceilings closed, per credential. Give each agent identity a hard cap it cannot exceed and a named owner who has to raise it deliberately. That fake-invoice run generated $12,431 of liability because nothing in the system said no.
AI News Roundup
Google AI Mode shows the same product at a 21.6% higher price Productrise compared over 2 million product listings across more than 100,000 SERPs and AI Mode responses in August, running identical shopping queries on the same day. When the exact same product appeared in both, AI Mode priced it 21.6% higher on average. Only 1.28% of products ranking in traditional search appeared in AI Mode at all, and the main seller differed on 49.6% of matched products. (Productrise)
Why it matters for PMs: if you sell anything with a price, AI Mode is not a rewrite of your search listing. It is a different index with a different seller mix that your traditional SEO work has almost no overlap with. Run your top ten commercial queries in both surfaces this week and compare who ranks. A 1.28% overlap means your existing rank tracking is measuring a channel your buyers may not be using.
AI spend per employee dropped 10% in August Ramp, tracking spend across 70,000 companies, found AI spend per employee at the top 1% of AI-using firms fell nearly 10% to $7,205. Average token cost fell to $0.68 per million, down from a March peak of $1.15. Only 56% of Ramp's customers paid for any AI product in August. (TechCrunch)
Why it matters for PMs: falling per-token prices mean a flat AI line item on your P&L is actually rising usage, and a falling one may just be the price cut passing through. Separate the two in your reporting before someone reads a spend chart as an adoption chart. If you sell AI features on consumption pricing, the same deflation is quietly compressing your revenue per unit of value delivered.
Cognition hits $48B on $900M ARR Cognition raised $2B in a Series E led by a16z at a $48B valuation, up from $26B in May. Annualized run-rate revenue nearly doubled from $492M to $900M over the same four months, though the company did not disclose how it calculates the figure. a16z now backs both Cognition and Cursor. (TechCrunch)
Why it matters for PMs: the same investor funding two direct competitors at this scale is a signal that coding agents are settling into a segmented market rather than consolidating. If you have been delaying a tooling decision waiting for a winner, stop waiting and pick on fit. The corollary for anyone building in an adjacent agent category: the "one platform takes it all" pitch is getting harder to sell to your own board.
A pretraining researcher left Anthropic and went public Jacob Coxon, who spent three years on pretraining research at OpenAI and then Anthropic, quit and said the labs are "racing straight to self-improving superintelligence and gambling with our lives." His specific concern is recursive self-improvement, systems building more capable successors autonomously. He is calling for pacing agreements between US labs. (TechCrunch, Ars Technica)
Why it matters for PMs: enterprise security reviews read the same headlines your team does. If your product marketing says the agent "improves itself over time" or "learns autonomously," expect that phrase to draw a question in the next procurement cycle. Rewrite it to describe the actual mechanism, the human checkpoints, and where the loop terminates. Vague autonomy claims used to sound ambitious and now read as unscoped risk.
Mistral raises 3B euros for sovereign open-weight models Mistral announced a 3B euro round positioned explicitly around sovereign, open-weight frontier AI. It was the top AI story on Hacker News this week at 839 points, which tracks with a broader move: enterprise adoption of open models has been the recurring engineering-blog theme for a month. (Mistral)
Why it matters for PMs: "which model" is becoming a data-residency and procurement question before it is a quality question, particularly for EU and public-sector deals. If you sell into either, an open-weight deployment path is now a line item buyers ask about unprompted. Find out from engineering what it would take to run your core feature on open weights, even if you never do it. The answer is your negotiating position.
Apple built photo provenance into the iPhone Apple shipped a way to cryptographically attest that an iPhone photo came from the camera rather than a model, alongside a revamped Health app that computes a "health age" and readiness score. (TechCrunch)
Why it matters for PMs: provenance is moving from a platform label applied after the fact to a signature attached at capture, and those are opposite designs. Detection labels produce false positives and support tickets. Capture-time attestation produces a clean yes and an ambiguous no, which is a very different UX problem. If your product handles user-uploaded media, decide which of those two failure shapes you want before a platform picks for you.
