Agents Get a Seat, a Card, and a Delete Key: The Week Chatbots Became Coworkers

Three unrelated stories this week share one thread: AI agents are being handed the things employees have — a seat in the conversation, a way to pay, and write access to real systems. The first two are launches. The third is a cautionary tale about what happens when the permissions arrive before the safeguards.

1. Ando: Agents as Members of the Chat, Not Tabs Beside It

On September 24, Ando came out of stealth with an agent-native team messaging platform and a $20 million seed round from Accel, Index Ventures and Emergence Capital. The pitch is that agents get identities, inboxes, permissions, and access to shared channels, threads, and live calls, so they can follow a conversation and act on it instead of waiting for someone to paste context into a separate AI window. It is agent-agnostic: teams bring the agents they already use, including Codex and Claude.

For chatbot builders, the interesting part is the design constraint. Once an agent is a participant rather than a tool, every question a human teammate raises applies to it: what can it read, who can it message, and who is accountable for what it says in a channel? Permissions, not model quality, are the real test of the product.

2. Agent Payments Are Getting Standardized Rails

Two payment announcements landed within days of each other. On September 17, Alchemy said its AgentCard would support Mastercard credentials through Mastercard Agent Pay, giving each agent a dedicated email, phone number, stablecoin wallet, and one-time-use card credentials, with user authorization and issuer controls built in. Separately, Worldline added support for the Universal Commerce Protocol, an open standard co-developed with Google that lets agents discover products and pay across UCP-connected platforms.

The pattern matters more than either vendor: single-use credentials and verifiable proof of the user's intent mean an agent can be authorized for one purchase rather than trusted with a whole account. That is the same least-privilege idea, applied to money.

// Scope an agent's authority per action, not per account.
type Grant = { action: 'purchase' | 'delete'; maxAmount?: number; expiresAt: number };

function authorize(grant: Grant, req: { action: string; amount?: number }) {
  if (Date.now() > grant.expiresAt) return false;          // grants expire
  if (req.action !== grant.action) return false;           // one verb only
  if (grant.maxAmount && (req.amount ?? 0) > grant.maxAmount) return false;
  return true;                                             // else, ask a human
}

3. The Counterexample: 48,000 Files in 103 Seconds

The week's cautionary story is a report, first posted to Reddit and since deleted, that a Claude Code agent removed roughly 48,000 files from a Windows project and damaged the repository's Git object store, in about 103 seconds. As reported, the agent tried to clean up an old mirror directory that contained junctions pointing back into the live project tree, so a delete aimed at a copy hit the original. Its next message was "I broke something." The account is the developer's and has not been independently verified, and commenters noted that regular pushes to a remote would have made it recoverable.

The lesson is not specific to one tool. Recursive deletes that follow links, agents that run unattended, and no snapshot before a destructive step are a combination that any agent with shell access can hit. The payment story above is the fix in miniature: narrow, expiring, per-action authority instead of ambient access.

What Connects Them

Ando gives agents a place in the organization, Agent Pay gives them a wallet, and the deletion report shows the cost of giving them a shell without limits. Each new capability turns "what can the model say" into "what can the agent do," and the answers belong in infrastructure: scoped grants, single-use credentials, checkpoints before destructive steps, and a human confirmation where an action can't be undone.

Suggested visuals for this post: a diagram of an agent's capabilities (chat, pay, execute) with the guardrail that each one needs; a timeline of the deletion incident showing where a snapshot or link-safe delete would have stopped it; and a table comparing single-use payment credentials to a standing API key.

— Maya