AI Agents Still Can't Order You Dinner. They Can Already Run Your Back Office.
On October 30, DoorDash’s CEO was asked on the earnings call how many orders AI agents were placing. His answer was refreshingly blunt. Third-party agents like Meta’s Muse had placed maybe several hundred orders in total. In the same quarter, DoorDash handled 993 million orders.
A few days later, a post from a San Francisco tech worker went viral after her tests found that AI shopping agents could browse and compare, but kept failing at checkout, where bot defenses and fraud systems treated them as threats.
It’s easy to read this as proof that agents are overhyped. I think that’s the wrong lesson. Agents aren’t failing because the technology doesn’t work. They’re failing in one specific place, for one specific reason. And understanding that reason tells you exactly where agents will work in your company, starting now.
Why shopping agents stall: they’re uninvited guests
Think about what a shopping agent is actually doing. It arrives at a website that was built for people, pretends to be one, and tries to spend money with a login that belongs to someone else. Every security system the business has built over twenty years was designed to stop exactly that.
So the businesses on the other end are reacting the way you’d expect. Amazon is blocking personal agents, while Walmart has rolled out a red carpet for them to win business from competitors. Banks are more cautious still. On JPMorgan’s earnings call, Jamie Dimon said the bank is “not gonna allow just any agent to come” inside. Bank of America has told customers that if they hand their login to an agent, they’re responsible for whatever it does.
None of this is irrational. From the business’s side, an agent with a customer’s password is indistinguishable from an attacker with a customer’s password. Until there’s a reliable way to tell them apart, blocking is the safe default.
That’s the specific reason consumer agents stall. The model can read a menu and fill in a form just fine. What it can’t do is get permission from a system that never agreed to let it in.
Inside your company, the agent is invited
Now picture the same technology doing work inside a company. The difference isn’t the model. It’s that every system the agent touches has agreed to let it in.
The agent has its own account, created on purpose, instead of a borrowed customer password. It connects through proper integrations instead of pretending to be a person clicking around a website. Its access is set by the company that owns the systems. And someone inside the company is responsible for what it does.
Under those conditions, agents already work well, and quietly. At GG Group Media, a Lithuanian digital marketing agency, four agents run most days across Slack, Jira, Bitbucket, and Confluence. One turns Slack conversations into properly structured Jira tickets. One writes code for simple tickets assigned to it. One reviews that code. One keeps documentation up to date and answers the team’s questions with links to the right pages. None of it would make a viral post. All of it gets used.
That’s the pattern. The agents that are struggling are the ones knocking on doors that were built to keep them out. The agents that are working have been handed a key.
The lesson: start where you hold both ends
If you’re deciding where agents fit in your company, the DoorDash number is genuinely useful. It tells you to start with work where you control both sides: the agent and the systems it acts on.
That usually means internal work. Your project tracker, your CRM, your documentation, your internal chat. You decide what the agent can reach, you give it its own credentials, and you can see everything it does. No bot defense will block it, because you’re the one who invited it.
It also means being skeptical of first projects that depend on someone else’s cooperation: agents that log into suppliers’ portals, place orders on public websites, or act inside a customer’s systems. Those may well work in a few years. Today, they mostly run into the same walls the shopping agents hit. The other side hasn’t agreed to let them in, and you can’t make them.
I’d put it this way. Consumer agents are a bet on the rest of the internet changing its rules. Internal agents are a bet on your own company, where you already make the rules. The second bet pays off much sooner.
DoorDash’s CEO put the balance well. You don’t want to fight where the technology is going, he said, but you don’t want to be delusional about where it is today either.
Meanwhile, agents are coming to your door
There’s a flip side. Sooner or later, your customers’ agents will start showing up at your website, portal, or booking system. Several hundred orders is small, but it isn’t zero, and it will grow.
The good news is you have time to decide how to treat them, and the tools are starting to appear. A proposed standard called Web Bot Auth lets an agent prove which company runs it, and according to the bot-protection company DataDome, Meta’s Muse has been signing some of its requests that way since around mid-October.
Three practical steps for now:
- Find out what happens today. Ask whoever runs your website what your bot protection does when an AI agent arrives. It might block it, let it through, or be unable to tell it from a person.
- Watch for agents that identify themselves. Agents that sign their requests are telling you who’s responsible for them. Those are the ones you can make rules for.
- Decide your policy before you need it. Should a customer’s agent be able to check an order status? Change a delivery address? Pay an invoice? The answers will differ, and they’re business decisions, not just technical ones.
Notice the symmetry. When your agents act on your systems, you want them identified, scoped, and logged. When other people’s agents act on your systems, you want exactly the same things.
The bottom line
The agent that orders your dinner is coming, but slowly, and on terms the rest of the internet hasn’t agreed yet. The agent that turns your Slack threads into tickets, drafts your Friday report, and keeps your documentation current is already here. It works because it’s invited.
We should say we’re not neutral. We build Agent Barn for exactly that second kind of agent. It runs on your own infrastructure, gives each agent its own scoped credentials for the systems you choose, and records everything it does in your own database. In other words, it’s built for agents that have been handed a key, not ones trying to pick a lock.
If you’d like to find the work in your company where an invited agent would pay off first, tell us about one workflow worth automating.