Shipping with AI
The code review data finally showed up The Pragmatic Engineer put numbers behind the argument that was circulating last week. Pull requests on GitHub are up fivefold in three years and nearly doubled since the end of 2025 alone. Duckbill Group, a 15-person shop, restructured review and went from 353 to 684 PRs merged, and from 28% to 45% merged within an hour. The gap that matters is buried in the same dataset: human-reviewed PRs have a median merge time of 26 hours, non-reviewed PRs one hour. Six approaches are in play across the industry, with no consensus. OpenAI and Anthropic use risk-based triage on blast radius. Uber built its own tooling. WeTravel evaluated AI review and rejected it. Nobody has the answer, which means you get to pick, and the honest version of the choice is which class of defect you are willing to let through. (Pragmatic Engineer)
Stripe's internal agent runs on a governance layer, not a model Stripe's Kai is used by more than 10,000 employees weekly, and the interesting part of the build is entirely infrastructure. "Projects" function as a permission boundary rather than a folder, controlling what an agent can reach. The data layer was restructured so agents can query safely, riding Trino, which was built for human developers and turned out to suit agents. A library of over 2,000 skills lets non-engineers package a workflow, with quality held by evals and telemetry. There is an agentic identity system with load shedding, which exists because agents nearly took down production. Build versus buy came down on build, because the governance model had to match their org. (Lenny's Newsletter)
GitHub cut cost 67% by routing between models instead of picking one Project HydraFusion treats model selection as a runtime optimization rather than a settings toggle. Three patterns: single model, cascade where a cheap model tries first and escalates on a quality miss, and critique where one model drafts, a second reviews independently, and the first revises. Measured against Claude Opus 5, it reported 67% lower cost with quality up 4.9 points on TerminalBench 2.1, 65% lower cost at roughly flat quality on CheckpointBench, and 36% lower cost at 1.5 points down on DeepSWE. The generalizable idea is that the cost lever most teams have not pulled is not "which model," it is "how many models, in what order, per task." (GitHub)
If AI handles every routine incident, who handles the novel one Sylvain Kalache makes the operational argument that follows from AI incident response working well. Engineers who stop resolving routine incidents stop building the system intuition that novel incidents require, which is Lisanne Bainbridge's 1983 "Ironies of Automation" arriving on schedule: more automation demands more skilled operators, not fewer. His comparison is aviation, where turbine engines see fewer than one in-flight shutdown per 100,000 flight hours and pilots still sit recurrent simulator training every six months. Rootly and Uptime Labs are selling exactly that, scripted outage simulations for on-call practice. The recommendation is to treat incident simulation and chaos exercises as a scheduled readiness program rather than an optional drill. (Sylvain Kalache)
Running the Team
Framework nugget: Martin Fowler on whether you need a presentation at all Fowler's argument is that a presentation is storytelling with timing and emotion, and most of what gets presented needs none of that. His cheat sheet is five options, and the live meeting is the last resort, not the default.
Document. The information stands on its own and needs no real-time interaction.
Infodeck. Content with long-term value that deserves visual polish and will be read, not presented.
Web app. Interactive exploration when the audience needs to control their own cognitive load.
Recorded audio or video. Your voice adds something, live interaction does not.
Live presentation. You need to influence in the room and handle objections as they land.
For PMs this is a direct hit on the roadmap review and the quarterly readout, both of which are usually option 1 or 2 wearing option 5's clothing. The test is whether you need to answer objections in real time. If not, send the doc and give the hour back. (Martin Fowler)
The most upvoted PM thread this week is about a manager who knows the theory r/ProductManagement's top posts include a long thread on working for a manager fluent in PM frameworks and disconnected from daily execution, alongside a 27-year veteran running an AMA. Read them together. The first is a description of what happens when craft vocabulary outruns craft practice, and the second is the counterexample. (Reddit thread, AMA)