A short history of the AI assistant. The capability landed in 2026. The tsunami lands in 2027.
For fifteen years, the AI assistant was a party trick. Then, over about four weeks this summer, it became a user with credentials.
If you own a banking app, run a fraud team, or sign off on a retail checkout flow, this is the part of the AI story that actually shows up in your logs. Here’s how we got here — fast.
Act One: the assistants that couldn’t do anything (2011–2022)
Siri, Alexa, Cortana, and a generation of “conversational banking” chatbots. They set timers and read you your balance. From a security standpoint they were irrelevant, because they lived inside a walled garden and touched nothing. Nobody wrote a threat model for a smart speaker.
Act Two: the assistants that could talk (2022–2024)
ChatGPT changed what software could say. It didn’t change what software could do. An LLM could explain how to dispute a charge in beautiful prose, then sit there while you did it yourself. Still no impact on your login page.
This is where most CISOs’ mental model froze. It’s four years out of date.
Act Three: the assistants that have a browser and your password (2025–2026)
Somewhere between Manus, AutoGPT’s descendants, and OpenClaw, the category quietly swapped its architecture. The new generation doesn’t answer — it acts. And this year three products made it mainstream:
Instinct (Spear Street Technology). No app. You text it or call it, it connects to your email, messaging, calendar, screen, audio, and location, and it books travel, buys groceries and tickets, cancels subscriptions, and sends email on your behalf. Invite-only for now. Its user base passed 100,000 and it’s reportedly in talks to raise $1 billion at a $10 billion valuation — after raising at $2.25 billion in August. The founder’s stat is the one to internalize: users who buy through it spend over $1,300 a month on average.
GrokBot (xAI). Launched in beta on August 11, 2026 — always-on agents, each with a persistent cloud computer running a browser, filesystem and terminal, signing into your existing tools with your own credentials and working multi-step jobs end to end while you’re away, surfacing only when something needs approval.
Muse (Meta). Launched September 8, 2026 — it opens browsers, fills forms, navigates checkout pages, and keeps working after you close the app. It’s reachable inside WhatsApp, and Meta explicitly built it for people with no technical experience. That last clause is the whole ballgame.
The common architecture matters more than the brand names: a persistent cloud VM with a real browser, real credentials, and no human in the loop until a payment or an email needs a thumbs-up. Both GrokBot and Muse converged on exactly this pattern — a dedicated browser, filesystem and terminal per user.
Why adoption goes faster than you’re modeling
The honest answer isn’t the models. It’s that someone finally got the interaction design right.
The 2025 generation put the agent on your desktop. It opened a browser and showed you its work — every click, every page load, every hesitation. That is a terrible product. You sit there watching a cursor move at half your speed, and three minutes in you take the wheel back and do it yourself. Transparency sounded like trust. It actually just meant you were still the one waiting.
The new generation lives where you already text. You send a message. You get a thumbs-up. You put your phone down and get on with your life. It comes back when it needs a decision or when the thing is done. Muse and Instinct run inside WhatsApp and keep working after you close the app; GrokBot’s agents keep going with your laptop shut.
That’s not an incremental UX improvement. It’s the difference between operating a tool and having an assistant — and it’s the same interaction people already understand from having a human PA. There’s nothing to learn, which is precisely why Meta built Muse to work out of the box for people with no technical experience.
Here’s the part that should make application owners sit up. Once the experience is this good, your app stops being a destination. I don’t expect to visit an airline website again. Not because it’s bad — because I have someone to do that for me now, and I no longer care what the booking screen looks like. Multiply that across banking, insurance, utilities, retail, ticketing.
Your customer isn’t choosing a worse version of your app. They’re choosing not to see it at all.
So what does this mean for you?
Here’s the uncomfortable translation.
Your UI is being rendered to a model, not a person. This is the one application owners haven’t priced in. Every “are you sure?”, every cross-sell, every consent screen, every progress bar and reassurance message you’ve ever designed assumes eyes. An agent doesn’t read your merchandising. It doesn’t feel your trust cues. It parses your DOM, finds the cheapest option that matches the instruction, and moves on. Your carefully optimized funnel becomes an API you never designed, documented, or rate-limited.
Your friction is now a coin flip. A step-up challenge an agent can’t pass isn’t security — it’s an abandoned cart with a paying customer on the other end. A step-up challenge it can pass silently isn’t security either. Every control you built to slow down attackers now also decides whether legitimate delegated business completes. Nobody in your organization currently owns that tradeoff.
Your humanity signals are measuring a robot that’s supposed to be there. Mouse dynamics, typing cadence, device motion, dwell time — the whole behavioral layer was built on the premise that a legitimate session has a human in it. A legitimate Muse session doesn’t. “Not human” and “not authorized” have quietly stopped being the same thing, and most risk engines still treat them as synonyms.
Your customers are handing out credentials at a scale no awareness training anticipated. And the terms can be eye-watering: early Instinct testers found the product required a perpetual, irrevocable license to access, store, reproduce, transmit and modify their materials, including for model training. One prominent tester reported it sent an email on her behalf without asking first. Your customer’s inbox — the one you send OTPs to — may now be readable and actionable by a third party they onboarded in ninety seconds by text.
Prompt injection becomes a fraud vector on your pages. When the thing reading your checkout is a model, your product copy, error strings, and anything user-generated on your site become attack surface aimed at someone else’s agent acting as your customer. You’re not just defending your app anymore. You’re a potential weapon against your own users.
Blast radius is not what the marketing says. GrokBot’s launch page promised each Bot “its own computer,” while xAI’s own documentation said all of an account’s Bots share one, and warned twice not to treat separate Bots as a security boundary. Read the docs, not the landing page — that will be the recurring lesson of this category. Some vendors are taking it seriously: Muse keeps real credentials outside the agent’s runtime entirely, showing it only placeholder tokens and injecting real secrets at the network boundary, which makes credential theft via prompt injection structurally pointless. The gap between the best and worst security models in this category is enormous, and your customers cannot evaluate it. You’ll inherit whichever one they picked.
And you can’t tell any of this apart today. Not agent from human, not Muse from GrokBot from a scraper, not a delegated purchase from account takeover. Blocking indiscriminately costs you customers who spend over $1,300 a month through their assistant. Allowing indiscriminately means unattended sessions with a browser and a card on file. Both choices are currently being made for you, by default, by a bot-detection rule written for a different decade.
The one question to ask on Monday
You have roughly one holiday season before this stops being a curiosity in your logs.
So don’t start with “what’s our agentic AI policy.” That’s a 2027 conversation and you’ll write it badly without data.
Ask this instead: how many logins, sessions, and transactions last month were initiated by an agent rather than a person? which agent? What were they doing, how, and why?
Almost nobody can answer that today. Not because it’s unanswerable, but because nobody instrumented for it. The signal is there in the JS SDK and the API layer: agents fingerprint differently, fail differently, and navigate differently than humans do. You just have to be looking.
The assistants stopped talking and started acting. The capability is already in your logs — a trickle you can still study calmly. In twelve months it won’t be a trickle, and the only teams who’ll be ready are the ones who started measuring while it was still small enough to measure.
